LEARN HACKING TIPS AND TRICKS: Security From Hackers And Viruses

Showing posts with label Security From Hackers And Viruses. Show all posts

Secure yourself by identifying shortened URLs

Secure yourself by identifying shortened URLs

URL shortening: URL shortening is a technique on the World Wide Web in which a Uniform Resource Locator (URL) can be made substan...

9:49 AM

Trojans and RATs- Know The Facts

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="posthead" style="clear: left; font-family: Georgia, 'Times New Roman', Times, serif; padding-top: 8px; position: relative;">
<h1 style="font-size: 20px; font-weight: normal; letter-spacing: -1px; line-height: 28px; margin: 0px; padding: 0px 0px 10px;">
<br /></h1>
</div>
<div style="clear: left;">
</div>
<div class="post-body entry-content">
<div dir="ltr" trbidi="on">
<div class="separator" style="background-color: white; clear: both; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; text-align: center;">
<a href="http://1.bp.blogspot.com/-yOsVHzy1HDk/TqwcEC2-pGI/AAAAAAAAAV4/m9vTnFeztOw/s1600/BEEN-HACKED.jpg" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><i></i></a></div>
<div class="separator" style="background-color: white; clear: both; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuTJZZlkDPtnmLgMOT-CKf6cj2J3RkN9ARFDKm-5UWGnxgSF3H6vu6rfvCYQnrKBCxkbM_BYBpGuZSU906CoakGII3t0SFFB_DWjvhhircvn3oXYfEOLQDtLjngcmS9flxweYJow2V9UrB/s1600/A+new+type+of+Trojan+horse+attacks+Europe.jpg" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuTJZZlkDPtnmLgMOT-CKf6cj2J3RkN9ARFDKm-5UWGnxgSF3H6vu6rfvCYQnrKBCxkbM_BYBpGuZSU906CoakGII3t0SFFB_DWjvhhircvn3oXYfEOLQDtLjngcmS9flxweYJow2V9UrB/s1600/A+new+type+of+Trojan+horse+attacks+Europe.jpg" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" /></a></div>
<i style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;"><br /></i><br style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;" /><br style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;" /><div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="font-family: inherit;">In my previous article, i have explained how we can hack remote computers using extreme RAT. I thought of writing an article on the basics of RATs before it. But many people are interested in practical knowledge rather than reading theory. So i wrote the practical working of RATs first.Before moving onto some other RATs, i am going to explain the facts that everyone must know before using RATs and Trojans.</span><span class="Apple-style-span" style="font-size: x-small;"><o:p></o:p></span></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="font-size: 12pt; line-height: 18.399999618530273px;"><span class="Apple-style-span" style="font-family: inherit;"><i><br /></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;">What are TROJANS?</span><span class="Apple-style-span" style="font-size: 16pt; font-style: italic;"><o:p></o:p></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;"><i><br /></i></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;">A Trojan is a program that pretends to be legitimate program, while It is malicious in nature and is infecting the system in background. It<span class="Apple-style-span" style="font-size: x-small;">  provides complete access of that system to the Attacker.</span></span></span><b style="font-style: italic;"><o:p></o:p></b></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><i><span style="font-size: 12pt; line-height: 18.399999618530273px;"><br /></span></i></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="color: red; font-family: inherit;"><b><span class="Apple-style-span" style="font-size: medium;">How Trojans work?</span><span class="Apple-style-span" style="font-size: 16pt; font-style: italic;"><o:p></o:p></span></b></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="color: red; font-family: inherit;"><b><span class="Apple-style-span" style="font-size: medium;"><br /></span></b></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;">Trojans work on client server basis. <span class="Apple-style-span" style="font-size: x-small;"> The client will reside on hacker’s system and the server will be on victim’s computer. When the victim clicks the server, client listens to the connections through the specified ports and gives the access to the victim’s system.<o:p></o:p></span></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="font-size: 12pt; line-height: 18.399999618530273px;"><span class="Apple-style-span" style="font-family: inherit;"><i><br /></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;">Ports</span><span class="Apple-style-span" style="font-size: 16pt; font-style: italic;"><o:p></o:p></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;"><i><br /></i></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;">Ports are the end points that provide communication between computers or networking devices.<i style="font-weight: bold;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><i><b><br /></b></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><span style="font-weight: bold; line-height: 13.800000190734863px;">Physical ports</span><span style="line-height: 13.800000190734863px;"><span style="font-weight: bold;">-</span><i style="font-weight: bold;"> </i>example usb ports,serial port etc<i style="font-weight: bold;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><i><span style="line-height: 13.800000190734863px;"><b><br /></b></span></i></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><span style="font-weight: bold; line-height: 13.800000190734863px;">Virtual ports</span><span style="line-height: 13.800000190734863px;"><span style="font-weight: bold;">- </span><span class="Apple-style-span" style="font-size: x-small;">Virtual ports provide a virtual connection between the computer systems. These ports are the ones we need for communication on internet. Different Trojans use different ports.  