How to Know If Your Computer Is Infected

These days malicious software is becoming an epidemic. It seems like it’s everywhere. Also, sadly, there's been a change in the way malware acts. It used to be that it would slow down your computer, or display annoying popups, but now malware is becoming increasingly discreet. You could be infected right now and not even know it. Also, sadly, it often seems as if the only way to make sure you’re not infected is to scan your computer with numerous anti-malware programs. Doing this can be time consuming and, while scanning, may even slow your computer to a crawl. Even after that you still can’t be sure you're clean. This is because scanners cannot recognize all new malware. The only other feasible option that I had heard of is to have someone else examine your computer. Generally this would be done online via scan logs, but this is also time consuming and not 100% reliable.

Because of these difficulties I have come up with a better method. This uses multiple programs, not to remove files, but just to analyze the computer. Each of these programs is very effective. They are all portable applications and will not cause any conflicts on your computer because they are only running when you're using them. However, they do require an active internet connection to function properly. After you have already gone through the below process once, and had all files whitelisted, this approach is much faster, much more certain, and much easier than any other approach I've seen. No type of malware can escape this process. I've never seen another method that could boast of that. However, some of the methods described here may seem very difficult, or even above your level of expertise. I promise that these methods are not nearly as difficult as they seem. Some may require a little bit of effort on your part, but they are certainly doable. In fact, after doing it once the process will become much easier the second time. This is very useful as most people will want to be able to ensure that their computer is clean at all times, not just once.

I also want to stress that in order to make sure that your computer is not infected you must follow each step. None of these programs is meant to be used independently. Each depends on the others to account for different infection scenarios. Also, if any step shows definite evidence of an infection, after your investigation, you should move directly to the last section. There is no reason to continue your investigation as your computer is already found to be infected.

However, if your computer passes all 3 tests below then you can be about 95% certain that it is clean. I would be nearly 100% certain, but there's currently a minor bug with Comodo Autoruns which makes analysis more difficult.

Simplest Way To Follow This Advice

The simplest way to go about following the following methods is to go through each process and, instead of manually making sure each file is safe, just submit all unknown files to Comodo for analysis. Instructions for how to do this are given below. After submitting these files all that is required is for you to sit and wait for them to complete their analysis (although this could take anywhere from a few days to a few weeks depending on the number of unknown files). You won't have to do any analysis of your own.

Index

1. Check for Rootkits
2. Use KillSwitch
3. Use Comodo Autoruns
4. Cleaning Any Infections

1. Check for Rootkits

It's important to ensure that there are no rootkits sitting on your computer. First scan your computer with Kaspersky TDSSKiller. The download link is near the bottom of the page. TDSSKiller will scan your computer for some of the most common types of rootkits. I've found it to have relatively few false positives and a very high detection rate. By the way, some scanners, including Comodo Cleaning Essentials, may detect this file as a dangerous file. It's not. This is a safe download link. It's just that the behavior of the program seems suspicious. If it is detected you can safely ignore the detection and continue on with the rest of the methods. As with every program in this article, I recommend that you do not delete any files using this program. A false positive on the wrong file could destroy your computer, even if you’re not infected.

To use this program, download the file and unzip it. Then open the file called TDSSKiller. Next select the option to “Start Scan”. This scan should take less than a minute. If it does not find any rootkit activity then you should next check your computer with Comodo Cleaning Essentials.

Now select the option to do a smart scan with CCE. To do this click on the icon for "Smart Scan". This will scan your computer for all types of malware, but we are specifically interested in its ability to identify rootkits. It will immediately begin downloading the most recent virus database, which may take a long time to complete. Once it has completed downloading it will immediately begin scanning. The scan should not take too long to complete. As before, I recommend that you do not delete any files using this program. One problem with this program is that I do find it to have a few false positives. Thus the best option, in order to be sure of the results from it's scan, is to report any files detected as dangerous, that you believe may be safe, to Comodo for analysis. You can do this by reporting them as a false positive on this page. Just select false positive and fill out the required information. Comodo analysts will get back to you by email with the results of their analysis.

After the scan is complete it will ask you to restart your computer. Allow it to restart. Do not open any unnecessary programs as this will make step 2 simpler. Just as another reminder, do not remove any files with this program. Once it restarts it will pop up with the final results. If it did not find anything, and neither did any of the above methods, then you can continue on to the next step.

For anything either of these programs does detect, I would advise that you navigate to the path given by Kaspersky TDSSKiller, or CCE, and investigate the files using the methods described in How To Tell If A File Is Malicious. However, for rootkits this is not always possible depending on how well the file is hidden. For those of you who are tech savvy you can attempt to follow the advice given in this post on the Comodo forums. However, another option is to post your results in a new topic you create in this section of the Comodo forums. Be sure to also mention the results of everything you did above. Of course, you can also post this in other security forums. However, it will likely be useful to create an account for the following steps, so you may as well post it in the Comodo forums. You will definitely get help in figuring out what’s going on with your computer.

2. Use KillSwitch

Again open Comodo Cleaning Essentials (CCE) and go to "Tools". Then select the option to  "Open KillSwitch". KillSwitch which will immediately begin analyzing all your running processes. This analysis should only take a minute or so. The reason I asked you not to open any other programs in the above step is because malware will nearly always run on system startup, while many legitimate programs will not. Thus there will be fewer potentially dangerous processes to examine.

