Is your machine a zombie?

[polonus]

Hi malware fighters,

Millions of PC's are turned into spam spewing zombie machines. Check if you are also likely to be part of a bot herd: http://www.rbltest.com/index.html

polonus

[drhayden1]

Zombie Detection System:
Reported as clean.
not dead yet damian my friend

[avatar2005]

My work PC is reported to be clean , I hope the home one will be too

UPD: Home PC is reported to be clean too

[Marc57]

All clean here, Thanks for the link damian.

[bob3160]

Since it reports my IP as clean, then it also means that
MySharedFiles are also clean. 

[DavidR]

@ polonus
This really doesn't say 'your system' is clean but that the IP you are currently dynamically assigned hasn't had a high volume of emails sent.

So this would only work to show 'your system' is clean if you had a static IP assigned.

Even then I don't believe it is worth much as the assigned IP address is for a browsing connection and your IP address for the mail server I guess is likely to be different. Plus if you were part of a spambot net I wouldn't think it would be using your ISP's mail server, but some other server that allows redirects, etc.

[neal62]

Thanks Polonus for this link. My IP was reported as clean by this program. Appreciate the info. 

[polonus]

Hi malware fighters,

Just for DavidR and for what it is worth we give it another test then.
Well this is off course for people with a fixed address, and is not for an address range.

Have you been labeled a spammer?
You may be able to find out.
First determine what your Internet protocol address is
by using a site like WhatIsMyIP.com at:
http://www.whatismyip.com/
Next punch your IP address (or your domain name, for business users)
into DNSstuff's Spam Database Lookup site to see a list of antispam companies
that recommend blocking your e-mail: http://www.dnsstuff.com/tools/ip4r.ch?ip=
or here: http://www.dnsbl.info/
or this followed by your current ip address: http://l.dnsbl.com/cgi-bin/l?l=

polonus

[polonus]

Hi malware fighters,

To start from another angle to establish you are behind a zombie computer is to use netstat.
This when you have some symptoms, sluggish computer, computer working idle (leds blinking),
altered hostfile, etc.

Netstat is a helpful tool for displaying information about current network connections. Here we present you with the scoop on Netstat syntax and uses.

Netstat (NETwork STATe) is an old part of the TCP/IP suite of tools. It's mentioned as far back as 1972, when it was known also as "who is up." Netstat is used to display not completely related information about current network connections. It has many implementations, from Unix to Microsoft Windows, each carrying a subset of the netstat commands.

Netstat is defined in RFC 1147, "The Internet Tool Catalog," as follows:
...a program that accesses network related data structures within the kernel, then provides an ASCII format at the terminal. Netstat can provide reports on the routing table, TCP connections, TCP and UDP "listens," and protocol memory management. MECHANISM Netstat accesses operating system memory to read the kernel routing tables.

Netstat provides this information for the moment at which one executes the command. That information might change even as netstat is running.
Netstat Commands and Syntax

Netstat works from a command line and has a variety of switches, as shown in Table 1.
Table 1 Netstat Command Switches

-a
   

Displays all connections and listening ports.

-e
   

Displays Ethernet statistics. May be combined with -s.

-n
   

Displays addresses and port numbers in numerical form.

-p proto
   

Displays connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.

-r
   

Displays the routing table.

-s
   

Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, and IP; The -p option may be used to specify a subset of the default.

interval
   

Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

Obviously, you can use the command

netstat /?

from a Microsoft DOS window to get the command set, or you can use the command,

learn to use it,

polonus