These are referenced using some numbers. There are  </span>65535 ports.<i style="font-size: 12pt; font-weight: bold;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><i><span style="font-size: 12pt; line-height: 18.399999618530273px;"><br /></span></i></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;">Direct connection Trojans</span><i style="font-size: 16pt;"><o:p></o:p></i></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;"><br /></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;">If the Trojan is direct connecting Trojan then attacker can connect to the victim directly and can get access to the victim machine, but the scenario is not always that easy. Victim can be behind a router, in that case direct connection Trojans will not any provide any access to the victim computer. One more disadvantage is we need to know the IP address of the victim.<i><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><i><br /></i></span></span></div>
<div align="center" class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; text-align: center;">
<span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: blue; font-weight: bold;">HACKER</span><span class="Apple-style-span" style="color: red; font-weight: bold;">--</span><span class="Apple-style-span" style="color: red;"><b>></b></span><span class="Apple-style-span" style="color: blue; font-weight: bold;">server</span><span class="Apple-style-span" style="color: red;">--></span><b><span class="Apple-style-span" style="color: blue;">VICTIM</span></b><i style="color: red; font-weight: bold;"><o:p></o:p></i></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;">Example: PRORAT<i style="font-size: 12pt;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<br /></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="font-size: 16pt; line-height: 24.533334732055664px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red;">Reverse connection Trojans</span><i><o:p></o:p></i></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="font-size: 16pt; line-height: 24.533334732055664px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red;"><br /></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="font-family: inherit;"><span style="line-height: 13.800000190734863px;">When the<span class="Apple-style-span" style="font-size: x-small;">  Victim is behind a router, direct connection Trojans will not  provide any access to the victim computer. Here comes the need of reverse connection Trojans. In this case, the victim will be connected to the hacker using the server file. This is </span></span><span style="line-height: 13.800000190734863px;">Very useful if the person sits behind a router . After infecting the victims PC, the trojan will automaticly connects to the hacker.<i><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px; text-align: center;">
<span class="Apple-style-span" style="font-family: inherit;"><b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="color: blue;">HACKER</span></span><span style="color: red; line-height: 13.800000190734863px;"><--</span></b><b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="color: blue;">Server</span></span><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="color: red;"><--</span></span></b><b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="color: blue;">VICTIM</span></span></b></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;">Example: Darkcomet<i style="font-size: 12pt;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="font-size: 12pt; line-height: 18.399999618530273px;"><br /></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;"><b>Port forwarding</b></span><span class="Apple-style-span" style="font-size: 16pt; font-style: italic; font-weight: bold;"><o:p></o:p></span></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;"><b><br /></b></span></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="font-family: inherit;">If the hacker does not connect to the Internet directly (with a modem) and he sits behind a router, he needs to forward the trojan ports in his routers configuration if he is doing a reverse connection. This is called portforwarding. <span class="Apple-style-span" style="font-size: x-small;"> The basic idea of port forwarding is to instruct our router to allow external connections to our PC. It varies from router to router based on its company and version.</span></span><i style="font-size: 12pt;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<br /></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;">Dynamic IP address</span><span class="Apple-style-span" style="font-size: 16pt; font-style: italic;"><o:p></o:p></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<b><span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="color: red; font-size: medium;"><br /></span></span></span></b></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span style="line-height: 13.800000190734863px;"><span class="Apple-style-span" style="font-family: inherit;"><span class="Apple-style-span" style="font-family: inherit;">Most of the computers today do not have a static IP address, So <span class="Apple-style-span" style="font-size: x-small;"> using a service like no-ip which gives you a name like hacker.no-ip.org  which can be pinged from anywhere on the internet and it will give your current IP address. Set your reverse connection trojans to connect to this name.</span></span><i style="font-size: 12pt;"><o:p></o:p></i></span></span></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<br /></div>
<div class="MsoNormal" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<span class="Apple-style-span" style="line-height: 24px;">Hope you liked the post, for further doubts please leave your comments.</span></div>
<div>
<span class="Apple-style-span" style="line-height: 24px;"><br /></span></div>
</div>
</div>
</div>

