How do i find out if I have a back door open on my system?

[blunuke420]

Here is the meat and potatos of my system

1.1Gig Athlon Asus board, 256 ram, connect to a home network through a netgear router which has bellsouth dsl Pipeing through it. I run Winxp Home on this puter and win xp pro on the other networked puter.

Now, Im not going to say that I try and download sub7 and backorifice but i do look at and download some things from the net which if i met the person who put these things on the net in real life i would not trust em any farther then i can throw them...

My question is, how do you troubleshoot your box to make SURE you are not brodcasting anything out of it you don't want to.

I use zone alarm for my fire wall, AVG antivirus, and NFR Back Officer which rarely ever does anything but smile at me.

The reason i ask this question is because when i am booting the puter i will get ghostflashes from behind the Winxp logo as it is loading and at other times. I also will get a random soft (barely audible) booop sound from my box from time to time. Sometimes its just 1 BOOOP, and others its Booop....booooop.....booop....boop then it stops. If nothing else can someone point me to a good tutorial for this subject, as i have no wish to waste anyones time...

[s0nIc]

First, your AV System SHOULD tell you if you have one when you do a system scan or when the back door is running. 2nd you could check the Startup in msconfig and see whats loadin up while ur windows boots up, and you can also check the Task Manager and have a peek on whats runnin in the background. Firewalls should also do fine, you will be warned if a certain sofware tries to connect to the outside, and you are certain it is a trojan, deny the access and delete it.

[tamariki]

Have you tried Spybot? http://security.kolla.de/ If not download and you will be amazed at what it picks up.
http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD has a programme that places restricted sites in your registry, preventing unwanted cookies and other nasties accessing your PC.
http://www.simplythebest.net/info/spyware.html has tips and links for further security issues.

[mark_boyle2002]

Try going to the rear of your house and looking for a large wooden or glas panel with the handle on the end facing you.

To find backdoor trojans etc try getting adaware or spybot.

go to www.downloads.com and look for free antivirus software.

alternatively. go into dos mode and type netstat when in dos mode. this will allow you to view connections to and from your machine

[phishphreek]

Aside from what everyone else has mentioned...

Check your listening ports.

A good program for that would be fport from foundstone. Active ports is also a good one.

Reboot your computer and run these right after startup, so you can be sure that nothing else has loaded. Look for programs that you don't recognize and connections that shouldn't be there.

netstat will also do the same thing....

[DjM]

The Cleaner is the most powerful trojan detection and removal program in the world. It can detect every known trojan and keep your system from being infected. Unlike anti-virus programs, The Cleaner can also remove trojans already in your computer.

Now, I have never used this program, but it does get recommend a lot on these forums.

You can download a 30 day free trial HERE


Cheers:

[cybernetic]

trun off file and print sharing and client for ms networks if you don't use them

scan your systems w/ as many av programs as you can get your hands on.

look at the zonealarm premission config (what is it letting out and what's it blocking)

look at the location of common trojan start-up methods (reg. keys, start up folder etc. etc.)

self port scan each machine and each other + the router both on 127.0.0.1 and the real IP

manually check the C: esspecially at the '\' + 'system root' + 'program files'

use linux

[Amanda]

Originally posted here by cybernetic
scan your systems w/ as many av programs as you can get your hands on.
use linux

AVG Has never let me down. AVG and some nice spyware/trojan removal should work much better then haveing norton/Macfee/others all on the same comp while eating up usefull space & looking exactly for the same stuff.

[s0nIc]

I use Norton System Works and ZAP for firewall and neither has let me down, 3 years online, still using win98 with 96MB RAM, 500Mhz P3, Onboard video and sound, and ive NEVER ever once got comproimised.

[|The|Specialist]

Now when you say "Ghostflashes" do you mean a frame of a windows app appears but then dissappears so quickly that you'd barely notice it? I have had a similair issue with some of the programs I've got running at the startup but so far everythings been fine and you can't hardly notice anything unless you have your head up agianst the screen. As for these 'boops' do they sound like the sounds my program makes? Some trojans may have a option called auto-beep.... the purpose behind it is to mainly annoy or scare the user with stupid windows soundFX that plays over and over agian. But im thinking maybe a program is haveing trouble loading or something.

Of couse windows also plays stupid soundFX when the wrong key is hit, or something weird happend, or when message boxes appear.