Protecting yourself from malware can be difficult, especially when it comes to identifying malware in your environment. Malware has become stealthier, and there are so many elements to check for potential infection that you can sometimes overlook? malicious code without recognizing it.
So, how can you effectively find malware on your PC?
You can rely on antivirus and antispyware tools or use online scanners such as the OneCare scanner to find potential infections. But is this enough?
Besides relying on malware tools, can you see yourself using other tools to scan for malware?
Since several of the recent blog entries have been asking malware related questions, I thought it would be prudent to provide something you can take away with you this time around.
Recently I ran across a thread discussion about checking inactive devices in your ‘device manager’ as a possible way to identify installed rootkits.
I tested this theory by using a command-line version of device manager called DevCon, and found some interesting information , but unfortunately didn’t see anything suspicious to investigate.
If you’re interested in trying it yourself, you can do so by downloading DevCon from http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q311272 .
To use the tool:
First dump your devices that are visible to a file.
devcon.exe find * >file1.txt
Then run the tool to list all files visible and hidden.
devcon.exe findall * >file2.txt
Compare the files.
fc file1.txt file2.txt
Since File compare is limited, I would recommend using a tool such as examdiff, which you can download from: http://www.prestosoft.com/ps.asp?page=edp_examdiff
Try it out, let me know if you find something interesting on a system.