Trojans and RATs- Know The Facts

In my previous article, i have explained how we can hack remote computers using extreme RAT. I thought of writing an article o...

9:40 AM

How to secure yourselves from Trojans and RATs

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="posthead" style="background-color: white; clear: left; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 12px; line-height: 17px; padding-top: 8px; position: relative;">
<h1 style="font-size: 20px; font-weight: normal; letter-spacing: -1px; line-height: 28px; margin: 0px; padding: 0px 0px 10px;">
<br /></h1>
</div>
<div style="background-color: white; clear: left; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
</div>
<div class="post-body entry-content" style="background-color: white; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 17px;">
<div dir="ltr" trbidi="on">
<br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD_gdLb37THCANOFmc5Gwi1jULQnm0JIwNO5ea40609mLE4PD3F7KZzH8zyfHqp7rUgXiClenwvF7ynURiWfHwLDHZ_xB6SRxBulv2S_MsjQvtVw2WF9LUhW_QaQOF1SXq0crfN1hUY-d3/s1600/computer-forensics.jpg" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="270" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD_gdLb37THCANOFmc5Gwi1jULQnm0JIwNO5ea40609mLE4PD3F7KZzH8zyfHqp7rUgXiClenwvF7ynURiWfHwLDHZ_xB6SRxBulv2S_MsjQvtVw2WF9LUhW_QaQOF1SXq0crfN1hUY-d3/s320/computer-forensics.jpg" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="320" /></a></div>
<br /><b><span class="Apple-style-span" style="color: red;">Symptoms of a trojan:</span></b><br /><b><span class="Apple-style-span" style="color: red;"><br /></span></b><br />Unusual behaviour of the system is a mere indication of a Trojan attack!!!<br />• Programs starting and running without the initiation of the User.<br />• Opening or Closing of CD-ROM drawers<br />• Wallpaper, background, or screen saver settings changing by themselves<br />• Screen display flipping upside down<br />• Browser program opening strange or unexpected websites.<br /><br />All the above actions seem like a ghost controlling your system!!!!<br />The actions clearly indicate that you are under Trojan attack!<br /><br /><b><span class="Apple-style-span" style="color: red;">Concept behind Detecting Trojans:</span></b><br /><br />The first and foremost thing you have to do is to check the applications which are <b>making network connections</b> with other computers. One of those applications will be a process started by the Server Trojan.<br /><br /><b><span class="Apple-style-span" style="color: red; font-size: medium;">METHOD 1:</span></b><br /><b><span class="Apple-style-span" style="color: red; font-size: medium;"><br /></span></b><br /><b><span class="Apple-style-span" style="color: red;">Detecting trojans using" </span><span class="Apple-style-span" style="color: blue;">netstat</span><span class="Apple-style-span" style="color: red;">" command</span></b><br /><b><span class="Apple-style-span" style="color: red;"><br /></span></b><br />An effective method to detect trojans is by using “<b>netstat</b>” command.<br /><b><br /></b><br /><b>Step1: </b>Go to Start>run and type cmd ( to open command prompt)<br /><br /><b>Step2: </b>Go to C drive and type netstat<br />It displays all the Active Connections.<br /><br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQED_rejfVYl8e35xbdMLx03QxGDOeO5-_w5rNXkaUfrMwN6_pkg62d1UTjHXqlqS9lstp1b2goLR6KuO69FOPB3461O0XaEE09yXFF6EafseFV0ZC23aPTHc-jtWgFXULyj9L55TuAvdz/s1600/netstat1.