Windows Forensic Analysis Toolkit, 3rd Edition

Chapter 6

Malware Detection

Chapter Outline

Introduction

Malware Characteristics

Initial Infection Vector

Propagation Mechanism

Persistence Mechanism

Artifacts

Detecting Malware

Log Analysis

Dr. Watson Logs

Antivirus Scans

AV Write-ups

Digging Deeper

Packed Files

Digital Signatures

Windows File Protection

Alternate Data Streams

PE File Compile Times

MBR Infectors

Registry Analysis

Internet Activity

Additional Detection Mechanisms

Seeded Sites

Summary

References

Information in this Chapter

• Malware Characteristics

• Detecting Malware

Introduction

If you own or use a computer, at some point malware is just going to be a part of your life. This is especially true for system and network administrators, who are often responsible for managing and ...