Как я могу контролировать свой интернет-трафик, будучи зараженным трояном или руткитом?

624
HQtunes.com

Как я monitorмогу подключиться к Интернету traffic, если он заражен трояном или руткитом? Какое приложение я должен использовать?

0

2 ответа на вопрос

3
MariusMatutiae

It may not be possible to do that, from within the infected pc.

Most trojans, and surely all rootkits are sophisticated enough to be able to hide their own existence and their activities from prying eyes. You may try using TCPView, an instrument by Mark Russinovich which displays, despite its name, open connections, both TCP and UDP. It has not been updated in quite some time, and it is not clear to me whether it is capable of foiling the sophisticated techniques employed by rootkits to evade detection.

What you are proposing to do is most easily accomplished by intercepting traffic from an healthy node along the way. For instance, security experts allow Virtual Machines to get infected, and they monitor their connections from the uninfected host pc. Or, if you have a router that uses something more elaborate than standard firmware (like for instance DD-WRT, OpenWRT or Tomato firmware) you can log onto the router, and use standard tools (wireshark and tcpdump) to check on the traffic.

You should also be aware of the possibility that the traffic be encrypted (it often is), exactly to make it harder for security experts to devise suitable counterstrategies. Still, even in these cases a use of tcpdump/wireshark will at least give you a list of IP addresses from which the trojan or rootkit in question is being controlled, and/or the list of possible targets, and/or a list of other infected pcs, all valuable information.

1
DarkMoon

Both Wireshark or Fiddler can show you the network traffic from a PC.

Похожие вопросы