How to detect trojans manually...

[enzyme6]

Hi, I'm new here. I was wondering if there was an efficient way of finding trojans on one's computer. My firewall log is showing outbound traffic being blocked on port 139. I did some research and found a list of possible causes known to use that port. Now I'm wondering if something like typing in the name of a trojan like Sad Mind in Windows Search will do any good. Do trojans use different names to cloak themselves? If they do, is there any way other than using ur anti-virus/ spyware programs that u can do by urself? I would appreciate any help. Thanks.

Lijin

 

[dyarwood]

Just a thought but why would you not want to use an antivirus or antispyware product? They are made for the job.

 

[tazuk]

If you are not comfortable using netstat to monitor ports, a freeware utility such as ActivePorts should help.
FileMon may also be of use to monitor file read / write activity.

Note that some anti-virus / anti-spyware products report ActivePorts as malicious because it includes an API that can be abused, although I'm not aware of any current exploits that do so.

HTH

TazUk

Blue-screening PCs since 1998

 

[enzyme6]

Thanks guys for responding. First, dyarwood, I didn't mean to imply that I dont use anti virus/spyware s/w. I do. But its those cases when something new is out and causing havoc that I was wondering about.

tazuk, I did have some exposure to netstat b4 so I was able to use that. but I wasn't able to find anything substantial. i'm gonna do some more research and get back to u. thx!

Lijin

 

[crow053]

port 139 is file and printer sharing, net bios. Make sure net bios is disabled, unless you are using it.

 

[ITSguy]

Go to the following site and download TCP View it will give you some great information on what ports are open and what they are connected to

http://www.sysinternals.com/Utilities/TcpView.html