Without waiting for the analysis to complete you can go to “View” and select “Hide Safe Processes”. This will hide all processes that are verified to be safe by Comodo. Once the analysis is complete all that are left are those programs that are either believed to be malicious or are unknown. Be aware that unknown does not mean dangerous. It only means that the file has not yet been whitelisted by Comodo. If KillSwitch now shows that “There are no items to show”, then your computer passed this part of the tests. You can move on to part 3. However, if there are files remaining then you should analyze them. To get to the file right click on the process in question and select “Jump to Folder”. This will open up the folder where the associated file is located and select the file as well. Then you can follow the methods described in How to Tell If a File Is Malicious.

Please note the option to analyze them by submitting them to Comodo to be added to the whitelist. This is very effective, especially as it will also help make future scans much easier to evaluate. Also, as KillSwitch uses the same virus database as CCE, it has a relatively high false postitive rate. Thus you should report any files detected as dangerous, that you believe may be safe, to Comodo for analysis. You can do this by reporting them as a false positive on this page. Just select false positive and fill out the required information. Comodo analysts will get back to you by email with the results of their analysis.

If your analysis shows that the file is safe, or you truly believe the file is safe, I would recommend submitting the program, or file, to Comodo for whitelisting. Instructions for how to submit programs, or individual files that belong to programs, can be found in this topic of the Comodo forums. Make sure you read through the first post entirely and follow all recomendations. This will ensure that your request is completed as quickly as possible. These submissions will be analyzed by Comodo staff and, if appropriate, added to the whitelist. However, in order to submit programs, or files, you do need to have an account on the Comodo forums. If you don't already have one then it's very easy to get one. There is an option to register on the top of any page on the Comodo forums.

If you submit all the safe programs on your computer for whitelisting then, once they're whitelisted, the next time you scan with KillSwitch there should not be any more unknown processes for you to examine. Thus, it becomes an incredibly easy task to ensure that your computer is still clean of infections. In fact, my computer always shows a completely blank screen after selecting the option to “Hide Safe Processes”. This allows me to ensure that my system has passed this test in less than one minute. Once you're done with this part you can close KillSwitch.

3. Use Comodo Autoruns

Now, through CCE, which should still be open, again go to "Tools". This time select the option to "Open Autorun Analyzer". This program will analyze the registry and show you the files associated with each item. Almost all malware will write to the registry. Thus, by scanning for all files associated with registry entries, this program can identify malware and unknown files, even if they aren't running. It may even be useful in identifying rootkits, although that is not its primary purpose. The downside to using this program is that it will likely give you more files to check than the above methods. However, if you really want to be sure that your computer is clean then this step is also necessary. As before, do not delete/disable anything with this program as it can be very dangerous if used improperly. We are only using its analytical abilities. Please do not use it to try and clean up any infections or you could inadvertently harm your computer.

After Comodo Autoruns opens it will immediately begin compiling the list. This process could take a couple of minutes to complete. Without waiting for the list to finish being compiled you can go to “View” and select “Hide Safe Entries". Note that this option will now be prechecked every subsequent time you run the program. Once the list is compliled Comodo Autoruns will automatically begin analyzing each entry. Wait until all entries have been analyzed. If this is the first time you have run this program, you should now close it and then open it again. I find that this often allows Comodo time to analyze some of the unknown files so that this time there will be less to check. If Autoruns now shows that “There are no items to show”, then your computer passed this part of the tests. If it also passed all of the above steps then your computer is clean and you no longer need to worry.

However, if there are still entries left over you should begin analyzing them. To get to the files that these entries are associated with right click on an entry and select “Jump to Folder”. This will open up the folder where the associated file is located and select the file as well. Also, with this program you will find that often a single file has numerous entries, which means that there’s not nearly as much analysis to be done as there would seem. You can analyze these files by using the same methods described in How To Tell If A File Is Malicious. Please note the option to analyze them by submitting them to Comodo to be added to the whitelist. This can be very effective, especially as it will also help make future scans much easier to evaluate. Also, like above, Comodo Autoruns has a relatively high false postitive rate. Thus you should report any files detected as dangerous, that you believe may be safe, to Comodo for analysis. You can do this by reporting them as a false positive on this page. Just select false positive and fill out the required information. Comodo analysts will get back to you by email with the results of their analysis. 

If your analysis shows that the file is safe I would recommend submitting the program, or file, to Comodo for whitelisting. You can do this by following the same process described above. Once again, make sure you read through the first post entirely. If you submit all the safe programs on your computer for whitelisting then, once they're whitelisted, the next time you check there should not be any more unknown entries for you to examine. Thus, it becomes an incredibly easy task to ensure that your computer is still clean of infections. In fact, my computer always shows a completely blank screen after selecting the option to “Hide Safe Entries”. This allows me to ensure that my system has passed this test in just a few minutes.

4. Cleaning Any Infections

If any of these methods do show that your computer is infected you should check out How to Clean An Infected Computer. Following this advice should allow you to remove almost any infection and get your computer back to working order. Once the cleaning is complete I would recommend following the above methods to ensure that all infections were successfully removed.