how would I detect a bot if I had one?
There are signs to look for. You could start with this:
https://www.shadowserver.org/wiki/pmwiki.php/Information/BotnetDetection
You could also try an online service like this one to check your IP address for anomalies:
https://www.check-and-secure.com/start/
And check all running processes:
http://www.sevenforums.com/tutorial...er-virustotal-check-all-processes-50-avs.html
But you shouldn't trust that anti-virus products can detect it, so watch out for not verified signatures(step 11) and strange or missing descriptions and Company names. Any purple colored processes are also suspicious, it means they are packed/encrypted. And submit any "unknown" files(step 6).
Besides that I have a batch file I run every now and then to check important files and settings on my system. Even if a malware manages to hide from scanners etc it still needs a way to start every time you boot up, so you should check the registry keys Run + Runonce + Winlogon. These parts should be general I think and needs to be run as admin to be able to read all registry keys for Local Machine(HKLM) and Current User(HKCU):
Code:
@echo off
echo ***** Checking IP, DNS etc...
ipconfig /all | find "IPv4 Address"
ipconfig /all | find "DNS Servers"
ipconfig /all | find "Default Gateway" | find /V "::"
ipconfig /all | find "DHCP Server"
echo.
echo ***** Checking Winlogon-Userinit...
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | find "Userinit"
echo.
pause
echo.
echo ***** Checking Runonce commands...
reg query "HKLM\Software\Microsoft\Windows\Currentversion\runonce"
reg query "HKCU\Software\Microsoft\Windows\Currentversion\runonce"
echo.
echo ***** Checking Run commands...
reg query "HKLM\Software\Microsoft\Windows\Currentversion\run"
reg query "HKCU\Software\Microsoft\Windows\Currentversion\run"
echo.
pause
echo.
echo ***** Checking shell open commands...
reg query "HKLM\Software\Classes\exefile\shell\open\command"
reg query "HKCR\exefile\shell\open\command"
echo.
pause
echo.
echo ***** Checking hosts file...
echo.
type C:\Windows\System32\drivers\etc\hosts
echo.
echo ***** Done!
echo.
pause
Verify that the DNS point to your router or ISP, and that the Winlogon/Run/Shell commands don't include any strange or unknown programs, and that your hosts file haven't been modified. The normal setting for Winlogon is only userinit.exe. Runonce should be empty unless you just installed something that requires a restart. The Run keys will likely include several programs though. The Shell open commands are usually
"%1" %* (normally no file names should be specified).
How Safe Mode works
When you boot to Safe Mode the Run and Runonce keys will be ignored (except for Runonce if it has a value with an asterisk (*) as prefix).
When you boot to
Safe Mode With Command Prompt the Winlogon key will also be ignored. Normally it means it won't run userinit.exe which is the process that starts explorer.exe (the desktop). But any other programs including malware specified here or in any of the Run keys won't be started either.
So if you check these registry keys, at least no malware should be able to start in any of these ways. You could also check the integrity of system files with
SFC - System File Checker. Or add the sfc command to the batch file.
