10 ways to detect malware from computer

1. Microsoft Process Explorer (formerly Sysinternals)
Process Explorer provides an excellent way to determine what processes are running on a computer. It also describes the function of each process. More important, you can use Process Explorer to create a baseline of the running processes used by the computer when it's operating correctly. If for some reason the computer starts behaving poorly, run Process Explorer again and compare the scans. Any differences will be good places to start looking for malware.

2. Trend Micro's HiJackThis
HiJackThis is Process Explorer on steroids, making the application somewhat daunting to those of us not completely familiar with operating systems. Still, running HiJackThis before having malware problems creates a great reference baseline, making it easy to spot changes. If it's too late to run a baseline scan, do not fear. Several Web sites offer online applications that will automatically analyze the log file from HiJackThis, pointing out possible conflicts. Two that I use are HiJackThis.de Security and NetworkTechs.com. If you would rather have trained experts help, I would recommend WindowSecurity.com's HiJackThis forum.

Download Free PC Tools Firewall Plus 6.0.0.66

A personal firewall that protects your computer from intruders and controls the network traffic in and out of your PC.

PC Tools Firewall Plus is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC. By monitoring applications that connect to the network Firewall Plus can stop Trojans, backdoors, keyloggers and other malware from damaging your computer and stealing your private information.

PC Tools Firewall Plus is advanced technology designed specially for people, not experts. Powerful prevention against attacks and known exploits is activated by default and advanced users can also easily create their own packet filtering rules to customize the network defenses. All you need to do is install it for immediate and automatic ongoing protection.

Protect and Prevent Computer from Spyware Infection

Spyware is malicious software (malware) that installs itself or runs on your computer without providing you with adequate notice, consent or control. It can monitor your online behaviour or collect your sensitive personal information such as personally identifiable information and passwords. It could as well display annoying popup advertisements, change your computer settings or cause your computer to run slowly. Because spyware does not obtain your consent before installing or running on your computer, and may not immediately display any noticeable symptoms after it infects your computer, you might not actually be aware of its presence in your PC.

There are many sources from which spyware and other malware could be introduced into your system. Spyware is most commonly installed through free software downloads, such as file sharing, screen savers and search toolbars. Also, they could be installed by websites, downloaded programs, or software you might install from a CD, DVD, external hard disk, or other removable media.

Virus - Exploit.PDF-JS.Gen

There are no obvious symptoms until the malware manages to infiltrate the system. This can happen when opening a crafted PDF file and the javascript code inside the file is executed.

Exploit:Win32/Pidief.D; Exploit:W32/AdobeReader.QQ

This is a generic detection for specially crafted PDF files which exploit different vulnerabilities found in Adobe PDF Reader's Javascript engine in order to execute malicious code on user's computer. The exploitation mainly involves the following two functions:
util.printf() - if an attacker sends a string long enough to generate a
stack-based buffer overflow he will then be able to
execute arbitrary code on user's computer with the
same level privileges as the user who opened the PDF
file
Collab.colectEmailInfo() - a stack-based buffer overflow can be
caused by passing a string long enough (at least 44952
characters) as a parameter in the msg field of this
function.

Worm - Win32.Worm.Downadup.Gen

Win32.Worm.Downadup is a worm that relies on the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (MS08-67) in order to spread on other computers in the local network. The authors took various approaches to make this malware especially fast spreading and hard to remove.

SYMPTOMS
Connection times out while trying to access various antivirus-related websites.
Windows Update has been disabled.
Presence of autorun.inf files in the root of mapped drives pointing to a .dll file inside the RECYCLER folder of the drive.

Malicious Advertisements (malvertising)

Malicious ads (also known as “malvertising”) may also be a way for a website to experience a malware attack. Rather than infecting a website directly, the hackers infect an ad network (perhaps even by simply creating an ad that looks legitimate, but actually serves malware to the user). One their malicious ad is in the ad network, it can be presented to users on various websites by the ad network simply rotating through its inventory of ads. This is often a difficult attack to detect on a website.

