Malware Detection Methodology

• Scan for running processes

=Use tools such as Process Monitor and Process Explorer

• Scan for registry entries

=Use tools such as jv16 Power Tools 2017 and Reg Organiser

• Scan for running windows services

=Use tools such as SrvMan and Advance Windows Service Manager

• Scan for windows start up programs

=Use tools such as Autoruns for Windows and Winpatrol

• Scan for event log entries 

=Use tools such as Loggly and Solarwinds Log & Events Manager

• Scan for installed programs

=Use tools such as Mirekusoft Install monitor and Sysanalyzer

• Scan for Files and Folders

=Use tools such as SIGVERIF and TRIPWIRE

• Scan for device drivers

=Use tools such as driverview and driver reviver

• Scan for network activities

=Use tools such as Capsa Network Analyzer and Wireshark

• Scan for DNS server setting modification

=Use tools such as DNSQuerySniffer and DNSstuff

• Scan for API Calls

=Use tools such as API monitor and APImetrics

• Run anti-malware scanner
• Document all findings

--if anti virus found then isolate machine from network, it not, update and run anti virus again.