(05-14-2013, 08:44 PM)noize Wrote: This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.

Some backdoors use browsers to connect back, and if it is your case, this code should find about it.

Code:

@echo off title Are You Backd00red? by Noize setlocal enabledelayedexpansion echo Backdoor Finder echo Coded by Noize at hackcommunity.com echo. echo Areyoubackdoored will check if any of your browsers are running. echo Some backdoor programs use browsers to connect back. echo You should close all browsers (don't kill the processes, though, just close the echo windows) before you start, or else you would for sure find them running. echo. < nul set /p var=Press any key to start... pause > nul echo. for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do ( cls echo Please, wait... echo Now looking for ID %%a... for %%A in (chrome iexplore firefox opera safari tor) do ( for /f %%b in ('tasklist ^| find "%%a"') do ( for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j ) ) ) cls if not defined check goto nobackdoors echo Done. echo Your computer is probably backdoored: echo process %check%looked open while it should have been killed. echo. < nul set /p var=Press any key to quit... pause > nul exit /b :nobackdoors echo Done. echo No backdoors are using browsers on current computer. echo. < nul set /p var=Press any key to quit... pause > nul

(05-14-2013, 08:44 PM)noize Wrote: This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.

Some backdoors use browsers to connect back, and if it is your case, this code should find about it.

Code:

@echo off title Are You Backd00red? by Noize setlocal enabledelayedexpansion echo Backdoor Finder echo Coded by Noize at hackcommunity.com echo. echo Areyoubackdoored will check if any of your browsers are running. echo Some backdoor programs use browsers to connect back. echo You should close all browsers (don't kill the processes, though, just close the echo windows) before you start, or else you would for sure find them running. echo. < nul set /p var=Press any key to start... pause > nul echo. for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do ( cls echo Please, wait... echo Now looking for ID %%a... for %%A in (chrome iexplore firefox opera safari tor) do ( for /f %%b in ('tasklist ^| find "%%a"') do ( for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j ) ) ) cls if not defined check goto nobackdoors echo Done. echo Your computer is probably backdoored: echo process %check%looked open while it should have been killed. echo. < nul set /p var=Press any key to quit... pause > nul exit /b :nobackdoors echo Done. echo No backdoors are using browsers on current computer. echo. < nul set /p var=Press any key to quit... pause > nul

(05-14-2013, 08:44 PM)noize Wrote: This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.

Some backdoors use browsers to connect back, and if it is your case, this code should find about it.

Code:

@echo off title Are You Backd00red? by Noize setlocal enabledelayedexpansion echo Backdoor Finder echo Coded by Noize at hackcommunity.com echo. echo Areyoubackdoored will check if any of your browsers are running. echo Some backdoor programs use browsers to connect back. echo You should close all browsers (don't kill the processes, though, just close the echo windows) before you start, or else you would for sure find them running. echo. < nul set /p var=Press any key to start... pause > nul echo. for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do ( cls echo Please, wait... echo Now looking for ID %%a... for %%A in (chrome iexplore firefox opera safari tor) do ( for /f %%b in ('tasklist ^| find "%%a"') do ( for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j ) ) ) cls if not defined check goto nobackdoors echo Done. echo Your computer is probably backdoored: echo process %check%looked open while it should have been killed. echo. < nul set /p var=Press any key to quit... pause > nul exit /b :nobackdoors echo Done. echo No backdoors are using browsers on current computer. echo. < nul set /p var=Press any key to quit... pause > nul

(05-14-2013, 09:47 PM)Linuxephus™ Wrote:

(05-14-2013, 08:44 PM)noize Wrote: This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.

Some backdoors use browsers to connect back, and if it is your case, this code should find about it.