Example of a malvertising popup imitating anti-virus software

Why Are Websites Being Targeted for Malware Attacks?

The simple answer is that malware attacks on websites are the best way for hackers to distribute viruses. In the past, viruses used to spread via email attachments, or by coaxing users to download and install a malicious file. These have all become less effective and/or too cumbersome for the hackers over time. The preferred
method of distributing viruses these days is by drive-by-downloads from legitimate websites. A drive-by-download occurs when a user visits a web page and malicious
code is automatically and silently downloaded and installed on the user's computer, without any interaction with the user required.

Once the virus is on the user's PC, the hackers have remote access to the computer and can steal sensitive information such as banking passwords, send out spam or install more malicious executables over time.

Web-based Malware Hurts Businesses

What is Web-based Malware?

Web-based Malware is an emerging security threat for websites and web users. Hackers are now planting malicious code on legitimate websites in an effort to distribute viruses to consumers. (This attack is often called a “drive-bydownload”). Once the viruses are installed on users’ PCs, the hackers can monetize those compromised PCs in various ways (including logging users’ keystrokes or using the compromised PCs to send spam email).

The malicious code that hackers inject on websites is Web-based Malware, and it is very different from the typical virus that might infect a user’s PC. Web-based Malware runs in a web browser and often works by embedding in, sourcing in, or redirecting to malicious content from a hacker's website. Web-based Malware can be written in HTML, Javascript, Dynamic HTML, AJAX, Flash, PDF, or a variety of other programming languages. By contrast, a PC-based virus often takes the form of an executable file that runs code directly on the computer's microprocessor as opposed to being interpreted by the web browser. Attackers often use Web-based Malware to infect web pages so that those web pages can serve as distribution points for traditional, PC-based viruses.

Review ESET Smart Security

I love ESET Smart Security and have been using it for over a year. If you ask anyone who is computer “savvy”, they’ll know about (and may already use) ESET.
I’ve reviewed ESET in great detail here. For sake of brevity, I’ll explain the best details in this handbook.

When you first start the program, you will be presented with the simple menu. You can enable the advanced menu by clicking at the bottom of the main menu. The interface for this program is simple and intuitive with a clean dashboard that shows you the most recent statistics from the program. From the main menu, you can see the status of the different modules of ESET Smart Security. If you are going to use this program, I highly recommend running all the modules together. This way, you do not need a separate firewall, anti-spam, or anti-spyware program running in the background.

Review AVG Internet Security

I’ve used AVG for many years on my computers because I trust it and it has always protected my files from malicious programs. AVG is now used by over 80 million users and remains one of the top security programs available today.

As this is your security 101 class, I won’t bore you with the details—I’ll get straight to the point. AVG protects you from:

1. Web browsing threats.
2. Targeted hacker attacks.
3. Viruses and spyware.
   

From AVG’s homepage:

AVG helps you stay safe while you shop, bank online, watch videos, search or surf the web, download music, documents and pictures, and email or chat. Every document or file you download, every web page or link you click on, is scanned by AVG before you open it. Unlike other security products, we stop the threats before they reach your hard drive and become a problem. Safe internet surfing is now possible.

AVG Internet Security also comes with a Firewall, which relies on existing data to determine whether a connection attempt is a threat.

Find and Remove Malware

I recommend antimalware software that I’ve used for years. I highly recommend these programs and am confident they will protect your PC and minimize system slowdowns, which are an all-too-common side effect of security software.

The two programs I recommend are AVG Internet Security and ESET Smart Security. Both of these are paid programs; however, I really feel you get what you pay for and will not be disappointed by either choice. AVG also has a free version and ESET gives you a 30-day trial, which I recommend you take before paying for a license. I recommend either of the two different programs because they will both provide the level of protection you need, not bog down your computer, and are reasonably priced for the level of support included, which is absent with free alternatives.