untangling_the_web

DOCID: 4046925
UNCLASSIFIEDiiFOR OlililelAL USE ONLY
4. open a DOS command tool and type netstat -a 15 or
select Start I Run I netstat -a 15
Netstat will display all the active and listening IP ports on your computer refreshing
every 15 seconds. What you are looking for is suspicious port activity. For
example, if port 31337 is active, there is a good chance you have the Back Orifice
Trojan on your computer. Also, look for unknown FTP server processes (port 21) or
web servers (port 80) that show up using netstat. But remember, you must
disconnect from the Internet and shut down all programs that might use the Internet
to get an accurate reading.
Or you can try a free online Trojan scanner such as the one available from
PCFlank.com or WindowSecurity.com (below). While a negative report is no
guarantee you do not have a Trojan horse, a positive test means you need to take
action to remove this infection.
What should you do if you think you have a Trojan on your computer? I strongly
recommend that you not start deleting software indiscriminately because something
you don't recognize may in fact be a piece of vital software! Instead, if something
suspicious shows up in your netstat investigation, now is the time to get some good
Trojan-detection and removal software. Below are some sites that will help you
locate legitimate anti-Trojan software and provide other advice on how to prevent
and remediate infection.
What if you ultimately discover that your computer is infested with a Trojan? Even
after you have successfully removed the malware, this may not be the end. How
long was the Trojan on your system? What kind of information did it collect and
forward? It is probably prudent (if inconvenient) to change all your passwords and
even get new credit cards if you have used them on that computer just to be on the
safe side. If you do such things as stock trading on your computer, you should
probably assume your account has been compromised. In fact, assume everything
on your computer has been compromised and treat the invasion as if a thief broke
into your house and lived in it for months without your knowledge.
As you can see, Trojan horses are bad, really bad. Again, it is best to avoid them,
and the single best defense is not to be promiscuous when it comes to downloading
software and opening email attachments. The second best defense is a good
firewall. But keep in mind that it is up to you to set the firewall options at a high level
of protection to ensure that no Trojan can "phone home" without your permission.
List of Trojan Ports
Onctek's Trojan Port List
Anti-Trojan Software Reviews
Anti-Trojan.org
Anti-Trojan Guide from Firewall Guide
http://secured.orcon.net.nz/portlist list.html
http://www.onctek.com/trojanports.html
http://www.anti-trojan-software-reviews.com/
http://www.anti-trojan.org/
http://www.firewallguide.com/anti-trojan.htm
590 UNCLASSIFIEDliliOft OlililelAL USE or~L,(