by Global

Created on: October 14, 2008

Before removal you must be familiar with your OS.Know behaviour of your os while its still clean.For example you must know on what ports your computer is listening and what is listening on those ports.I preffer to use built in windows tools and commands so this article will focus on those tools.

When you install windows and all your trusted software and drivers,open command prompt (start ->run ->cmd) and type netstat.It will give you usage info.what i use mostly is "netstat -ano".

Also,at this point press ctrl + alt + del to bring task mgr up.This will list all processes currently running.Remember them well.

Better replacement for this is process explorer available for free from sysinternals.com.

Later on if you start expiriencing problems like strange connections requests ie. you have one Internet explorer open(or none at all) and netstat shows multiple connections it may and may not represent trojan activity.It could just be updater of some program.

A bit about trojans.They are programs consisting of client and a server.You will have server on your computer and person who instaled it will connect with client.Server is so configured so it starts with windows and this is how you will find it.

It will be somewhere in startup registry keys like "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run".You have same key under HKEY_CURRENT_USER and HKEY_USERS but it will most probaly install under first one to start with every user account.You can access those keys by running regedit.exe.

Now that you know what processes were running on default install,it should be easier to catch newer thet you dont remember installing.Run netstat again with above options and find what is listening or connecting.

Then by the PID you can identify process you suspect is trojan.Then again open cmd.exe and type "tasklist /svc" and find process with pid obtained from netstat.Kill that process with "tskill PID".When you've done that find its .exe file and delete it.

Go to regedit again and search for that file in the registry and delete all occurences.

Reboot.:)

Should be ok now but do this ONLY when you are certain you have trojan.Google for trojan info and behavior.Most AV and AS software is scanning for trojans so you might(should) use those.I found "happy" combination of those tools that works nicely on my system but you should do some testing and see what works for you.

hth

Learn more about this author, Global.
Click here to send this author comments or questions.