Slashdot Mirror
How Can I Tell If My Computer Is Part of a Botnet?
ashraya writes "My father (not too computer literate) has a desktop and a laptop both running Windows in his network back in Hyderabad, India. I set up a Linksys router for him to use with his broadband service. For some reason, he reset the config on the Linksys, and connected it up without wireless security, and also with the default admin password for some time. As you would expect, both of the Windows computers got 'slow,' and the desktop stopped connecting to the internet completely for some reason. As I logged in remotely to 'fix' things, I noticed on the Linksys' log that the laptop was making seemingly random connections to high-numbered ports on various IPs. I did an nslookup on the IPs to see that they were all either in Canada or US, with Comcast and other ISP addresses. Is that a sign that the computers were in a botnet? Are the other hosts part of the botnet too? (I have since rebuilt the Windows hosts, and these connections are not happening now. I have also secured the Linksys.)"
What it really means is that your dad is a part of an international crime ring and he really is a cracker, without your knowledge. He just felt that you did not have a clue so allowed you to play with his computer.
I prefer the "u" in honour as it seems to be missing these days.
Well the only fool proof way
If that sentence doesn't end with "from orbit" and have "nuke it" in there somewhere it just isn't true!
No comprende? Let me type that a little slower for you...
Doesn't work in XP.
C> netstat -a | find "LISTENING" [ENTER]
Response: NETSTAT is not not recognized as an internal or external command,operable program or batch file.
Did you know that both wireshark and tcpdump use libpcap? Wireshark has a pretty GUI, tcpdump is the command line version.
Perhaps it would help if I explained that in video format.
Captcha was "obvious", this is unnerving.
It makes remarks about wanting to try other operating software. It's unusually concerned about antivirus protection. Plug and Play only works with force-feedback devices. It makes unusually long "hand-shakes" with the email server. It accuses you of installing spyware. It asks you to run your network scans in promiscuous mode. It tells you that it's mainframe never liked you.
and show them how to login as their normal username and use "run-as".
Awwww, how cute! He's trying to teach a user something!
Let's watch...
While my father was cleaning his gun, he loaded it and emptied the clip into his foot. He then reloaded and pumped another four slugs into the same foot. So I was wondering, does any one know where I can get a good deal on Band-Aids? Thanks.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
This is windows. find == grep. Well, find < grep.
Is a father computer anything like a mother board?
- real hackers don't have sigs -
For a suspicion? Good luck with that.
Slashdot is doing tech-support for India now?
Some chick named Alanis is calling you subby.
Q: How do I tell if my computer is part of a botnet?
A: If it's got Windows on it, it is.
Is it running windows?
Sounds like Dad, if that's even his real name, knows more about computers than he is pretending to.
He is clearly torrenting, and your best course of action would be to report his nefarious actions to the authorities.
It comes with a logo; looks like a window. :)
--- For a good time mail uce@ftc.gov
... and now imagine I chose 'Plain text'
c:\>netstat -b
Your computer is fine.
c:\>
Sweet!
And he totally isn't being paid to refer you!
Because, I mean, he only gets paid when he's SUBTLE.
My sig can beat up your sig.
A horse is a horse,
Of course! Of course!
what are you talking about? OSX has a dated Unix command line. All you have to do is type [apple]-[space] term [enter]. You can even make it a little better by typing bash [enter] after that.
If the answer to both your questions is "Yes", then you are most likely part of a botnet. This advice is free of charge.
[FUCK BETA]
Mod parent up.