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="317" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQED_rejfVYl8e35xbdMLx03QxGDOeO5-_w5rNXkaUfrMwN6_pkg62d1UTjHXqlqS9lstp1b2goLR6KuO69FOPB3461O0XaEE09yXFF6EafseFV0ZC23aPTHc-jtWgFXULyj9L55TuAvdz/s400/netstat1.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br />Now Type the command<b><span class="Apple-style-span" style="color: blue;"> netstat –ano</span></b><br />It displays all the present <b>TCP/IP</b> and <b>UDP ports </b>that are being used.<br /><br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXiZYy1bw4TWM8odnSx4pyqkjlDFKZGCOBGnNC55Nu35T9KZD7EZD6gRH_MTXoIrRHKSP3OAxQ57QbemVFyeTu4zeAicmOidAIIzHxy_DdQZucG9dPEBVnmQy_xphMxxgGQSqjwzexGieX/s1600/netstat2.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="353" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXiZYy1bw4TWM8odnSx4pyqkjlDFKZGCOBGnNC55Nu35T9KZD7EZD6gRH_MTXoIrRHKSP3OAxQ57QbemVFyeTu4zeAicmOidAIIzHxy_DdQZucG9dPEBVnmQy_xphMxxgGQSqjwzexGieX/s400/netstat2.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br />The trojan could be one of the ESTABLISHED conections. But not all the ESTABLISHED connections are trojans.<br /><br /><b>Step 3: </b>Open<b> task manager.</b><br /><br />(This can be done by right-clicking on task bar and start task manager)<br /><br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYPseRc4SYxfzq4HXQao8ZrFD037347yl88XDi9PnnJnFJ5W_q4b5BkIHqTIcohuNwGRiGwzBCVE3lHUKrhsAIZ7U18vXRv0Q7A4vOIcs0tzPgN8EosafNsfZ6DONLEslXDZbsU-2Qzf8w/s1600/netstat3.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="205" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYPseRc4SYxfzq4HXQao8ZrFD037347yl88XDi9PnnJnFJ5W_q4b5BkIHqTIcohuNwGRiGwzBCVE3lHUKrhsAIZ7U18vXRv0Q7A4vOIcs0tzPgN8EosafNsfZ6DONLEslXDZbsU-2Qzf8w/s400/netstat3.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<b>Step 4:</b><br /><b><br /></b><br />Go to <b>view</b>--><b>select columns</b><br /><br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTKLWJIxsMPMItDq06isuM2Xac73p7L7iaisHAAx9SoF-PhayzzfOSzTJbe7TB_PnH41eu16n6i2LNPryIfeo5iZrQtnQdRRJHVR_EDzT3QKAeAcT60GsS2PSv0ARO13bedNNhc3GlcMzS/s1600/netstat4.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTKLWJIxsMPMItDq06isuM2Xac73p7L7iaisHAAx9SoF-PhayzzfOSzTJbe7TB_PnH41eu16n6i2LNPryIfeo5iZrQtnQdRRJHVR_EDzT3QKAeAcT60GsS2PSv0ARO13bedNNhc3GlcMzS/s400/netstat4.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br />Check the <b>process Identifier</b> and click <b>ok.</b><br /><br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkrjywIRlEx5G2Fte5f8qoIDM53KvEuhdLIFz_f5TSxErdATIK85e1vb3uKSiDFBhLQvKZFWFZr4q1tEfQJZGCY6Z3CWy5qBrHhV2ATah0xGzNAJi_9i7Rv92YHMJ2ZL-A0gOVpY3rYC3-/s1600/netstat5.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="202" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkrjywIRlEx5G2Fte5f8qoIDM53KvEuhdLIFz_f5TSxErdATIK85e1vb3uKSiDFBhLQvKZFWFZr4q1tEfQJZGCY6Z3CWy5qBrHhV2ATah0xGzNAJi_9i7Rv92YHMJ2ZL-A0gOVpY3rYC3-/s400/netstat5.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br /><br /><b>Step 5: </b>Cross check the <b>PIDs </b>of<b> ESTABLISHED </b>connections with the<b> PIDs </b>shown on <b>task manager</b> to know the name of the program or application running. For example <b>PID 5004</b> is<b>TeamViewer.exe </b>(as shown in the image)<br /><br /><div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghgxFqrh9agoqtVSRgOBPp-j_mLKMk_9-9CuaXVwMFuPFBoENRHWKE2Eus19qcQNPyVBuiT97iCJn-A10gpE4j4nBU4rhdTCoooxwB78qxm86Ea9aXZ4HmMybbz9fLHJv9sYQsuqOdWJ8B/s1600/netstat6.