How to know if your PC is hacked? Digital Forensics 101

How do you know if your PC is hacked or compromised or infected by malware? In this video we will introduce you to the field of digital forensics and guide you through autoruns, system internals and more. Join the live Discord Workshop: discord.gg/nxC...
Video sponsor: Intezer. Check out analyze.inteze...
We provide cybersecurity tests & consulting for business: tpsc.tech/
Buy the best antivirus in our tests: thepcsecurityc...
If you want to learn to protect yourself from such threats don't forget to subscribe: www.youtube.co...

[@pcsecuritychannel]

More advanced version of the video, going through RAM forensics with Volatility: kzbin.info/www/bejne/jHyWl6mEe6x0sKc

[@V1c7ori0us]

Great video,I would like to add a small note. When uploading files to Virustotal they are made public meaning everyone can download them. So don't upload files that contain potentially sensitive information/credentials.

[@SuperSohaizai]

Yeah I almost did something similar, so I'm going to push this up

[@Hikari_Sakurai]

They should clearly state it as a warning message before uploading.

[@amogus7]

They get hashed??

[@V1c7ori0us]

@@amogus7 The full file can be downloaded from the API

[@lolitaras22]

@@Hikari_Sakurai "By submitting data below, you are agreeing to our Terms of Service and Privacy Policy, and to the sharing of your Sample submission with the security community. Please do not submit any personal information; VirusTotal is not responsible for the contents of your submission. Learn more.". That's the first thing you read when entering the site, what else they can do?

[@Revan-kq7ih]

Just registered at interzer. I have to say I am impressed by it's capabilites. This does give me a much better feeling when using community fixes to ancient games, that don't run on Windows 10 otherwise. I only wish they would offer the upload of bigger file sizes with the free version, even if one were only be able to upload one big file a month. The installers for some mods tend to be multiple gigabites in size.

[@maestreiluminati87]

@@Unknown_Genius you just have to find the right community, others will usually do scans and scan each file uploaded in their domain but one can never be too careful

[@Klara988]

Yeah somehow I just have a bad feeling about mod community even if it trustworthy there can be still bad guy among them right? I use bitdefender as a AV, right now I am safe but still have a bad feeling about mod in my PC anyway (I download mod from Nexus and steam community I always hate game dev that not fix bug because I have to download fixed patch from modder(which is stranger) instead😞)

[@NightmareRex6]

@@Klara988 its possible yes, more likely wah ti think is to happen is say oen th emodders themselves is infected and dosent know and it speads to the file when its thir turn to work on it. althugh sitse like nexus mods seem to do a virus scan im not sure how good it is.

[@terrylandess6072]

I remember becoming infected with Malware quite awhile back. Using some of these techniques I began eliminating certain files with a specific date. When my system failed to restart and the BIOS(?) gave me missing file names, I was luckily able to find, copy to 3.5"disk, and transfer to the affected system these missing files (which I had deleted). Eventually I was able to get my system running. I made a copy of all the files I wanted to save, and then reformatted the system and reinstalled Windows. WHEW! You live and learn . . . . .

[@terrylandess6072]

@@apdkfjei Did the word 3.5" disk pass you by? They didn't have USB then, but thanks . . . .

[@pcsecuritychannel]

There will be a live discord workshop on Discord right after this video premiers! Join here: discord.com/invite/nxCtSMaP?event=925373517367742496

[@fede6991]

ok

[@_BangDroid_]

Discord wants my mobile number to join, never had that request before

[@abitterberry2149]

A.K.A. What you should do if you waited for the tierlist to choose your AV. I really like this new content! Our ignorance of computer inner workings is the highest vulnerability so teaching us things like that is gold! thank you!

[@gevelegian]

One of my best "antiviruses" is being very aware of my computer, most of the times I found viruses or rootkits just because my fans worked harder than I was used to.

[@asteelcup859]

By the time you notice that it's already too late. Be proactive and *prevent!* A good antivirus (NOT Windows Defender) safe(r) browsing practices, oh - and change all your passwords right now! Who knows if you've had a snooper or keyloggers (those don't consume much resources at all).

