Hi malware fighters,
To start from another angle to establish you are behind a zombie computer is to use netstat.
This when you have some symptoms, sluggish computer, computer working idle (leds blinking),
altered hostfile, etc.
Netstat is a helpful tool for displaying information about current network connections. Here we present you with the scoop on Netstat syntax and uses.
Netstat (NETwork STATe) is an old part of the TCP/IP suite of tools. It's mentioned as far back as 1972, when it was known also as "who is up." Netstat is used to display not completely related information about current network connections. It has many implementations, from Unix to Microsoft Windows, each carrying a subset of the netstat commands.
Netstat is defined in RFC 1147, "The Internet Tool Catalog," as follows:
...a program that accesses network related data structures within the kernel, then provides an ASCII format at the terminal. Netstat can provide reports on the routing table, TCP connections, TCP and UDP "listens," and protocol memory management. MECHANISM Netstat accesses operating system memory to read the kernel routing tables.
Netstat provides this information for the moment at which one executes the command. That information might change even as netstat is running.
Netstat Commands and Syntax
Netstat works from a command line and has a variety of switches, as shown in Table 1.
Table 1 Netstat Command Switches
-a
Displays all connections and listening ports.
-e
Displays Ethernet statistics. May be combined with -s.
-n
Displays addresses and port numbers in numerical form.
-p proto
Displays connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r
Displays the routing table.
-s
Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, and IP; The -p option may be used to specify a subset of the default.
interval
Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.
Obviously, you can use the command
netstat /?
from a Microsoft DOS window to get the command set, or you can use the command,
learn to use it,
polonus