Networks

Ask something
Discussion Locked

PortScans and Trojans...

0 helpful
5 replies

by dgemcse

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Need some help thinking like a hacker...
Security or IDS has never been something I could spend alot of time here, as I am a one man army.
Demo'd Retina, and find that there are ports open on certain machines for known trojans. This, after we werehit hard by some backdoors that killed AV on alot of machines, from a remote user bringing his machine in here and connecting (ouch!)
Anyway, netstat on local machines do NOT show the same ports that the portscans are showing as open. EX: retina shows 1045 Rasmin on one machine, but a local netstat does not. Why is that?
What other tools are out there for this kind of detection? I am not good with a sniffer. Was using Super Scan as well as Retina, and they are both showing similar info. Why can I not see this in netstat, and what does it really mean? Infected or not? AV is running and no hits there.

Why would the portscanners show this as open, but not see it locally? Any good reading, or other sources of info for using portscanners to track down other trojans that might be lurking about?

Thanx!!

5 replies

by mshavrov

Best practice to fight against troyans and viruses is in installing Antivirus and, probably, some "Spy Detection" software. Antivirus alone will not solve all problems, since some antiviruses do not react on "semi-trojans" (like Gator, etc.). I was shocked when I run PestPatrol for the first time even considering a fact that I have antivirus all the time and I update signatures weekly. Try this. By the way, you may use "online antiviruses" (Trend, etc.) and freeware "Spy Detectors" (try to look"spyware" on Google.

Good luck.

by darthkim

Most of the "better" trojan's hide themselves or modify netstat to hide their presence.

sysinternals.com and foundstone.com offer free tools which really identify what services are really running.

Also keep in mind that vulnerability scannersdon't often tell the right story. Often they misidentify ports as a trojan, when in case they are valid applications.

Good Luck.

This discussion is closed to new replies.