[commander]

Nice tutorial... it was helpful. I did it and found that some process shown in the cmd (which are ESTABLISHED) are not listed in the Task manager. What should I do???
Thanks...

[Danus]

Nice tutorial gotta say, although newbies might stop important windows processes and crush the computer.

[Yung Lean]

Very nice tut. But you can also to make sure check your System32 folder press to sort your files by date and if you see what files have granted access lately and look for the suspicious files cos most rats hide in System32 folder or Temp folder

[malfoy_G_PIR]

It's as easy as that.
Hope you find this useful.

-Arcane.cfg

Well is not bad ,and for the start -this is the right way to identify if you have malware on your computer.But .... there is a but - first of all -task manager don't show you all the process that are run,and some rat could dissalow this feature -i would add -to use the diagnostic program like process hacker and some program in the link below :
http://technet.microsoft.com/en-us/sysin...s/bb469930,
second - for you example i don't even watch what connection is establish since i see 127.0.0.1 as ip(127.0...1 is a home connection) - be carefull to explain that it could be a process running like you have the dropbox or like i have ,the kaspersky automatic update.If you kill a process that you see conection established may be some automatic update of av,sandboxies ,teamviewer connection thru internet - whit bad results.Is good for you to make a copy of the process every time when you install a new program and compare sometimes with the actual process running. You forgot to say that a malware running thru the feature printer and fax device sharing in internet -as countermeasure is to disallow this process going to lan icon -right click whith mouse -open network and sharing center -change adapter settings -go to your lan or wifi card -properties -and make sure to disallow the File and Printer Sharing for Microsoft Networks - in the middle box,and also the telnet .But , like i say is a good start for those how don't know how to identify a malware.

your link which u posted is not working, url not found.

---

That tut is so usefull thanks.

[Erion]

Never thought about this method and i'v fought with this crap most of my computer life, Nice and simple, much appreciated

[eRoHsIk dInG]

thanks pal....

[salchichon]

Very nice tutorial, well explained, thanks.

[Jony Som]

Very clear, well explained and simple to use.
Happy to see that there are tutorials explaining how to protect own computer better.
Thanks alot.

[nadja2011]

Ty nice for sysadmins..

[eliesoriun]

Is it common for RATs to use 80 and 443 ports?