As a personal user, how can we detect the path of the backdoor or virus and remove it with network monitor?
migrated from serverfault.com Jan 11 '10 at 10:47
This question came from our site for professional system and network administrators.
Wow. That's a vague question. What operating system? What do you mean "with network monitor?" I'm going to assume your question is this:
How can I tell if something has installed a backdoor on one of my systems over the network?
There's two main tools you'll use: First, nmap to scan the system and see if it's listening on any ports it shouldn't be. Second, ethereal/wireshark/tcpdump to look at the network traffic leaving the system and see if there's anything strange in there.
You basically can't.
If it's a decent backdoor, it's not detectable at all from within the system and the only way to even suspect there's a backdoor installed is by doing as Schof wrote and monitor the network traffic from outside...
...and that will most likely not give away much more than suspicion as it's likely to use outbound HTTP or HTTPS anyway. The system then obviously has to be wiped, or rather, it should have been wiped the second you suspected there's something wrong with it. There's no real business case in trying to hunt down and identify a backdoor unless that's what the general business plan is or this is some kind of high-security facility where identifying some kind of culprit is of importance. And if it is, you call in the experts ^^
Now, a stupid backdoor however might be detected by your favorite anti-malware application.