[@2rosaleen]

Followed the link, so sad it premieres right before I go to work. Excited to see this video though. I love this channel! ❤️ Yay~

[@pcsecuritychannel]

You can join the discord anyway for future events. Mostly we plan on doing these during the weekends.

[@2rosaleen]

@@pcsecuritychannel I am part of the discord, I appreciate your response~

[@Sica1000]

you could zoom more to the programs, my eyes hurts.

[@75hilmar]

Get a bigger phone 😂 just kidding

[@AtlasVRC]

Would love to see something like this for phones, they are pretty much hand held computers with all kinds of sensitive data that needs protection.

[@Josh_James76]

I agree

[@nlx78]

Yeah, and barely proper AdBlock, having people accidentally click on a miniscule x to close it but actually open up a page that might install something. Thankfully, Russian hackers are kind of occupied now, one less problem.

[@itsme7570]

Keep this series going please!!!! Cyber sec student studying windows workstation RN and learning a lot from you

[@courageousmelon5654]

Senior support engineer at a middle sized European university here: Step one is a bit useless. The standard user really is not gonna be able to distinguish the good from the bad, unless the process is named with "trojan" in it or something like that, which is ofcourse highly unlikely. It will probably cause more concern, because the user will see a lot of "unknown" processes that are perfectly fine and necessary.

[@mcasillasr]

So wich step of this video is for "standard users"? I mean... this channel is focused on "technical users"

[@alu9949]

@@mcasillasr This video is supposed to be for beginners

[@courageousmelon5654]

@@mcasillasr Alu has already said it, but yes... this video is for beginners. It is literally said in the introduction...

[@DFX2KX]

@@PaulTietjens one of the very first things I do on a fresh system install is take a good long look through the processes. certain programs I straight-up know all of their process names (FAH_Core being one that comes to mind because I run fold@home, but there are several that spawn when you open various game-clients, too.)

[@courageousmelon5654]

​@@Unknown_Genius Your Phone is literally the displayname of the app... I don't see your point in this regard. It is the way it should be.

[@malwaretestingfan]

Very interesting video, Leo. Sysinternals AutoRun and Process Explorer are also very helpful.

[@emiyakiritsugu6329]

What r those if I may ask, kind sir~ Something delicious to eat 😋

[@emiyakiritsugu6329]

@@shinjironaosuke7920 Ara Ara~ may I step on you, darling…

[@alangrant5684]

A tip to share: Often look at your Tasks regardless. This will eventually make you very familiar with what should be there and what looks not right.

[@kolbymonroe5569]

you know maleware can inject into system processes. It's called a runtime exploit and this is used to bypass anti-viruses when running. Best way to find maleware on your computer is to monitor network activity. it is much more effective than looking at processes.

[@kolbymonroe5569]

runtime exploits are very common and are easy to code for someone who has some schooling.

[@kolbymonroe5569]

@@Unknown_Genius please speak english

[@alangrant5684]

@@kolbymonroe5569 Who says one can only do one or the other? Run all the anti-malware you want sure, so are you saying it's not worth also getting familiar with your running processes?? I gave a tip that you or anyone can take or leave, but I'm sharing it because it has served me well for over 40 years on computers so far. I can open up my Processes now and know right away what they are and which are new and look suspect. It's not definitive but it really does help.

[@roguewasbanned4746]

Yeah that’s what I do. Any outright weird task will be spotted immediately

[@itenthusiast5988]

Another great video . Have seen and read many videos and articles on this topic but yours seem crisp, content and straight to the point with clear explanations. Thank you

[@d4rknyt]

Great idea for future videos. Very interested and looking forward to them! Thanks for the great content.

[@WirableCrown1]

My FBI agent and I really enjoyed this video, thanks mate!!

[@ohlookgonnacry3897]

😬😂

[@martinchocoo]

I love you The PC Security Channel, please never go away

[@chrisking2196]

Great work Leo as always. Question I also check network activity and traffic as means to check data transferring. I know this was a basic intro into Digital Forensics but this could also used as another tool in the toolbox to detect malicious activity? thanks

[@leovonpoozle9990]

thanx?

[@user-zp5yu6pg6r]

Process Hacker 2 does this. If something is sus, block it with a Firewall and test whether it's working

[@NightShooter87]

This isn't Digital Forensics. It's Cyber Security. The chap who is doing this, has got mixed up. DF deals with criminals using triage, hard drive analytics etc etc.

[@stevemury2348]

The service that you provide humanity Deserves more recognition

[@bobbyb42]

I'm so excited for this series. It's just what ive been looking for

[@stoexposure428]

Thank you for posting this video. This has helped me a lot. Have a great 2022 New Year!!!

[@elmergardner]

Minor suggestion, the text is difficult to read, you should lower the display resolution when recording these videos

[@johnnymiller3793]

Excellent stuff, as a previous I.T. person this video has helped me review over some stuff I have forgotten about just in these past few minutes. Well drawn out and put together.

[@csparty11]

What should i say about this, most people won't notice malware until they get some problems. But if the malware is intelligent it won't show itself and just steal your information or whatever it's suppose to do. It will hook itself in to a windows system file or some popular program file, and uploading this file to a website will only show that a part of the file has been encrypted. Obviously most of that blob will contain the malicious code. Windows Defender or any other scanner won't ever find it. If you're lucky you might see some suspicious traffic but that all depends. All the methods shown sofar won't reveal this kind of malware. So i hope you have something better coming up.

[@Anthony-kj3xw]

There's a saying "Malware can hide but it must run". Everything will unencrypt itself to run in memory, by then hopefully AV can flag something. For really advanced threats, it's gonna be more about noticing abnormal behavioral and execution. But this is good and relevant stuff for intro.

[@dot32]

kinda wild that i've actually walked on the bridge in your desktop wallpaper

[@alipetuniashow]

Love these tutorials

[@kopuz.co.uk.]

or else

[@davidwildermuth6796]

Great Video. Look forward to gaining more knowledge from this Channel

[@kibagami25]

great video please make more and also make some of these videos for people that have been in tech for a while.

[@fistpunder]

I like the way your taskbar icons are centered. could you show how that is done?

[@frikinmaya4301]

i believe that is the default layout on windows 11

[@dylanh333]

Just a random observation: your wallpaper is the Elizabeth Quay pedestrian bridge from the city where I live, Perth!

[@oldrockgeeser9426]

Doesn't anyone ever wonder why the more we get protected the more we need protection. After millions of security updates and many many protection programs VPN and so on everyday we hear that we need to protect ourselves more and more, seems we need to ask questions as to why?

[@jonny6702]

Because things are constantly changing. Each component has other components that it depends on. A part of windows might update, and include updated dependencies, and one of those dependencies could have added a new feature. One small oversight in any part of the chain and a new vulnerability is introduced. An application may depend on 100 different libraries, and each of those libraries could depend on another library to function. You end up with tons of links in the chain and if one of those links have a vulnerability, it can be exploited by bad actors. Nothing will EVER be 100% secure. Never. There will always be vulnerabilities being introduced and patched in a cycle. It's impossible to have the foresight to know that your code can never be exploited. The battle will go on forever, and it only gets more complex. There could be thousands of untapped vulnerabilities in the software on your PC, just waiting to be discovered. Sometimes, vulnerabilities are found in decade old software/libraries. The issue was always there, it's just nobody had found it yet.

[@kaldemvor]

The more complicated technology and programs become, the easier they get to disrupt.

[@lordfatcock]

The people creating the malware are constantly having to improve. So the market is pretty crowded which means developers are gonna go above and beyond to be better. A good example is the cold war or just any arms race. Plus they work 24/7 on finding exploits, the same goes for white hats who are also looking to find those exploits first and close them. Luckily platforms offer cash rewards to find these exploits thus the war goes on.

