Investigating Windows Systems

Chapter 2

Finding Malware

Abstract

Analyzing systems for the existence of malware is something we have all encountered and done, as it is a very common request made by clients. There are a number of different things to look at, locations within Windows systems that can be analyzed, and those locations are dependent upon the version of Windows being examined.

Keywords

Malware

Chapter Outline

• Introduction 17
• Finding Malware—Windows XP 17
  • Image Format 18
  • Analysis Goal 18
  • Image Survey 20
  • Constructing a Timeline 21
  • System Time Changes 29
  • Documenting the Malware 30
  • Analysis Summary 30
  • Analysis Points 31
• Finding Malware—Windows 7 32
  • Analysis Goal 32
  • Image Survey 32
  • Constructing a Timeline 33
  • USB Device Analysis 41
  • Analysis Summary 42
  • Analysis Points