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="170" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghgxFqrh9agoqtVSRgOBPp-j_mLKMk_9-9CuaXVwMFuPFBoENRHWKE2Eus19qcQNPyVBuiT97iCJn-A10gpE4j4nBU4rhdTCoooxwB78qxm86Ea9aXZ4HmMybbz9fLHJv9sYQsuqOdWJ8B/s400/netstat6.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br /><b>Step6: </b>Whenever you find a suspicious program, copy the name and paste it in the search box of <b><a href="http://spywareguide.com/" style="border: 0px; color: #0033cc; text-decoration: none;">spywareguide.com</a></b><br />For example, one of the programs could be <b>Backdoor.Alvgus.a.exe</b>. Copy it and paste it in the search box of <b><a href="http://spywareguide.com/" style="border: 0px; color: #0033cc; text-decoration: none;">spywareguide.com</a></b><br />Click on it and it displays its properties…..<br /><br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJ6jGj87Uh-Yk83D-L9Gfe35Q48Fv9JLG3BcLYmRDqL8yGLyvF0WuZbMMXHyGXfhozmVdu662WyBjE2M_HU0SZuR8gVm8-jJ8_-KiLZoRjC_Qao0flxNDDS3qQzF2TiM5ShCYX0O_qJxLg/s1600/netstat9.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="132" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJ6jGj87Uh-Yk83D-L9Gfe35Q48Fv9JLG3BcLYmRDqL8yGLyvF0WuZbMMXHyGXfhozmVdu662WyBjE2M_HU0SZuR8gVm8-jJ8_-KiLZoRjC_Qao0flxNDDS3qQzF2TiM5ShCYX0O_qJxLg/s400/netstat9.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br /><br /><b><span class="Apple-style-span" style="color: red;">How To Kill A Program??</span></b><br /><b><span class="Apple-style-span" style="color: red;"><br /></span></b><br />Well, you have identified a trojan. Now you have to kill it. You can kill the process using pskill.<br />And now you can kill the program using <b>pskill.</b><br />You can download pskill from <a href="http://technet.microsoft.com/en-us/sysinternals/bb896683" style="border: 0px; color: #0033cc; text-decoration: none;">here. </a><br />Store the <b>pskill.exe</b> application on your C drive. And now you can kill the particular process using the command<b> C:\>pskill 5004</b> (<b>PID</b> of the program).<br /><br /><b><span class="Apple-style-span" style="color: red; font-size: medium;">METHOD 2: </span></b><br /><br /><br /><b><span class="Apple-style-span" style="color: red;">Detecting and removing Trojans Using  TCPView:</span></b><br /><b><span class="Apple-style-span" style="color: red;"><br /></span></b><br />If you find it difficult to do all the above stuff, just go through this method.<br /><b><span class="Apple-style-span" style="color: blue;">TCPView</span></b> is a Windows program that will show you detailed listings of all <b>TCP</b> and <b>UDP </b>end points on your system, including the local and remote addresses and state of TCP connections. you can download it from <a href="http://technet.microsoft.com/en-us/sysinternals/bb897437" style="border: 0px; color: #0033cc; text-decoration: none;">here.</a><br />When you start TCPView it will enumerate all active TCP and UDP endpoints, resolving all IP addresses to their domain name versions.<br />Endpoints that change state from one update to the next are highlighted in yellow;<br />those that are deleted are shown in red, and new endpoints are shown in green.<br />You can right-click on active connections and check the properties.