Basic way to guard us from keylogers
Now i believe Everyone here might know that you need to have an internet connection to make a RAT or a Password Recovery Tool work, which would mean, if you are not connected to internet, you dont have to worry about being infected with RAT or Password Recovery Tool.
Ok, so for those who have internet connection & think they are being infected with a Trojan.
Tutorial starts:
1st
Now every program has their own process which can be seen on task manager. So the First thing to do is to find out which process the Trojan is being attached to.If you see some unknown process search that on google. A good hacker will always makes sure he hides its process with a Windows based Process for eg. svchost.exe or something like that.
2nd
If you cant find, then the next thing you can do is use cmd.
how to open cmd prompt
Click on Start--->Run-->Type Cmd
3rd
Once Command Prompt is opened. use this command
netstat -an |find /i "listening"
Note: The NETSTAT command will show you whatever ports are open or in use, but it is NOT a port scanning tool!
Now we wonder What this Command does?
this command will show all the opening ports. Now check for any unknown port.
4th
YOu can skip step 3 if you want, and can do this instead.
Open command prompt and type
netstat -b
Now this command will show you the active connections with the process with their PID(Process Identifier) and also the packets.
Look out for SYN Packets & the Foreign address its been connecting with , check the process its been associated with , check the ports also. If you find that its connecting to some unknown ports, then you can say you have been backdoored.
5th
Go to your task manager.
On the top of it, click on View---> select Column---> Tick on PID(Process Identifier).
Match the suspicious Process with the Processes In task manager, check PID also.
Now most of the RATs resides on Start up. how to delete them from start up?
1st
Go to regedit ---> HKLM\Software\Microsoft\Windows\Current version\Run
On the Right hand side, check for the process name which you find on step 4. if its not their. Check at
HKCU\Software\Microsoft\Windows\Current Version\Run
OR
Open Cmd prompt & type start msconfig
Go to Startup tab, you can check the startup process there.
Now i believe Everyone here might know that you need to have an internet connection to make a RAT or a Password Recovery Tool work, which would mean, if you are not connected to internet, you dont have to worry about being infected with RAT or Password Recovery Tool.
Ok, so for those who have internet connection & think they are being infected with a Trojan.
Tutorial starts:
1st
Now every program has their own process which can be seen on task manager. So the First thing to do is to find out which process the Trojan is being attached to.If you see some unknown process search that on google. A good hacker will always makes sure he hides its process with a Windows based Process for eg. svchost.exe or something like that.
2nd
If you cant find, then the next thing you can do is use cmd.
how to open cmd prompt
Click on Start--->Run-->Type Cmd
3rd
Once Command Prompt is opened. use this command
netstat -an |find /i "listening"
Note: The NETSTAT command will show you whatever ports are open or in use, but it is NOT a port scanning tool!
Now we wonder What this Command does?
this command will show all the opening ports. Now check for any unknown port.
4th
YOu can skip step 3 if you want, and can do this instead.
Open command prompt and type
netstat -b
Now this command will show you the active connections with the process with their PID(Process Identifier) and also the packets.
Look out for SYN Packets & the Foreign address its been connecting with , check the process its been associated with , check the ports also. If you find that its connecting to some unknown ports, then you can say you have been backdoored.
5th
Go to your task manager.
On the top of it, click on View---> select Column---> Tick on PID(Process Identifier).
Match the suspicious Process with the Processes In task manager, check PID also.
Now most of the RATs resides on Start up. how to delete them from start up?
1st
Go to regedit ---> HKLM\Software\Microsoft\Windows\Current version\Run
On the Right hand side, check for the process name which you find on step 4. if its not their. Check at
HKCU\Software\Microsoft\Windows\Current Version\Run
OR
Open Cmd prompt & type start msconfig
Go to Startup tab, you can check the startup process there.
0 comments:
Post a Comment