keylogger detection

  • Thread starter Thread starter lucky
  • Start date Start date
L

lucky

Guest
is there anyway i can see if a keylogger is running on my pc those that send email of logs. and are there any methods for a backdoor to escape netstat -a detection and if yes how do i detect these kinda backdoors?and can hardware firewalls block ports that backdoors access?

thanx
 
LAN IP Destination URL/IP Service/Port Number
192.168.1.102 205.188.165.153 HTTP
192.168.1.102 205.188.248.25 HTTP
192.168.1.103 www.the-group.org HTTP
192.168.1.103 www.yahoo.com HTTP
192.168.1.103 205.134.182.164 HTTP
192.168.1.102 m.doubleclick.net HTTP
192.168.1.102 ad.doubleclick.net HTTP
192.168.1.102 205.188.165.153 HTTP
192.168.1.102 205.188.248.25 HTTP
192.168.1.102 205.188.165.153 HTTP
0.0.0.0 ê 0
192.168.1.102 213.114.109.166 412
192.168.1.102 205.188.248.25 HTTP
192.168.1.102 205.188.165.153 HTTP
192.168.1.102 205.188.248.25 HTTP
192.168.1.102 217.35.146.38 412
0.0.0.0 ê 0
0.0.0.0 ê 0
0.0.0.0 ê 0
192.168.1.102 24.127.100.248 412
192.168.1.102 193.253.212.97 412
0.0.0.0 ê 0
0.0.0.0 ê 0
192.168.1.102 205.188.9.100 5190
0.0.0.0 ê 0
0.0.0.0 ê 0
0.0.0.0 ê 0
192.168.1.102 203.167.136.85 31636
192.168.1.102 205.188.248.25 HTTP



this is my firewall log.....maybe u guys can see if there's anything suspicious bout it.......

thanx

P.S sorry bout the format of the log....but it was really a chore to post them up
 
All I can say is that you were surfin' around a lot, using AOL or ICQ and some kind of file sharing program, like DC.

The only strange line is this one:

192.168.1.102 203.167.136.85 31636 (Explanation: 192... is your IP, 203... is the connected IP, 31363 is the port used)

I can't find any programs responding to this port, so maybe you should consider closing it, unless you know it's legit. It might be a game or something that you connect to. If anyone else knows what this port is used for, please respond to this message, since collecting port numbers is a great hobby of mine :)
 
Next time you do a netstat or something similar close everything you know is using the internet. Whatever is left over is probably something you don't want. Then go through systematically starting up every program and writing down what it runs on.
 
203.167.136.85 is named dialup.clear.net.nz
 
unless you have to run it, disable file and printer sharing.

Reboot the system.

after reboot, close or disable all the chat programs and third party stuff that runs at start up.

From dos prompt type ipconfig /renew

after it renews

type netstat -a

this will now display anything thats currently running on the connection.

Depending on what operating system and what firewall you may be able to kill off any connections you care to.

And without knowing your operating system or firewall, it's hard to point you in the right direction.

The other posters are correct in that you might want to record these events or connections and study up on them.

http://www.iana.org/assignments/port-numbers can be somewhat useful but again this can be a bit overwhelming all at once.

Post your operating system and firewall and version. Perhaps we can direct you to better means of security.
 
There is no way. Format your computer and reinstall your OS. There's more clever ways to hide things in windows than there are people in the world with the knowledge to do it.

Once your system has been compromised it cannot be considered trustworthy until it's been completely wiped. If it's connected to a network, disconnect it at the plug. Check any floppies for viruses using another PC and use CDs to reinstall everything.

Netstat will generally show everything but you CANNOT BE CERTAIN until the system is wiped clean.
 
a firewall will block most trojan ports .
however u need to make sure that your OS is trojan free
<a href="http://hop.clickbank.net/hop.cgi?sccentral/diamondcs">Trojan Defense Suite</a> The shareware version will let you check on trojans and removal . the real fun starts when you have the regged version so u can do all kinda neat stuff like doing an entire port scan on your computer see what is open .
Great way to test firewalls course it takes 20 hours or so to check all bloody ports. But it works .
 
ok......
im on a small lan

win98
winME

linksys router wif firewall

netbios enabled

that's bout all

thanx
 
dude... you guys are crazy... it's like you guys can read the matrix dude... dude...
 
You must log in or register to reply here.
General chit-chat
Help Users
  • No one is chatting at the moment.
  • The Helper The Helper:
    I love the Trending Content!
  • The Helper The Helper:
    New News Forum World News
  • The Helper The Helper:
    How often does the Trending Content box refresh?
  • The Helper The Helper:
    Also, in the last template there was a seperation between sticky threads and regular threads in the forum
  • Ghan Ghan:
    Not sure. It's probably part of a cron job.
  • The Helper The Helper:
    Hey Ghan, whatever cron job its part of its not running its been the same for days. If it does not work can we remove it?
  • Ghan Ghan:
    More here: https://xenforo.com/community/threads/why-are-my-trending-content-threads-not-trending.232452/
  • The Helper The Helper:
    LOL! A tweak job!
  • The Helper The Helper:
    this is the fix I get from that yeah this is hard to control. disabling bots is pretty much necessary as ai and other bots would push really old threads to the top. reduce weight of view count. disable guest view tracking if you really want to push active threads to the top. a bit of tinkering for a few days with the weights and other settings should get you a decent trending widget box.
  • Ghan Ghan:
    I changed the settings a bit.
  • Ghan Ghan:
    Narrowed it to 7 days for the half-life and set views to 0 weight.
  • The Helper The Helper:
    I dont think Trending would work for this forum it would be better to just have the last 5 posts from anywhere
  • Ghan Ghan:
    Probably will have to give it some time to update.
  • Ghan Ghan:
    I'm guessing it is not retroactive.
  • Ghan Ghan:
    Next on the punch list: Update the server to Ubuntu 24.04.
  • The Helper The Helper:
    Mad Lads is new I see it displays original post date
  • The Helper The Helper:
    as long as it changes it is good - it is good now it updated and its new stuff
  • The Helper The Helper:
    One thing I have noticed and I dont know if it is by design but like 1 out of 3 times I come to the site the Anubis screen just hangs open, if I refresh it will go away but sometimes it hangs
  • Ghan Ghan:
    I've seen that as well.
  • The Helper The Helper:
    Wow - the change in the stats are major. I kind of knew it was all bots but wow, to see the effect. Why the social media sites cant do something like this I have no idea.
  • Ghan Ghan:
    Probably inflates their numbers so they look better to advertisers.
  • The Helper The Helper:
    Yeah google does not filter those bots. I remember when Apex was doing Google ads I saw the same IPs in there as I was seeing here - google is totally tracking all those bots as traffic and most google traffic, at least ours, was all bots
  • The Helper The Helper:
    oh wow, i bet i can post x links now and do the webp pics now giggity
  • The Helper The Helper:
    ahh anubis blocks anyone that has javascript turned off
  • The Helper The Helper:
    Robot: HTTP client library - i love the new robot :)

The Helper Discord

Staff online

  • Ghan
    Ghan
    Administrator - Servers are fun

Members online

Online now:
165 (members: 1, guests: 164)

Share this page

Affiliates

Hive Workshop NUON Dome World Editor Tutorials
Back
Top