427 Botnet fm qxd

www.syngress.com/solutions
and click on the 
“Ask the Author”
form. 
427_Botnet_02.qxd 1/9/07 9:49 AM Page 73

---

■
At times your computer may run significantly slower than normal.
Unfortunately this is commonly due to AV software searching for
various forms of malware, including botnet clients.
■
The network activity light on your DSL modem or NIC card may
flash rapidly during a time when you aren’t doing anything that you
believe would cause network traffic.
■
Your antivirus program may shut off by itself.
■
If it’s still running, your antivirus program may detect several types of
malicious code at one time.The names given to the viruses may indi-
cate parts of a botclient’s functionality like hide windows, backdoor,
and so on.
■
Your Windows XP firewall log, which may be called pfirewall.log if a
domain policy hasn’t picked another standard, is located in the
Windows or WINNT directory. Examine any Inbound Open source
IP addresses and destination ports for a rational explanation. If you
have access to lists of Command and Control servers, any traffic to a
known C&C server should be considered a big clue.
■
Run TCPView from www.systeminternals.com. Examine all of the
network connections and the processes that are associated with them.
Any unknown processes or unfamiliar connection IP addresses should
be investigated.
■
Run Process Explorer from www.systeminternals.com. Examine the
processes to see if any processes are running that don’t normally run
on your computer. Right-click to be able to select Verify. If the
vendor is unable to verify the process, you can click on Google on
the same menu. Using Google you can see if anyone else has
reported bad things about the process. One problem with this
approach is that hackers may replace known good executables with
malware and reuse the good software’s name.
■
Check the security event log for login failure for network type 3
where the workstation name does not match the local computer
name.This would be a sign of a password guessing attack, particularly