Re: what is the best procedure to track down a potentially new virus/worm/etc?

In-Reply-To: <41BF4C2B.5080704@technicalworks.net>

John,

> > It it were UNIX, I could use commands like socklist and netstat to
> > track down the malware processes. But in Windows XP, I don't know what
> > to use. Are there any built-in utilities? Some freeware stuff? All
> > help is welcome.
> This is the link I meant to send :)
> http://www.sysinternals.com/ntw2k/utilities.shtml

While these tools are excellent, they are just tools, and have limitations.  
For example, autoruns.exe (and the CLI variant, autorunsc.exe) are great tools. 
 Pslist.exe, however, does not provide information regarding the path to the 
executable image of the process, or the commandline used to launch the process. 
 When using the SysInternals utilities to collect data, you have to correlate 
between multiple tools (pslist, handle, listdlls) which can be extremely time 
consuming.  

For what the original poster (OP) asked for, all it takes is a tool to get the 
command line of the processes (ie, tlist.exe, from the MS Debugger Tools), and 
openports.exe (for process-to-port mapping...'nestat -ano' can also be used for 
this).  Once he has this information, he will know where the bot is located on 
the system.  Add in autoruns.exe (mentioned above), and he knows which 
autostart location is employed by the bot, if at all.  He can then clean the 
system and attempt to determine the infection vector.

H. Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com