<br /><div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirjaU7jIwAzC_80PkGNuQJZ1qKv1WNpCc7LEwG0ZNOFzxWKSZHbMJcFmmjkRxXz2iaS4-_qCy1htKcOfQOSgR3GMDRUxj3KIlYlFZRieUFr3mRu1QV5gnBz44vxab7ig5DyA6D-zJwq-3K/s1600/tcp.png" imageanchor="1" style="border: 0px; color: #0033cc; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirjaU7jIwAzC_80PkGNuQJZ1qKv1WNpCc7LEwG0ZNOFzxWKSZHbMJcFmmjkRxXz2iaS4-_qCy1htKcOfQOSgR3GMDRUxj3KIlYlFZRieUFr3mRu1QV5gnBz44vxab7ig5DyA6D-zJwq-3K/s400/tcp.png" style="background-color: #f3f3f3; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(221, 221, 221); margin: 0px; padding: 5px;" width="400" /></a></div>
<br />Once you get hold of the Trojan application, you can Kill the active connection and the running process and then delete the physical application file.<br />This will make you recover from the attack of Trojan.<br /><br /><br /><b><span class="Apple-style-span" style="color: red;">How to prevent a Trojan Attack??</span></b><br /><span class="Apple-style-span" style="color: red;"><b><br /></b></span><br />The key to preventing Trojans and backdoors from being installed on a system is to not to install applications downloaded from the Internet or open Email attachments from parties you don’t know.<br />Most commercial antivirus programs have Anti-Trojan capabilities as well as spyware detection and removal functionality.<br />These tools can automatically scan hard drives on startup to detect backdoor and Trojan programs before they can cause damage. It’s important to use commercial applications to clean a system.<br />Also use Malwarebytes Anti-Malware to protect your computer from all kinds of viruses and trojans. You can download it from <a href="http://www.malwarebytes.org/" style="border: 0px; color: #0033cc; text-decoration: none;">here.</a><br /><br /><b><span class="Apple-style-span" style="color: red;">NOTE: Never ever download trojans and RATs from third party websites. Always use Trojans from their official websites only.</span></b><br /><br /><b><span class="Apple-style-span" style="color: red;">About the author:</span></b><b><span class="Apple-style-span" style="color: red;"> </span></b>This is a guest post by <b><span class="Apple-style-span" style="color: blue;">ANUSHA MANNE</span> </b>who is interested in new technologies and wants to share knowledge with my blog readers. Usually writes articles related to<span class="Apple-style-span" style="color: blue;"><b> latest technologies</b></span> at <span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px;"><b style="border: 0px; color: #0033cc;"><a href="http://www.anushamanne.blogspot.com/" style="border: 0px; color: #0033cc; text-decoration: none;">Techie Talk</a></b></span><br /><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px;"><br /></span><br /><a href="http://www.blogger.com/" style="border: 0px; color: #0033cc; text-decoration: none;"></a><span id="goog_1370705558"></span><span id="goog_1370705559"></span>Hope you enjoyed the article, feel free to leave your comments for further<b> clarifications</b> and<b>doubts.</b></div>
</div>
</div>

How to secure yourselves from Trojans and RATs

Symptoms of a trojan: Unusual behaviour of the system is a mere indication of a Trojan attack!!! • Programs starting and running ...

9:39 AM

Secure yourself by identifying shortened URLs

Trojans and RATs- Know The Facts

How to secure yourselves from Trojans and RATs

Popular Posts

Comments

Blog Archive