1

Sometime ago I came across this situation:
Windows 7 machine infected with adware, ads tabs opening up in chrome out of nowhere. Pretty invasive stuff. In the end i got rid of it with some malware removal tool (adaware), but that's like the "i'm feeling lucky" approach.

Say it didn't work, there's no suspect browser plugin / extension in sight, so it's some kind of program getting spawned from time to time that opens up stuff in chrome. Let's say we've looked in the usual places (scheduler, startup registry entries, services ...) but found nothing or it's just too messy.

How do you go about tracing something like that ?

Any way to catch the process red-handed, as in some kind of system-wide debugger we can tell to attach itself to any process that tries to exec chrome (or whatever call it is windows uses) so we can look at it before it goes away ?

Any dev / system / RE tool out there that can do that ?

Similar question came up a while back with no good answer.

| improve this question | |
  • First thing I always do is look into extensions/dll's that load with explorer and any other windows startup processes. Those are the nastiest as they are no process by themselves - they use another processs' memory space to execute their dirty stuff. And it's really hard to detect. – Gizmo Oct 9 '14 at 17:39
1

In such cases I use Sysinternals Suite which provides a wide toolset. For your particular scenario try "Process Monitor"

Another good system monitor would be GMER

| improve this answer | |
  • The question is about tracing. How is this going to help ? – lemonsqueeze Oct 9 '14 at 23:21
  • @lemonsqueeze using sys monitor you will be able to find all processes and dlls loaded, so you could search them and find malicious. – ST3 Oct 10 '14 at 12:40
  • define "tracing". To find out which process is responsible, the Sysinternals Suite is a very good toolset. Once you know the process, you can use any debugger to attach and really "trace" around in it what and how its doing it – pHiL Oct 10 '14 at 14:04
  • @pHiL Tracing is like hunting down an animal by following his tracks until you find it. The suggested answer feels more like scanning to me: going through the whole forest hoping to find it somehow. Sysinternals tools are great, but if the adware has infected a system exe or is just not running when i run Process Monitor, how is that going to help ? – lemonsqueeze Oct 10 '14 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.