5

Here is a snap shot of my processes running on Windows XP enter image description here

Is there anything suspicious?

How will you know if some one is accessing your computer remotely?

3 Answers 3

7

A remote access implies a network connection. You can detect a network connection using tools like netstat. You can actually see the data using a sniffer. Unless it's encrypted.

You may fail to see the connection if your computer is compromised and netstat was replaced with a patched version that would hide the rogue connection.

It is still possible to detect such a data flow if you are the middle man - control both your computer and the router in front of it. Then you would run a sniffer on the router and would see data coming for your computer from outside. Again, unless your router is compromised as well.

7

Instead of process explorer you should use tcpview, by the same guy (Mark Russinovich). It's also on the Sysinternals site somewhere!

It will show you all network connections from and to your computer in a very clear, sortable and tabular manner.

There is nothing suspicious in your process list. But anything could hide itself in a svchost.exe as a Windows service. No, don't close them, they're crucial for your PC to run without difficulties! (Especially the "RPC" service... Things are really going DOWNWARD if you close that one). Also viruses can inject into other processes, where you can only see them in the "loaded library" list of Process Explorer for each process. But this is about if someone accesses your computer from outside, which does not always have something to do with viruses.

1

Try plugin a safe box (a non-Windows box if possible) and use Wireshark to sniff network traffic. If you see anything flowing suspicious (like some weird port or an incoming connection from the outside) then you definitely are.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .