how can i detect trojan activity?

Hi

I was wondering if any of you have a tool or program that can detect when a file or program acceses another program that has internet privleges ,and can detect other suspicious activities




:borg:

you mean like a firewall?



slick

no some firewalls have that component but i want a program just for that

Your profile says you're using windows, so here goes:

You should get a decent firewall (like what slick8790 says) with a good report-generating feature. Try to search here at antionline and you'll see some useful info about what might be of service to your needs.

Also try to to get TaskInfo at http://www.iarsn.com/taskinfo.html . I find it very useful and informative, a lot better than the usual task manager. It will tell you what's hogging the resources and where those files are located (correct me if im wrong, but win taskmanager wont tell you the path of the process file).

If you're on a network, and you're on the server which shares internet on LAN, try using LanScan Network Monitor at http://www.lanscan.com . It will tell you which computer on the network is hogging the bandwidth and on what site they are connected to. I find lanscan very useful in concern to administering correct bandwidth usage on a network.

hope this helped.

is there any (small sized ) anti trojan anti hacker firewall that you know of that can work with zone alarm :)

Hi,

Though this isn't exactly what you're looking for, but I find it handy.

It alerts you when a program makes a change to the registery, as many trojans will do and gives you the choice to delete the string, or keep it.

Regprog

You can set it to run at start up, and its free :)

Hi,

Take a look at:

http://digilander.libero.it/zancart

Winsonar

I usually relate connectivity to firewalls like the rest of the guys have suggested........this one looks at background systems that start running?

Cheers

"anti trojan anti hacker firewall" - there was once a place called paradise :)

if this will be a server which you wont use for development or any other purpose other than just being a fulltime server, then you dont have to worry much about trojans.

as for the anti hacker part, that's kinda hard :) haven't heard of anything like that yet.

i'm using zone alarm in one of my webservers and it's doing pretty much of a good work. Although I'm not very happy with its report generation.

also, putting 2 firewalls together on the same box is not always the trend. you should pick two firewalls which you know will work with each other seamlessly (i find that hard to find). and you also need to let them run under close supervision because they will probably mess with each other (i tried zone alarm and norton firewall, they messed up).

best method for you as i think, just put an auto-updating antivirus (almost all commercial ones are), put a hardware firewall (costly though) and then keep watch :)

coolfuse,

You might try ZoneLog Analyser 1.19

http://www.zonelog.co.uk

I think that is the link?............it works alongside Zonealarm and provides detailed reporting.

Cheers

nihil: yeah i used ZoneLog Analyzer before and with some reason, i stopped using it (i forgot what was it). i better install it again and check it out again. thanks for refreshing my mem. now, im using tiny PF on my new server. seems better than ZA, but thats just me.

sounds like your looking for proport from the digital underground thier main site is under construction all they have are the downloads with no discription so i googled for proport and found it on tucows:

http://www.tucows.com/preview/209068.html

Information:
This is a Trojan and nuke protection program. It monitors local ports for incoming connections or attacks and provides the option to disconnect them.
It comes with a default list of 300 common Trojan ports to monitor that can be edited by the user.

It also has an attack log, remote filter and process manager. Plus, it features an autostart method spy, autostart file editing, and file scanning.

---------------

i used it a while ago, and still have an older copy running on a machine. it was ok but id rather have an alerting firewall

hey man why dont u check the open ports of ur system using nmap. this will tell u the extra acivities going in ur system and you can check them by either losing the demons of those services or by removing the extra programs from the system manually.

firewall my help you to prevent and detect trojan coming or in your system, but not you can take a visit in this site http://www.softlandmark.com/ go free downloadable software for security purpose security, but if your not talking baout firewalll maybe using a program that look out for some changes in registry ... as far as i know trojan and other virus can be found in the registry ...

If I am not wrong, you are looking for something that is similar to the Jetico Personal Firewall. I have not try this beta Firewall, but I have take a look at the help file:

Process attack module is designed to filter out following common used hacker's practices:
-Running hidden web browser
-Application code modification
-Injecting malicious code to running applications
-Installing global hooks

I don't see this feature in any other Firewalls. It is good to have it.
http://www.jetico.com

Put stethoscope on large wooden horse ?

You could always wait for the next round of RIAA supenas to be issued. If you get one then YEP, You've got a trojan on your hands. :)