[@jamiedias]

would love to see more videos on this topic including taking memory dumps and reverse engineering etc.

[@bledlbledlbledl]

The title of the video reminds me of some of the banner-ads I used to see (haven't recently): "Is your PC infected with steathware? Download our special detection utility to find out, and get rid of the viruses" :P

[@freeideas]

OMG this would be a giant project! If ever in doubt, I will just copy my (non-executable) documents off and wipe the HD clean. Actually, I already keep such documents backed up, so I can just skip to the wipe. :)

[@merlina9559]

Malwares can be "Stealth" , meaning that if you run Task Manager the malware will stop until you close task manager. Any idea how to get rid of that ?

[@srimanproductions8396]

using resmon in run is another alternative but takes a a while to master

[@kr-sd3ni]

well, always open task manager, malware doesnt work *taps head*

[@eeurr1306]

@@srimanproductions8396 What does using resmon in run mean?

[@grandtheftautoexpert2040]

@@eeurr1306 You use the resource monitor, and each tab has a set of processes related to the tab e.g. disk tab process with disk usage. Though it's less readable than the task manager, which is why he said it takes a while to master

[@Unlmtdprogress]

Thank you so much. I often get real weird wifi connectivity/disconnects at times or my laptop will suddenly start running the fans really fast and it will at the same time slow down everything.. and it happens in weird cycles-- and im not srue if thats normal, so I thought maybe I was being hacked.. This video and software help quite a bit. Idk if you mentioned the PID thing in task manager but I think thats important too

[@JimCKD]

Τhats a very good vid, or better a very good series of vids, as it seems. Are u planning to do vids about other OS, like MacOS and Android? I think that would have been interesting, too. Anyway, thumps up for your always useful vids! 💯

[@Calisota]

1:55 "Restart your computer - turn it off and on again" I wanna budge in there real quick because thats not how this works. Windows 10 and 11 both dont shut down if you shut down the PC or press the power button on your case. they go in deep sleep. they page all RAM and go into hibernation until you press the power button again. A real reset happens if you RESTART the machine. thats why drivers and windows ask for a RESTART and not a shutdown. if you would just calmly shut down and reboot, you'd end up with mostly the same services running again.

[@davidfishwick5573]

That's true. I found that out when i disabled a service in the registry (it was greyed out in services), yet despite the fact that in services the service now said "Disabled", it was still running! Even though id turned the machine off and on more than twice! Only when i did a restart did it disable, and finally stop launching fully.

[@NhoyBarangay]

I usually do basic cross reference from Task Manager and netstat -no on the command prompt.

[@gautampatel8540]

Fabulous, Helpful & Informative🔥🔥

[@CoolJosh3k]

Text on screen is really small. Even at 1080p in full screen it is hard to read.

[@SylphidUndine]

i immediately recognise the elizabeth quay bridge

[@LemonFalls]

Great video. , I think you could go even further and check packets activity throught a packet sniffer.

[@TheHarway]

Had a bitcoin miner and didn't even know! thank you so much!

[@CYNC33]

KZbin seems to enjoy deleting my comments about this. Just please thoroughly check your computer. Could be more than you think.

[@imbuidoneillloydl.7997]

and also check for task scheduler if there's malicious task and check for startup

[@moh.hamoda]

Great video.. keep running

[@brownlife03]

Alright going to check it out later today my laptop & desktop all in one been acting suspicious

[@sdfffdsf3t]

I’ve seen some more advanced malware which terminates itself when task manager is open

[@IIlIIlIIlII]

Off topic but I'm curious as to why are you using Camtasia to record videos instead of let's say OBS or Shadowplay? I'm just curious. Good video as always!

[@whocares7078]

OBS is trash, That’s about all you really need too know I’ll leave the actual detailed reason out As there’s many lol

[@IIlIIlIIlII]

@@whocares7078 Is it actually trash or you just don't know how to use it? Been my Shadowplay replacement for the past 6 years.

