0

I have a Windows 10 PC that may be infected with malware, possibly with a Trojan. Various scans with antivirus programs and extensive analysis have not yet delivered a conclusive result.

So far, it is known that the malware is already becoming active and doing its malware thing before/without any user being logged in.

I have pulled the disk from the compromized PC and have booted it on another, sandboxed system in order to analyze it. AM currently monitoring its network traffic with Wireshark.

What tool could I use to monitor the PC via LAN or Wi-Fi and record any actions that take place on that PC, like start of executables, network access and the like?

Would this be possible with Remote Desktop Manager for example?

Grateful for tips or experience what best to use here.

3
  • If you're that close to certain that the system is compromised, pull the disk out, put in a new disk, and reinstall everything from scratch. Then, either connect the old disk to a NON-WINDOWS system to do any deep analysis that you can find tools for, or physically destroy it. – Jeff Zeitlin Jun 20 at 19:36
  • I already pulled the disk out and booted it in another, sandboxed system in order to analyze it. – David.P Jun 20 at 20:43
  • Malware often has the ability to detect standard monitoring programs and then remain silent if they are active. – Robert Jun 21 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.