I recently watched Keith Barker's demonstration on how to detect malware with different features of the free REMnux...
tool. Do you have any other free antimalware tools you'd suggest using to find malware on infected machines?
One of the best places to find free information security tools is SecTools.org's Top 125 Security Tools list, which rates both antimalware tools and rootkit detectors. It's periodically updated based on feedback from the information security community. SANS also has a short primer on malware analysis that includes additional tools. However, note that many of these tools require significant knowledge about the systems under investigation, and it may be best to use these tools in a lab setting before doing so in the field.
I have found that some of the most useful tools for beginners conducting malware analysis are the Windows Sysinternals tools. Note that security teams should always analyze malware on a test/isolated system because it is likely that the system will become infected. Organizations could conduct these tests in a virtual machine, but some advanced malware is able to detect a VM and will then behave differently. You can use the filemon tool to monitor what files are accessed by the malware, or regmon tool to monitor access to the registry. By monitoring file and registry access, you can get a better idea of the activities occurring on your systems. You could then use process explorer to take a more in-depth look at the running processes from the malware.
There are two basic types of tools that can be used to find malware on an infected machine: one set of tools will look for known malicious signatures or behavior while the other will be for an advanced user to investigate in-depth to identify advanced malware on an infected machine. Signature- or behavior-based tools are often the commercial tools from McAfee, Symantec, etc. or open source tools such as ClamAV. Many times the advanced tools will be highly customizable, or feature a general toolkit that may take significant effort to use, such as Microsoft system internal, or Sysinternals, tools.
Ask the Expert!
Want to ask Nick Lewis a question about enterprise threats? Submit your question now via email! (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
Island hopping attacks create enterprise risk by threatening their business affiliates. Here's how to create an incident response plan to mitigate ... Continue Reading
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.