How to detect a Trojan with DOS

Trojans, by their nature, are inserted onto your PC by various means. Lately some advertisers have been targeted. Some of their ads contain malicious code that allows a Trojan onto your computer from legitimate sites. Once on your PC, the Trojan opens connections to the internet to allow other programs to connect to your computer.

Using some simple DOS commands ( YES DOS still lives on Windows computers ), you can see if there might be a Trojan running on your computer.

Things You'll Need

• Windows PC
• Command Prompt (DOS BOX)

Instructions

1. 

   Open a command prompt ( dos window ), by selecting

   START >> RUN

2. 

   type in the letters CMD and press OK

3. 

   type in netstat -a and press enter to show you all connections to your PC

4. 

   you should see a list of all connection your PC is making, locally as well as remotely.

5. 

   This image shows some typical connections that your PC may display when running netstat -a

6. 

   type in netstat -ab and press enter, this will show you what programs are making the connections

7. 

   you may have to wait several minutes for all the connections to display and you might be amazed at what you see.

8. 

   some connections you see will be obvious, iexplorer.exe is Internet Explorer, and you can see that it's making connections.

   if you see iexplorer.exe and you don't have Internet Explorer open, then you probably have a Trojan.

9. if you see a program making any UDP OR TCP request to remote destinations, you can search google or yahoo to determine what the program is, and how to remove.

Tips & Warnings

• This works on Windows 2000, Windows XP and Vista.

• Skip steps 1 & 2 for vista and just type in cmd in the start menu box.

• To make sure this check is accurate, you should do this right after the PC has started, without opening any browser windows.

• to refresh, press the up arrow and enter.

• although all network connections will show in this window, check the results before assuming the worst.