Home > Ask the Security Experts > Ed Skoudis Questions & Answers > Are there effective tools that can determine if Storm and Nugache Trojans have been installed?
Ask The Security Expert: Questions & Answers
EMAIL THIS

Are there effective tools that can determine if Storm and Nugache Trojans have been installed?

Ed Skoudis, past SearchSecurity.com expert EXPERT RESPONSE FROM: Ed Skoudis, past SearchSecurity.com expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 15 February 2008
The article titled Storm, Nugache lead dangerous new botnet barrage was disturbing. Are there effective tools that can determine if these Trojans have been installed?


BROWSE BY TAG
Expert Archive: Information Security Threats,   Ed Skoudis,   Malware, Viruses, Trojans and Spyware,   Information Security Threats,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Ed Skoudis
Is introducing Wi-Fi to airplanes is a good idea security-wise?
Can a hacker actually post malicious scripts to any server using a drop-down list?
Should organizations implement an incident severity ratings system?
Is it possible to delete search data from a search engine's servers?

Malware, Viruses, Trojans and Spyware
ISP shutdown latest cat-and-mouse game with hackers
How to get rid of malware, botnets on a hospital IT network
How can search results lead to malware?
How to prevent mobile phone spying
Should a national cybersecurity strategy include offensive botnets?
How to defend against rogue DHCP server malware
New Trojan stealing FTP credentials, attacking FTP websites
Cybercriminals exploit Michael Jackson, Farrah Fawcett deaths
When BIOS updates become malware attacks
Antispyware buying guide for Indian enterprises

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
bot worm  (SearchSecurity.com)
directory traversal  (SearchSecurity.com)
government Trojan  (SearchSecurity.com)
Kraken  (SearchSecurity.com)
man in the browser  (SearchSecurity.com)
polymorphic malware  (SearchSecurity.com)
RavMonE virus  (SearchSecurity.com)
RFID virus  (SearchSecurity.com)
Rock Phish  (SearchSecurity.com)
Zotob  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


The best tools we have available today are the antimalware tools that include antivirus and antispyware functionality. The antivirus vendors constantly release new signatures and heuristic functions that try to detect recent widespread bots. Microsoft has also released and constantly updates its open source Malicious Code Removal tool, which deletes some, but not all, of the most virulent bots. However, there is always an inherent lag between the time the bad guys release their latest variant and when the vendors update their tools to detect it. That lag time could range from a day to several weeks, depending on whether the given malware is widespread enough to get attention from the vendor.

While antimalware tools will do most of the heavy lifting on bot detection, technically sophisticated users and certainly system administrators can analyze their machines to try to look for anomalies. I've written several articles on how to do this, including this detailed one on how to find malware on your Windows box.

One of the most useful tools in our arsenal is the humble netstat command. When run at a Windows command line with the "--nao 1" option, it will show all TCP and UDP port activity on a machine, displaying the process ID number every second. Because bots need to communicate with their botnet controller or peer-to-peer network; this technique can be used to look for unexpected communicating sessions on machines to identify a bot.

More information:




Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Find Security Solutions for Your Business
Targeted Security Channel Tips for Resellers, Integrators and Consultants
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts