Are you backdoored? 05-14-2013, 08:44 PM
#1
This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.
Some backdoors use browsers to connect back, and if it is your case, this code should find about it.
Some backdoors use browsers to connect back, and if it is your case, this code should find about it.
Code:
@echo off
title Are You Backd00red? by Noize
setlocal enabledelayedexpansion
echo Backdoor Finder
echo Coded by Noize at hackcommunity.com
echo.
echo Areyoubackdoored will check if any of your browsers are running.
echo Some backdoor programs use browsers to connect back.
echo You should close all browsers (don't kill the processes, though, just close the
echo windows) before you start, or else you would for sure find them running.
echo.
< nul set /p var=Press any key to start...
pause > nul
echo.
for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do (
cls
echo Please, wait...
echo Now looking for ID %%a...
for %%A in (chrome iexplore firefox opera safari tor) do (
for /f %%b in ('tasklist ^| find "%%a"') do (
for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j
)
)
)
cls
if not defined check goto nobackdoors
echo Done.
echo Your computer is probably backdoored:
echo process %check%looked open while it should have been killed.
echo.
< nul set /p var=Press any key to quit...
pause > nul
exit /b
:nobackdoors
echo Done.
echo No backdoors are using browsers on current computer.
echo.
< nul set /p var=Press any key to quit...
pause > nul
My Bitcoin address: 1AtxVsSSG2Z8JfjNy9KNFDUN6haeKr7LiP
Give me money by visiting www.google.com here: http://coin-ads.com/6Ol83U
If you want a Bitcoin URL shortener/advertiser, please, use this referral: http://coin-ads.com/register.php?refid=noize
Give me money by visiting www.google.com here: http://coin-ads.com/6Ol83U
If you want a Bitcoin URL shortener/advertiser, please, use this referral: http://coin-ads.com/register.php?refid=noize


![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
