1

I have a Windows 8.1 machine that seems to be acting weird and getting slow day by day. I believe that it may be a victim of Remote access Trojan(RAT) infection.

How do I listen to ports on my PC and how do I close them if necessary ?

How do I deduce that a port is associated with a RAT and how do I close it ? Will netstat be of any use in this respect ?

1

First of all, you should check that your firewall is enabled in Windows. Make sure it doesn't have any weird exceptions listed in it. Secondly, install and run antivirus scanner(s) for the entire system. You can run 'netstat -aon' from command prompt to see all "listening" ports. Also check from task manager if you have any weird processes running with SYSTEM privileges, even something benign sounding like "notepad.exe". Although, if the perp has infected you with a rootkit, everything may look just normal and you cannot find anything suspicious using above methods. In that case you could only use traffic monitoring and analysis to detect any anomalies in it.

1

Often malware can attempt to mask itself, so if you are compromised it may be difficult to detect on the system itself. I don't know much about the use of this system, but moving slower and slower could mean adware if it browses a lot of websites. Still somewhat malicious but not quite the same intent as a RAT. You could consider running spybot search and destroy or malwarebytes to see if they find anything interesting. Process explorer could help you locate strange processes. You could also run something like wireshark and view the network traffic leaving the device. You could potentially spot something suspicious there, but of course run it with everything else closed to eliminate noise. This may just be another underlying OS issue and not malicious, you could attempt to run an OS recovery on the system and see if it is resolved. If this were in a corporate environment and I could change around my infrastructure I would attempt to set up a SPAN port and capture traffic originating from that host so I could see what it is doing, in a way that malware on it could not alter.

2
  • How do I eliminate noise ? I don't think just closing my browser will do that. For example, Windows Update maybe running or other services maybe looking to update. So what all do you recommend turning off ? Is there a good anti-adware software that you would recommend ?
    – Sreyan
    Sep 25 '14 at 13:53
  • You're right that other things can run in the background, but I just mean the less running that could create a network connection the better. You also could run your system in safe mode which would likely be running less background services. As to anti-adware I've found the free versions of both malwarebytes and spybot to be pretty good. Sep 25 '14 at 17:07
1

You will need an Ethernet hub, not a switch (available cheap on eBay) and a second computer. Plug the Win8.1 computer into the hub and plug your Internet connection also into the hub. The Win8.1 computer now has connectivity through the hub.

Download Wireshark to the second computer and install it. Plug the second computer also into the hub, start Wireshark, and put it into promiscuous mode. Set up a filter to look only at the IP address of the Win8.1 computer.

You will now be able to monitor all the incoming and outgoing traffic on that computer. Do know that there's normal "chatter" even when a computer is supposedly idle, so you're going to have to try to separate that chatter from any malicious traffic.

If the suspect computer is part of a botnet, you may see a very large volume of traffic. That's bad. If it's running a keylogger or such, perhaps not. Log on to an unimportant site and See What Happens. (tm) (Change your password on "unimportant site" immediately after, and from a different computer.)

If you find evidence of malware, there are cleanup programs mentioned in the other answers. Safest course: Back up your data and re-install the operating system after formatting the disk using a bootable CD.

4
  • I am attaching a copy of the output that I got from running netstat -aon on my machine. Netstat output How do I classify something as malicious ? What type of data am I looking for that will label a process/port as malicious ? PS I have omitted my IP Address in the output provided, so it is marked with x.
    – Sreyan
    Sep 26 '14 at 17:51
  • You're going to need to do reverse DNS on those IP addresses to see which ones you can eliminate as harmless, then investigate further those that remain.
    – Bob Brown
    Sep 26 '14 at 17:53
  • What about those that can't be resolved ? And also, for example I have some IPs that link to the US so how do I judge whether that is malicious or not ? Reverse DNS lookup provides me with no other info. What is the next step of investigation that you would recommend after eliminating the harmless IPs ?
    – Sreyan
    Sep 26 '14 at 17:58
  • Use Windows Firewall to block the ones you can't eliminate and see what stops working. Take careful notes as you go through this process.
    – Bob Brown
    Sep 26 '14 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.