Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible for spywares/ virus not to be detected by network monitoring tool ( for eg TCPView) if they are sending information/files over internet ?

share|improve this question
1  
Yes, why are you asking? Are you doing something or just a general question? –  AthomSfere Mar 22 '13 at 1:28
    
I am asking because I know anti-spywares may not be effective. But how come traffic monitoring softwares cannot catch that some app is sending data over internet ? –  Esha Sharma Mar 22 '13 at 1:39
    
Because malware can interfere with the traffic monitoring software. If a PC has ANY malware on it, you can't trust ANYTHING on that computer: you don't know how much access the malware got. Monitoring stuff can help, but you really need a separate computer to monitor and report on issues for security stuff; you can't rely on the primary. –  cpast Mar 22 '13 at 2:07
    
@cpast can these malwares transmit files/ documents etc without being detected ? –  Esha Sharma Mar 22 '13 at 2:19
    
I believe it can send stuff without being detected by software on the compromised machine (if it gains admin access, it can do anything: the general guideline is that once a system is compromised and a malicious user gains admin access, you no longer control that computer, can't recover, and need to start over). Now, you can monitor the network traffic, just not using tools on the compromised machine. –  cpast Mar 22 '13 at 2:30

1 Answer 1

This really comes down to where you are running the network monitoring and how low level the malware is.

Most malware that you see (from my experience) is not low-level enough to re-write networking stacks to where local monitoring tools would not see the traffic. This could happen though, so there is always a change of the traffic blindly passing through. You are getting more into root-kits and things like that, not you everyday malware when this happens.

If you run the network monitoring on the gateway/router, you are going to see the traffic from the machine, now matter how low-level the malware is. This will show you all traffic coming from a host if it is on the gateway, no matter how the traffic is disguised.

share|improve this answer
    
I donot have control on the router it is provided by my organisation. Could you suggest best way to figure out if there is a malware or not ? –  Esha Sharma Mar 22 '13 at 11:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.