Slashdot Mirror
How Do I Determine If My PC is a Zombie?
Captain Chad wonders: "With the recent news of a 1.5-million node botnet, as well as the AIM rootkit worm, I'm getting a bit concerned about whether my PC may be a zombie. I'm seeing a lot of internet activity, even when nothing is running, and I've checked the process explorer for obvious tasks to no avail. I apply patches as soon as they're released, and my antivirus/spyware programs report nothing. How do I determine if my PC is a zombie, and if it is, how would I de-infect it?"
On this same vein, college campuses are often prime breeding grounds for undead-boxen. bcrowell adds: "I'm a teacher at a community college where Windows is the only supported OS -- if you ask the school to put machine on your desk, you get a Windows box. Faculty who want to run MacOS or Linux have had to provide their own machines, and those who want to do PowerPoint presentations for their classes have been told that they have to buy their own laptops and bring them in.
Now Academic Computing has announced a new policy: any unauthorized use of the network, such as plugging in your own computer to a port, is prohibited, and will result in disciplinary action. There are supposedly plans to enforce this rule automatically with hardware and software. Great consternation has ensued in the faculty senate, and the manager who wrote the policy has explained that it is basically aimed at the problem of improperly maintained teachers' machines getting '0wned'. A little ironic, because the Windows boxes maintained by the computing folks keep getting infected by worms. Still, it's not an unreasonable concern; many teachers are clueless. In fact, I wouldn't pretend to know enough to keep a Windows machine secure on a public network, although I haven't had any problem with the FreeBSD box on my desk. Any suggestions on how to deal with this? Effective arguments to use? Good educational resources to point people to so they can learn how to keep their Windows boxes secure? Many of my colleagues seem to think that security mainly involves buying antivirus software."
Now Academic Computing has announced a new policy: any unauthorized use of the network, such as plugging in your own computer to a port, is prohibited, and will result in disciplinary action. There are supposedly plans to enforce this rule automatically with hardware and software. Great consternation has ensued in the faculty senate, and the manager who wrote the policy has explained that it is basically aimed at the problem of improperly maintained teachers' machines getting '0wned'. A little ironic, because the Windows boxes maintained by the computing folks keep getting infected by worms. Still, it's not an unreasonable concern; many teachers are clueless. In fact, I wouldn't pretend to know enough to keep a Windows machine secure on a public network, although I haven't had any problem with the FreeBSD box on my desk. Any suggestions on how to deal with this? Effective arguments to use? Good educational resources to point people to so they can learn how to keep their Windows boxes secure? Many of my colleagues seem to think that security mainly involves buying antivirus software."
Really... What kind of internet activity are you seeing? Are the lights blinking and you have no idea what is actually happening or are processes on your box accessing IRC servers accross the world without your knowledge?
Being called a dork on Slashdot must be like being called the retard in special ed.
Semi-off topic:
If the admins can't even secure their own software, why should they think that those not in "the know" can.
My advice, get written statements about the reasons for no external computers. If the internal computers continue to get infected after this policy is put in place, anonymously email the people in charge (the admins' bosses) reminding them of the reason for the "fix".
As for getting infected, I agree with the other posters, and add that it's hard enough to keep a windows PC uninfected when just one careful person is on it. But once you start giving easily-infected PCs to people who aren't careful, the thing becomes a hive of filth.
Am I open minded towards open source, or closed minded towards closed source?
Yeah, it actually updates the status of connections in realtime. Kinda like nettop, except it keeps closed connections in the list. You can also see incoming connection attempts, even if they fail.
How we know is more important than what we know.
If you only have acess to one computer, you could do something like boot knoppix, load the base operating system inside QEMU, then watch what it does.
This post written under Gentoo-linux with an SCO IP license.
I see a lot of people offering some moderatly technical advice, but perhaps a simpler answer to the question is - there's no one easy, foolproof, turnkey way to reliably determine whether your Windows machine is infected.
There are too many different types of malware around - virii, spyware, rootkits, trojans, and so on - each of which has new twists coming up almost daily. No single development team or company can keep up, and there are too many out there trying for there even to be a dominant player (and if there were, malware would promptly be rewritten to undermine the anti-malware utility in question...).
You will either need to learn how to use some of the tools others in this thread mention (it's not as hard as it may seem at first - try running them on a system you can be confident is clean, and become familiar with what "safe" traffic looks like, then try yours), or be prepared to pay hefty $ for expert help, or switch to another OS.
FWIW, I've run un-patched Windows2k for years without trouble, largely because I use a hardware NAT (firewall) and avoid Outlook. Even so, I am careful to avoid clicking on the wrong things online, and I am working towards moving to Linux ASAP.
Perfectly Normal Industries
Heh, not like you need to do much overriding, the windows apis used by netstat are so pathetic they report connections open that are closed, or never even existed. TcpSafe uses WinPCap to capture live traffic and present it in a user friendly format. Although it is possible for a rootkit to directly attack this technique, they don't as they are intended to defeat userland programs, not installable network drivers.
How we know is more important than what we know.
here at Lewis & Clark (http://www.lclark.edu/ they use a client for any windows based machine to authenticate. Any other OS is required to authentify using a webpage to which you are redirected automatically when opening any webpage.
The client ensures you have all mandatory updates installed to connect, otherwise the access is discontinued. Saves lots of trouble, and my friends on OSX and me on gentoo have no problems whatsoever.
Might want to suggest your IT department to take a look at it... And even contact our IT department, they're pretty open about helping other schools keep their networks clean.
Hope that tidbit of info helped.
Oh, before I forget, the client used to be called "SmartEnforcer", and now it's a Cisco client... don't remember the name since I don't use it.
---- I am certain of only one thing : I know nothing else.