Hi Russ,
First thing to do is to ask for more info from the ISP.
Then do a connection scan and a port scan.
Some tools:
Current Ports http://www.nirsoft.net/utils/cports.html
In the same vein
Connection Watcher http://www.moo0.com/?top=http://www.moo0.com/software/ConnectionWatcher/
If in fact the computer is used as a bot, you may see lots of connections to unknown destinations.
Watch for connections using UDP
Close all programs that connect to the internet, like browsers ,chat programs etc.
You should only see you're your connection to the ISP.
Traffic should be quite light - IOW ,not a lot of data is being transferred.
If a legitimate program does an update check while doing your port check, it will clearly show the name of the program.
Anything else might be suspect.
The right-click menu (on a connection) will give you several options ,including disconnect or kill the process.
In addition run another AV scan before or after the port check.
Also check for root kits. Several AV programs do this, but you could still try
Rootkit Revealer http://technet.microsoft.com/en-us/sysinternals/bb897445 but as stated ,it's somewhat surpassed
by the inclusion of rootkit scanners in most AV- or anti-malware programs.
Only as a last resort would I do a complete wipe and re-install (obviously after saving valuable personal data)
But that's up to you.
Peter E.
--------------------------------------------------
From: "Russ Cox"
Sent: Monday, 05 September, 2011 2:38 PM
To: <[log in to unmask]>
Subject: [PCSOFT] bots
How do you know if your computer has been taken over as a bot? My friend
was told by her ISP that she was a bot. I scanned the computer with
Malwarebytes, Microsoft Security Essentials, and Spybot. One trojan and
one virus were removed, but she's still told she is a bot. How can you
tell if that's true? Next step is to scrub her HDD and reinstall everything.
PSOFT maintains hundreds of useful files for download
visit our download web page at:
http://freepctech.com/index.php/downloads
|
