How Do I Determine If My PC is a Zombie? 90
Captain Chad wonders: "With the recent news of a 1.5-million node botnet, as well as the AIM rootkit worm, I'm getting a bit concerned about whether my PC may be a zombie. I'm seeing a lot of internet activity, even when nothing is running, and I've checked the process explorer for obvious tasks to no avail. I apply patches as soon as they're released, and my antivirus/spyware programs report nothing. How do I determine if my PC is a zombie, and if it is, how would I de-infect it?"
On this same vein, college campuses are often prime breeding grounds for undead-boxen. bcrowell adds: "I'm a teacher at a community college where Windows is the only supported OS -- if you ask the school to put machine on your desk, you get a Windows box. Faculty who want to run MacOS or Linux have had to provide their own machines, and those who want to do PowerPoint presentations for their classes have been told that they have to buy their own laptops and bring them in.
Now Academic Computing has announced a new policy: any unauthorized use of the network, such as plugging in your own computer to a port, is prohibited, and will result in disciplinary action. There are supposedly plans to enforce this rule automatically with hardware and software. Great consternation has ensued in the faculty senate, and the manager who wrote the policy has explained that it is basically aimed at the problem of improperly maintained teachers' machines getting '0wned'. A little ironic, because the Windows boxes maintained by the computing folks keep getting infected by worms. Still, it's not an unreasonable concern; many teachers are clueless. In fact, I wouldn't pretend to know enough to keep a Windows machine secure on a public network, although I haven't had any problem with the FreeBSD box on my desk. Any suggestions on how to deal with this? Effective arguments to use? Good educational resources to point people to so they can learn how to keep their Windows boxes secure? Many of my colleagues seem to think that security mainly involves buying antivirus software."
Simple (Score:5, Funny)
Happy Halloween >:D
Re:Simple (Score:2)
Yuck! (Score:2)
Re:Simple (Score:3, Funny)
Re:Simple (Score:4, Informative)
Re:Just to be safe (Score:1)
Re:easy first step (Score:2)
Re:easy first step (Score:2)
umm... (Score:2, Funny)
Re:umm... (Score:2)
What kind of internet Activity? (Score:4, Interesting)
Sysinternals, Unix attitude applied to Windows (Score:5, Informative)
Re:Sysinternals, Unix attitude applied to Windows (Score:1, Offtopic)
Pretty low, if you ask me. Should we mod you troll?
--LWM
Re:Sysinternals, Unix attitude applied to Windows (Score:2)
Re:Sysinternals, Unix attitude applied to Windows (Score:1)
OT: Lameness filter? (Score:2)
So, WTF?
How is that supposed to prevent lameness?? I can't see the point of having spaces inserted into long urls - is the idea to break up any long string of text?
--LWM
Re:OT: Lameness filter? (Score:2)
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Back in the old days, people would post shit like that and it would make the page really really wide. This, of course, made reading the comments impossible, so taco added code to break up lines like that. The link was clickable anyway, so who
Re:OT: Lameness filter? (Score:2)
I like to copy/paste links from lynx to firefox - harder to do with the space in it
I will accept it as my cross to bear!
Again, thanks.
--LWM
Use ethereal to check out your network traffic (Score:5, Insightful)
Re:Use ethereal to check out your network traffic (Score:2, Informative)
That isn't to say that all traffic is bad traffic. Most of the time that traffic you're seeing isn't YOUR traffic. Its the traffic of all the other computers on the network talking with yours. This isn't a bad thing. Its typical of a large network. You'll have lots of computers talking to each other to let each other know when something changes. For instance, a new computer comes online and has to get an ip address. Usually it doesn't know where to get an ip address, so it sends out a broadcast to al
Rootkits My Son (Score:5, Informative)
Re:Rootkits My Son (Score:3, Informative)
Or you forgot that your antivirus software does network activity.
I had that happen a couple weeks ago, I just happened to be watching my network activity light and it lit up when I wasn't doing anything. This bothered me, as you might expect.
Took me a couple minnutes of poking around to figure out tha
Finally, my signature is on-topic (Score:3, Informative)
Re:Finally, my signature is on-topic (Score:1)
Re:Finally, my signature is on-topic (Score:2)
Re:Finally, my signature is on-topic (Score:3, Informative)
By the way, that's the answer to the original question. netstat -a at a command prompt lists current connections and current listeners. Check the other computers (by googling or whoising them, not by visiting them) to see if they're evil.
Re:Finally, my signature is on-topic (Score:3, Interesting)
Re:Finally, my signature is on-topic (Score:2)
Re:Finally, my signature is on-topic (Score:3, Interesting)
Re:Finally, my signature is on-topic (Score:2)
Re:Finally, my signature is on-topic (Score:1)
sudo watch -n1 "netstat -nape --inet"
This will truely update ever second indefinitely and will provide a bit more information.
Re:Finally, my signature is on-topic (Score:1)
sudo watch -n1 "netstat -nape --inet"
Heh! That will be fun to run on anything else but Linux.
Especially on FreeBSD, which happens to have a watch(1) command but for quite a different purpose :-)
Good idea though. Something similar can be done on the BSDs and on Solaris with:
Re:Finally, my signature is on-topic (Score:1)
Oh . . . darn. Well, I like your app. Cheers.
Re:Finally, my signature is on-topic (Score:2)
I did something MUCH smarter... (Score:1)
Odd thing is, I also do it for anyone who complains about spyware to me. So far they know... I WILL NOT fix windows issues, but I will "reinstall"... they have to agree that they will ask ME to install software for them unless they get it from the CVS/packagemanager that is defaulted by their distribution... overall I've had little trouble, though they complain that certain things (windows
Netstat (Score:4, Informative)
There are also some switches that can show more detailed information, some of them are undocumented I believe. Use Google if you need to find them.
Using Ethereal is also an option - it can provide a lot more information but is more involved to use and interpret the results.
Re:Netstat (Score:2)
Re:Netstat (Score:3, Interesting)
Lazy admins (Score:3, Interesting)
If the admins can't even secure their own software, why should they think that those not in "the know" can.
My advice, get written statements about the reasons for no external computers. If the internal computers continue to get infected after this policy is put in place, anonymously email the people in charge (the admins' bosses) reminding them of the reason for the "fix".
As for getting infected, I agree with the other posters, and add that it's hard enough to keep a windows PC uninfected when just one careful person is on it. But once you start giving easily-infected PCs to people who aren't careful, the thing becomes a hive of filth.
Only trust the machine externally (Score:5, Informative)
Start with an external packet sniffer - see what traffic the machine is sending out and on what ports. If you are seeing traffic that you don't understand - get help to determine what it is. You can start with a simple NAT gateway, and simply log the IP addresses/ports that your machine(s) are going too. If you see unidentified remote ports, well - you probably have a problem, if you see port 80 traffic to sites you don't know what they are - you have a problem, etc.
How to clean up the mess. Well, your first step would be to simply reformat the hard drive. If you can't do that - good luck, remember you will need to start with a clean media boot (as in a CD boot to a Linux/BSD distro) and see what you can find. Remember with a rootkit present, your kernel can and DOES completely lie to you about what is going on internally.
Re:Only trust the machine externally (Score:1)
Except for reformatting your hard drive. You might make your original drive a slave drive though, and use a new clean hard drive as the master and reinstall your OS on that. A live cd distro (as suggested) might help in a short term solution too.
Re:Only trust the machine externally (Score:2)
Ditto. I feel bad for people who balk at re-formatting their hard drive. They always ask me if there is an easier way. Unfortunately, reformatting is the easy way. Trying to clean out rootkits and nasty spy/adware requires a lot of knowledge, even with the excellent free tools available. (Thanks, sysinternals, lavasoft and safer-networking.org).
Re:Only trust the machine externally (Score:2)
Re:Only trust the machine externally (Score:1, Insightful)
Post your IP address (Score:3, Funny)
Re:Post your IP address (Score:5, Funny)
Thanks in advance.
Re:Post your IP address (Score:2)
I just... (Score:1, Funny)
Even as I type this it's trying to beam all your personal information back to Ukranian hackers, three different sites that claim they're eBay, and it's sending hundreds of megabyte
Wow! (Score:2)
God! People these days!
Re:Post your IP address (Score:1)
Re:Post your IP address (Score:2)
However, I get the joke.
http://gotohell.com [gotohell.com] Thanks in advance.
Re:Post your IP address (Score:1)
Have fun.
I let a friend have a key while he was in town.. (Score:2, Funny)
Now I have paranoia.
Re:I let a friend have a key while he was in town. (Score:3, Funny)
It's tough but you have to remember to shoot for the head.
Re:Very easy test: (Score:1)
In everyday terms - (Score:5, Interesting)
There are too many different types of malware around - virii, spyware, rootkits, trojans, and so on - each of which has new twists coming up almost daily. No single development team or company can keep up, and there are too many out there trying for there even to be a dominant player (and if there were, malware would promptly be rewritten to undermine the anti-malware utility in question...).
You will either need to learn how to use some of the tools others in this thread mention (it's not as hard as it may seem at first - try running them on a system you can be confident is clean, and become familiar with what "safe" traffic looks like, then try yours), or be prepared to pay hefty $ for expert help, or switch to another OS.
FWIW, I've run un-patched Windows2k for years without trouble, largely because I use a hardware NAT (firewall) and avoid Outlook. Even so, I am careful to avoid clicking on the wrong things online, and I am working towards moving to Linux ASAP.
Re:In everyday terms - (Score:2)
That works well, actually. I've run Windows XP Home for a few years without SP2 nor anti-virus nor personal firewall, and it hasn't slowed to a halt nor given any signs of abnormal activity. The trick? Don't download disreputable software, use Firefox (or Mozilla), and stay behind a firewall/NAT. And run Windows Fi
Re:In everyday terms - (Score:2)
Dealing with Stupid, Lazy, or Malicious IT (Score:5, Interesting)
Re:Dealing with Stupid, Lazy, or Malicious IT (Score:3, Informative)
One thing you can do is put a large hidden file, call it something like "swap.sys" or something of that nature. Boot Linux from an attached device (usb / cdrom), then use losetup to loopback mount that file, and run your normal linux install from there. This will take a bit of advanced knowledge to set up since you'd probably have to install your distro to another drive and copy it over, then set up the initial ram disk image on your boot devi
Dealing with staff who think they know better (Score:2)
It would also be a good idea to demonstrate that you have the financial resources to cover the loss if the system gets compromised as a result of your non-standard box creating a security flaw. For the benefit of the uninitiated/wishful thinkers, that liability is $EXPERT_HOURLY_RATE * $HOURS_TO_REINSTALL_ENTIRE_NETWORK + $COST_TO_ORGANISATION_OF_TIME_LOST_DO
Re:Dealing with staff who think they know better (Score:2)
stray tag...here's the correct version. (Score:2)
Competent network admins should be able to protect against internal attacks, as well as external ones. Indeed, targetted malicious attacks are more likely to come from within the firewall & usually do the most damage. One rooted box should never be capable of making it so you have to reinstall the entire network.
lookup your subnet at dshield (Score:5, Informative)
www.shield.org maintains a database of sources of malicious network traffic. Many organizations submit firewall logs to dshield, so they have a pretty good global view of who the bad apples are on the network. For anyone who administers network connected machines, it's a good idea to periodically look up [dshield.org] your IP(s) or subnet(s), and see if anyone has generated any complaints about any of your own boxes.
Caveat: This will probably only identify the most aggregious zombies, and only the ones that are doing things that firewalls can identify as malicious. Just because your IPs don't show up on dshield, doesn't mean they aren't zombies.
Mynetwatchman is a similar service, there may be others as well.
Re:lookup your subnet at dshield (Score:2, Informative)
I guess you mean www.dshield.org (with the 'd' added!)
www.dshield.org not www.shield.org (Score:2)
how my college does it (Score:3, Interesting)
The client ensures you have all mandatory updates installed to connect, otherwise the access is discontinued. Saves lots of trouble, and my friends on OSX and me on gentoo have no problems whatsoever.
Might want to suggest your IT department to take a look at it... And even contact our IT department, they're pretty open about helping other schools keep their networks clean.
Hope that tidbit of info helped.
Oh, before I forget, the client used to be called "SmartEnforcer", and now it's a Cisco client... don't remember the name since I don't use it.
Re:how my college does it (Score:1)
Works well if your users are using webapps. Not so good if they're using 3270 emulation or the like.
md5, sha1? (Score:1)
Why couldn't you get the md5 or sha1 hash of that file (or group of files), and then periodicaly recheck the files and compare the two. Of course you would probably have to redo the "initial" hashing after any official update (or does your kernel not change all that often? Like I said I have no idea about most of this).
That's all i've really thought o
Re:md5, sha1? (Score:2)
Re:md5, sha1? (Score:2)
--LWM
this command (Score:4, Funny)
Go over their heads (Score:3, Insightful)
It sounds like their heads have swelled too much, so talk to their boss, or their bosses boss. Explain that your work is better with this tool, and that it is unreasonable to ban your tool given the known lack of risks. This is not a garage-built closed-source piece-of-shareware; but a globally used, open source, well-inspected and maintained tool. Remember the talking points: ZERO viruses (macs), not running as Administrator, updates are applied regularly and consistently.. (well, there's better Persuader lists out there.)
I've been in IT for the last 10 years, and we are there specifically to help the users do their job. Sometimes it's to disable all email attachments, and sometimes it's setting up a Windows 98 machine for a critical job.
You may need to compromise.. a probabation peroid of increased firewall monitoring, maybe a "I'm responsible" contract to cover their butts. Thing is.. if their argument comes down to "Because we said so", then they are enforcing a personal agenda, and have ceased being effective at their primary responsibilities.
(Falling asleep at this point, so my ramblings will go unedited..) Hope this helps.
"Simple" answer... (Score:2)
I've seen many responses, including webpages which may be helpful, or other programs which may be up to date. Personally, I prefer netstat. It's not "user friendly", but it's always up to date. If you're smart enough to keep your computer updated, you're smart enough to start recognizing stuff and feeding Google what you don't understand.
What community college is that? (Score:2)
What community college is that? Better yet, what is their IP address range, or their domain name (so I can add them to my email blacklist)? Given their backwards policy on security, I would be safer by refusing anything from there.
Tripwire for windows? (Score:2)
Does such a thing exist for windows?
on a switched lan? use arpspoof (Score:2, Informative)
RootkitRevealer (Score:2)
You may also want to check out this interesting story from Mark Russinovich, Sony Music CDs installing DRM rootkit [sysinternals.com].