0

I've got this malware(or spyware as Kaspersky detected), from the USB storage device by purely a lack of focus. After scanning and defecting all the drives that are connected to my computer with Kaspersky & Malwarebytes, I still feel unsatisfied that I might be still using a potentially dangerous computer.

I really don't bother about OS corruption, my only concern is that if there's someone somewhere leaking out information from my computer or from it's hardware anyhow.

Is there a way to scan all the ports for malicious activities?

closed as off-topic by Overmind, AndrolGenhald, Tom K., LvB, forest May 17 at 5:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • You can scan all ports fairly easily (something like Wireshark would work), but identifying if any information is being extracted without your approval is tricky. My computer is currently showing about 100 frames per second (requests/responses), while essentially doing nothing. Some of these are encrypted, some are data, some are network overhead. You would have to know all the legitimate connections, and then see if anything remained - and you'd still miss anything that managed to look legitimate (e.g. malware sending to a domain you trust which has been compromised) – Matthew May 10 at 8:34
  • @Matthew Oh, then I need to check them all manually. Thanks for the answer tho! – My name is name May 10 at 9:06
1

Sadly, there is no such thing. The reason for that being because it's extremely difficult to tell with a reasonable degree of accuracy what is benign and what is malicious.

Telling what is good from what is bad is a very general problem that Anti-Virus vendors have been trying to solve for a very long time. I won't judge how successful they were at doing so.

The underlying problem is that exact matches for behavior are extremely rare. Exact matches are only possible for very primitive malware, and even then only malware that has already been encountered in the wild.

What if my scanner is too permissive?

Simply put, it won't detect all the malware. And since you are the defender, defending successfully 99 out of 100 tries just isn't good enough.

What if my scanner is too restrictive/paranoid?

Imagine an anti-virus scanner that would alert you for every file you open, because it contains a 4-byte long match for some malware signature. Your operating system would effectively become unusable. As a result, you would become "numb" to any and all warnings from your scanner, thinking it's going to be yet another false positive.

What about ports specifically?

Since you mentioned port scanning specifically, I want to go into more detail about that. A port scanner is basically an application which tries to connect to many ports and see which ones answer and which ones don't.

More sophisticated port-scanners attempt to communicate with the application behind the port to see what the application does. If the port scanner sends an HTTP request and receives an HTTP response, the application is likely an HTTP server of some sorts.

The reason why this would not work for malware scanning is that such scanners can easily be tricked. An application can just choose not to reply, and the scanner would have to report "Sorry, I don't know what that is". Since this is extremely common behavior, it is likely not suspicious. Reporting it as "potentially dangerous" would lead to a "What if my scanner is too paranoid?"-scenario.

  • Thanks for the clarifying answer. I understand everything you've pointed out but then, you say that I'll never be able to be sure if is it safe to use my computer online after when I start to suspect if there's something wrong going on? Then formatting is the best and only way to solve the problem right? – My name is name May 11 at 17:23
  • If you already suspect that something is "weird", then I would definitely recommend a clean re-install. However, I don't know your system, and as far as I am aware, my answer is not specific to your system either. – MechMK1 May 13 at 13:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.