[@hexogenic983]

@@IIlIIlIIlII He quite literally did the "It's bad, just trust me bro" No explanation no nothing. Nice

[@KRAVER_]

OBS is great "IF" you know how to use it

[@ghost-user559]

Is there any way to screen record natively from within Windows using a built in tool?

[@aderitosilvachannel]

This is useful, but it's too basic. Any "decent" malware will have some kind of survival mechanism, that re-registers itself on the system and prevents basic things like these.

[@deephish]

This is a bit basic, most hackers are much more advanced than this. They will install a DLL which is hooked by a system process, running everytime something such as the explorer shell is opened. It will never show up in the task manager because it is a subprocess.

[@Reason_over_Dogma]

This is a beginners video, my guy. It's meant as an introduction

[@-GameHacKeR-]

can't wait for the ZoneAlarm Free Antivirus vs Kaspersky test to see if they behave the same since ZoneAlarm uses Kaspersky ... Doesn't it?

[@GainingDespair]

They do use Kaspersky for signatures, most modern day solutions use multiple means to determine if a file is malicious. Signatures is just a list of known malicious software, it isn't capable of determining if a file is malicious if it's not on the list. Signatures are half the battle really a second line of defense, it's propriety software which is the front line. ZoneAlarm has their own, they do not use Kaspersky for this, just the signatures. Signatures do help speed up scans, and they are handy to have for sure, but signatures mean absolutely nothing at all the first time malware is encountered (zero day), as Kaspersky will have no signature for it. This than falls on their proprietary software to determine if it is safe or not, but once Kaspersky has determined if it is safe or not the signature is added to their list.

[@castlerock7423]

Zone alarm is ok if you use it's firewall or if it comes with it, but Kaspersky has always had exploits in it from what I've gathered.

[@karlwalker1771]

This Is Better Than A murder Mystery :)

[@Morpheus776]

ok you showed were the places are to look for suspicious stuff but i still dont know what suspicious stuff looks like

[@BsktImp]

Will you also cover port scanning?

[@BustedknucklesProspecting]

How do I recover my Facebook business page that was hacked? The hackers removed me from admin on my own page. I need help desperately

[@Biggarou]

Moral of this story is, stay off of janky sites.

[@Jon6429]

Good video but don't forget the router as not every hacker wants to get inside your PC. Some just want free untraceable Internet access. So if your WiFi password is only eight characters long and is the same one that came installed by default, then you might want to change it... along with the internal Admin Password. Occasionally you'll also come across folk still using the WEP encryption settings, it's getting rarer thankfully but it still happens. Be kind to them.

[@highevo]

I have this process called Sink to receive asynchronous callbacks for WMI client application and it has incredibly high memory. More than CHROME. should i be worried this is always running?

[@dipaksinha3669]

Leo haven't done any K7 nor quick heal test ...pls do a video on those 2 product... thanks in advance

[@GorillazMach1]

You should do a video about different task managers. Like anvir task manager. Etc

[@acengland82]

is the software that runs in thee background that can do/monitor all this (or close to it)? or does something like kapersky do it already?

[@JohnDoe-bq5oo]

good series idea , def make more!

[@FernandoZ1]

Hello The PC Security Channel. You use tiny font. I cannot read most of it on a tablet using 1080p. I suggest that you make it much larger.

[@Im_DJ]

Plese make video on how to set up antivirus on pc , you can start from kaspersky both free and paid. Plze

[@userou-ig1ze]

would a simple pi-hole be sufficient to capture potential c2 servers, and how would we identify them? Or is it mandatory for the malware to keep track of dynamic dns', and therefore it's tracable?

[@keepanopenmindlookatallthe2540]

I've found that using pfSense as a virtual firewall and web proxy catches a lot of malware It does take some configuration though

[@liovanio]

1. see if your PC have processes strangers; 2. scan you PC with one antimalware; 3. install one software of security ( i recommend comodo internet security); ...

[@epicmodz1546]

great video, I do need some help as something is stealing my passwords as I am getting log in requests from all over the world and password changes. The discord link is not working and need the workshop help please.