Code:

@echo off title Are You Backd00red? by Noize setlocal enabledelayedexpansion echo Backdoor Finder echo Coded by Noize at hackcommunity.com echo. echo Areyoubackdoored will check if any of your browsers are running. echo Some backdoor programs use browsers to connect back. echo You should close all browsers (don't kill the processes, though, just close the echo windows) before you start, or else you would for sure find them running. echo. < nul set /p var=Press any key to start... pause > nul echo. for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do ( cls echo Please, wait... echo Now looking for ID %%a... for %%A in (chrome iexplore firefox opera safari tor) do ( for /f %%b in ('tasklist ^| find "%%a"') do ( for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j ) ) ) cls if not defined check goto nobackdoors echo Done. echo Your computer is probably backdoored: echo process %check%looked open while it should have been killed. echo. < nul set /p var=Press any key to quit... pause > nul exit /b :nobackdoors echo Done. echo No backdoors are using browsers on current computer. echo. < nul set /p var=Press any key to quit... pause > nul

Funny you should mention that as I just Trashed a thread with a file that was backdoored and then Revoked a User who wouldn't exactly have been thought as having uploaded something like that.

(05-14-2013, 09:47 PM)Linuxephus™ Wrote:

(05-14-2013, 08:44 PM)noize Wrote: This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.

Some backdoors use browsers to connect back, and if it is your case, this code should find about it.

Code:

@echo off title Are You Backd00red? by Noize setlocal enabledelayedexpansion echo Backdoor Finder echo Coded by Noize at hackcommunity.com echo. echo Areyoubackdoored will check if any of your browsers are running. echo Some backdoor programs use browsers to connect back. echo You should close all browsers (don't kill the processes, though, just close the echo windows) before you start, or else you would for sure find them running. echo. < nul set /p var=Press any key to start... pause > nul echo. for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do ( cls echo Please, wait... echo Now looking for ID %%a... for %%A in (chrome iexplore firefox opera safari tor) do ( for /f %%b in ('tasklist ^| find "%%a"') do ( for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j ) ) ) cls if not defined check goto nobackdoors echo Done. echo Your computer is probably backdoored: echo process %check%looked open while it should have been killed. echo. < nul set /p var=Press any key to quit... pause > nul exit /b :nobackdoors echo Done. echo No backdoors are using browsers on current computer. echo. < nul set /p var=Press any key to quit... pause > nul

Funny you should mention that as I just Trashed a thread with a file that was backdoored and then Revoked a User who wouldn't exactly have been thought as having uploaded something like that.

(05-14-2013, 09:47 PM)Linuxephus™ Wrote:

(05-14-2013, 08:44 PM)noize Wrote: This is a simple snippet of code to check whether (supposing you closed all browsers) a browser process results running.

Some backdoors use browsers to connect back, and if it is your case, this code should find about it.

Code:

@echo off title Are You Backd00red? by Noize setlocal enabledelayedexpansion echo Backdoor Finder echo Coded by Noize at hackcommunity.com echo. echo Areyoubackdoored will check if any of your browsers are running. echo Some backdoor programs use browsers to connect back. echo You should close all browsers (don't kill the processes, though, just close the echo windows) before you start, or else you would for sure find them running. echo. < nul set /p var=Press any key to start... pause > nul echo. for /f "tokens=5" %%a in ('netstat -ano ^| find /i "established"') do ( cls echo Please, wait... echo Now looking for ID %%a... for %%A in (chrome iexplore firefox opera safari tor) do ( for /f %%b in ('tasklist ^| find "%%a"') do ( for /f "delims=" %%j in ('echo %%b ^| find /i "%%A.exe"') do set check=%%j ) ) ) cls if not defined check goto nobackdoors echo Done. echo Your computer is probably backdoored: echo process %check%looked open while it should have been killed. echo. < nul set /p var=Press any key to quit... pause > nul exit /b :nobackdoors echo Done. echo No backdoors are using browsers on current computer. echo. < nul set /p var=Press any key to quit... pause > nul

Funny you should mention that as I just Trashed a thread with a file that was backdoored and then Revoked a User who wouldn't exactly have been thought as having uploaded something like that.

(05-14-2013, 10:47 PM)noize Wrote: Huh? I'm sorry, who posted what?