Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As a personal user, how can we detect the path of the backdoor or virus and remove it with network monitor?

share|improve this question

migrated from Jan 11 '10 at 10:47

This question came from our site for system and network administrators.

Wow. That's a vague question. What operating system? What do you mean "with network monitor?" I'm going to assume your question is this:

How can I tell if something has installed a backdoor on one of my systems over the network?

There's two main tools you'll use: First, nmap to scan the system and see if it's listening on any ports it shouldn't be. Second, ethereal/wireshark/tcpdump to look at the network traffic leaving the system and see if there's anything strange in there.

share|improve this answer

You basically can't.

If it's a decent backdoor, it's not detectable at all from within the system and the only way to even suspect there's a backdoor installed is by doing as Schof wrote and monitor the network traffic from outside...

...and that will most likely not give away much more than suspicion as it's likely to use outbound HTTP or HTTPS anyway. The system then obviously has to be wiped, or rather, it should have been wiped the second you suspected there's something wrong with it. There's no real business case in trying to hunt down and identify a backdoor unless that's what the general business plan is or this is some kind of high-security facility where identifying some kind of culprit is of importance. And if it is, you call in the experts ^^

Now, a stupid backdoor however might be detected by your favorite anti-malware application.

share|improve this answer

You must log in to answer this question.