How do i find out if I have a back door open on my system?

Here is the meat and potatos of my system

1.1Gig Athlon Asus board, 256 ram, connect to a home network through a netgear router which has bellsouth dsl Pipeing through it. I run Winxp Home on this puter and win xp pro on the other networked puter.

Now, Im not going to say that I try and download sub7 and backorifice but i do look at and download some things from the net which if i met the person who put these things on the net in real life i would not trust em any farther then i can throw them...

My question is, how do you troubleshoot your box to make SURE you are not brodcasting anything out of it you don't want to.

I use zone alarm for my fire wall, AVG antivirus, and NFR Back Officer which rarely ever does anything but smile at me.

The reason i ask this question is because when i am booting the puter i will get ghostflashes from behind the Winxp logo as it is loading and at other times. I also will get a random soft (barely audible) booop sound from my box from time to time. Sometimes its just 1 BOOOP, and others its Booop....booooop.....booop....boop then it stops. If nothing else can someone point me to a good tutorial for this subject, as i have no wish to waste anyones time...

First, your AV System SHOULD tell you if you have one when you do a system scan or when the back door is running. 2nd you could check the Startup in msconfig and see whats loadin up while ur windows boots up, and you can also check the Task Manager and have a peek on whats runnin in the background. Firewalls should also do fine, you will be warned if a certain sofware tries to connect to the outside, and you are certain it is a trojan, deny the access and delete it.

Have you tried Spybot? http://security.kolla.de/ If not download and you will be amazed at what it picks up.
http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD has a programme that places restricted sites in your registry, preventing unwanted cookies and other nasties accessing your PC.
http://www.simplythebest.net/info/spyware.html has tips and links for further security issues.

Try going to the rear of your house and looking for a large wooden or glas panel with the handle on the end facing you.

To find backdoor trojans etc try getting adaware or spybot.

go to www.downloads.com and look for free antivirus software.

alternatively. go into dos mode and type netstat when in dos mode. this will allow you to view connections to and from your machine

Aside from what everyone else has mentioned...

Check your listening ports.

A good program for that would be fport from foundstone. Active ports is also a good one.

Reboot your computer and run these right after startup, so you can be sure that nothing else has loaded. Look for programs that you don't recognize and connections that shouldn't be there.

netstat will also do the same thing....

Quote:

---

The Cleaner is the most powerful trojan detection and removal program in the world. It can detect every known trojan and keep your system from being infected. Unlike anti-virus programs, The Cleaner can also remove trojans already in your computer.

---

Now, I have never used this program, but it does get recommend a lot on these forums.

You can download a 30 day free trial HERE


Cheers:

trun off file and print sharing and client for ms networks if you don't use them

scan your systems w/ as many av programs as you can get your hands on.

look at the zonealarm premission config (what is it letting out and what's it blocking)

look at the location of common trojan start-up methods (reg. keys, start up folder etc. etc.)

self port scan each machine and each other + the router both on 127.0.0.1 and the real IP

manually check the C: esspecially at the '\' + 'system root' + 'program files'

use linux

Quote:

---

Originally posted here by cybernetic
scan your systems w/ as many av programs as you can get your hands on.
use linux

---

AVG Has never let me down. AVG and some nice spyware/trojan removal should work much better then haveing norton/Macfee/others all on the same comp while eating up usefull space & looking exactly for the same stuff.

I use Norton System Works and ZAP for firewall and neither has let me down, 3 years online, still using win98 with 96MB RAM, 500Mhz P3, Onboard video and sound, and ive NEVER ever once got comproimised.

Now when you say "Ghostflashes" do you mean a frame of a windows app appears but then dissappears so quickly that you'd barely notice it? I have had a similair issue with some of the programs I've got running at the startup but so far everythings been fine and you can't hardly notice anything unless you have your head up agianst the screen. As for these 'boops' do they sound like the sounds my program makes? Some trojans may have a option called auto-beep.... the purpose behind it is to mainly annoy or scare the user with stupid windows soundFX that plays over and over agian. But im thinking maybe a program is haveing trouble loading or something.

Of couse windows also plays stupid soundFX when the wrong key is hit, or something weird happend, or when message boxes appear.

When you first turn on your computer
Goto run, cmd
Netstat -a
there shouldn't be anything there that doesn't look 'right'. Connected to other computers on your network is fine, also is being connected to them via port 0.
If you see some remote IP address ie 64.xxx.xxx.xxx:31337 connected to port # 31337 or some other suspicious port (search google for port list) you can even check every connection, there should not be many, for anything out of the ordinary.

You can also manualy check registry entries. A link for those can be found here.

The boops that I am hearing are coming from the computers internal speaker. Its almost akin to a 70's style atari boop or the sound your box makes when you overload the keyboard buffer and ever time you press a button your box boops to let you know that its taking a crap on itself so quit hitting the keyboard...

Anyway thanx for all the help on this subject. I have put most of everthing I read here to use and am fairly confident now that no one has control of my puter but me.

"My question is, how do you troubleshoot your box to make SURE you are
not brodcasting anything out of it you don't want to"

Hi

Besides using antivirus and spybot

You should always verify your ethernet card is not in
promiscuous mode with a detection program here is one for Windows there
may be others you can find using the google search engine I'm only
famillar with anti-sniff from Lopht..........

http://ntsecurity.nu/toolbox/promiscdetect/

If the answer is yes

then you have to check for any sniffers on your computer
if you discover the hackers sniffer it may be able possible to search
the sniffers log to piece together what he did on your system

Beware

To disguise a backdoor from your attention our friend likes to use tools
from the Windows resource kit such as Srvany.exe and netcat.exe to create
a service on your pc that he/she can connect via a remote shell
once he/she checks out what services are running before installing
the backdoor picks one that's turned off removes it with 'Srvinstw.exe'
tool then install a new service with the same name. This disguises his
backdoor and reduce the chance you'll detect it so you'll be running
around looking for new services or anything weird and won't know....
check everything on your computer not just the odd or
weird stuff that would tip you off to the Intruder when it could
be right under your nose..........

Doc ;)