[@hul8376]

Great video!

[@wurf5336]

awesome video! :)

[@OthmanAlikhan]

Thanks for the video =)

[@crispyone2564]

Autoruns is awesome especially for someone learning wtf is actually going on

[@dpro369]

How do you know when your PC is hacked? It's when Indian call center calls you !

[@usamac4108]

Looks like the Discord link has expired.. Will anyone provide an updated invite link to the server? Or was that a temporary server for the workshop alone?

[@rb6725]

I wouldn’t put much faith in the accuracy of this channel viewers. Your antivirus test in December 2021 showed your results but you have not tested those antivirus programs individually for months or over a year. I went back over a year on your channel and could not find a McAfee review either. Professional antivirus testing websites AV Test and AV Comparatives do much thorough reviews and their results are different to yours, to say the least.

[@cyrusreyes4865]

why my disk at 100? is my hard drive broken or something making my pc make my disk 100

[@jpowerw]

Please, enlarge the text! It's not readable on my 24 inch screen!!

[@joelanzo]

What about Process injection where malware could replace a legitimate Process?

[@Xiefux]

if you're using an proprietary OS like windows then you're hacked from the beginning. windows is not safe to use

[@SamualN]

:)

[@malwaretestingfan]

Indeed, even if software like ShutUp10 helps with the privacy issue if you really need to use Windows.

[@andymok7945]

JT needs a time-out for the next 100 years.

[@miamivice966]

I wouldn't use Sysinternals anymore... Flagged as phishing a long time ago.

[@jimbo-dev]

Looks like Windows only content. I wish that was mentioned in the title

[@JCO2002]

Watching this makes me even happier I switched to Linux.

[@bartdaw6681]

I have a Lenovo laptop and every time I get a bios update from Lenovo the laptop slows and becomes choppy for a week, it has been that way since I bought it new.

[@choppedartisan7360]

Yeah. No. Instead of all these. Use a live/rescue disk from a well known security app dev. But, yeah, it won't flag all malicious tasks from task scheduler.

[@gblargg]

Right, video shows how to find if your PC is hacked, unless it's hacked well and it hides itself from the OS.

[@choppedartisan7360]

@@gblargg YES! You are right. It's about hacking, not virus infection. Kudos.

[@Dan.a.k.a.bradpitt]

LEO .... NEO ....KNOCK KNOCK ... the matrix has you

[@Jason-zh7wo]

Great info thanks 👍

[@jvanb231]

There are two states of infected. Known to be infected and unknown if infected.

[@okgoodgame]

well i havent notised anything off, so i think my computer must be fine

[@keppela1]

Had to stop a third of the way through - I have Win 7 and it doesn't show a startup tab in task manager.

[@bruuhbruuh8122]

I got a question can you check big files before installing it? There's files total virus can't scan due to max size.

[@carl9235]

Could this be used to boost performance on your pc? For example, disabling discord/steam/epic/chrome/edge/oneNote

[@pcsecuritychannel]

Yes.

[@k1llerwafflez821]

So im rly scared bc for some reason there has been multiple unkown deviced connected to my wifi and i dont know what to do..

[@AliYar-Khan]

All my files in PC are converted to voom file ... How I can retrieve my data

[@strongleongch]

Can you zoom to important things, please. Can't see shit from phone

[@jozsiolah1435]

Security Essentials solves all problems, when it is regularly updated. Windows needs activation when installed, and keep the DVD in a safe place. The code can remain on the cover. The tray pops out every 6 months, asking for the Win dvd. For laptops, the batt has to be good, and the best is to keep the cpu at 50%. That way, you will save the batt. The x shouldn't exist on the batt icon, it is a threat.

[@botrustbolt5818]

Is there any way to know if someone accessed my external hard drive?

[@scarecrow9307]

even if my pc is hacked. will it help if I reinstall windows deleting everything from my drives?

[@evenly.2529]

The last time I was this early I was learning how to hack pcs lmao