Manage special ports on the local machine-prevent Trojan attacks

A Trojan is a malicious remote control software. A Trojan is generally divided into a client and a server. A client is the console of various commands used locally, the server is running for others. Only computers running on the server can be fully controlled.

Currently, the most common Trojan Horse is based on the TCP/UDP protocol for communication between the client and the server. Since the two protocols are used, it is inevitable to open the listening port on the server (that is, the host where the trojan is planted) to wait for the connection. for example, the monitoring port used by the famous glaciers is 7626, And the Back Orifice 2000 is 54320. then, we can check whether a trojan or other hacker program has been planted by checking the port opened on the local machine. the following describes the methods in detail.

Netstat commands provided by Windows

Netstat displays protocol statistics and the current TCP/IP network connection. This command can be used only after the TCP/IP protocol is installed.

Netstat [-A] [-E] [-N] [-S] [-P Protocol] [-R] [interval]

Parameters

-A: All connections and listening ports are displayed. server connections are usually not displayed.

-E displays Ethernet statistics. This parameter can be used with the-s option.

-N: the address and port number are displayed in numeric format (instead of trying to find the name ).

-S displays statistics of each protocol. By default, statistics of TCP, UDP, ICMP, and IP are displayed.-P options can be used to specify the default subset.

-P protocol: displays the connection of the Protocol specified by protocol. Protocol can be TCP or UDP. if you use the-s option together to display statistics for each protocol, the protocol can be TCP, UDP, ICMP, or IP.

-R displays the content of the route table.

Interval re-displays the selected statistics. interval seconds are paused between each display. Press Ctrl + B to stop re-displaying statistics. If this parameter is omitted, netstat prints the current configuration information once.

Now we know how to use the netstat command. Let's learn how to use it now. Use this command to check the port opened on your machine. go to the command line and use the parameters a and N of the netstat command:

C: netstat-a-n

Active connections

PROTO local address foreign address State

TCP 0.0.0.0: 80 0.0.0.0: 0 listening

TCP 0.0.0.0: 21 0.0.0.0: 0 listening

TCP 0.0.0.0: 7626 0.0.0.0: 0 listening

UDP 0.0.0.0: 445 0.0.0.0: 0

UDP 0.0.0.0: 1046 0.0.0.0: 0

UDP 0.0.0.0: 1047 0.0.0.0: 0

To explain, active connections refers to the active connection of the current local machine, and proto refers to the protocol name used for the connection. Local address is the IP address of the Local Computer and the port number being used for the connection, foreign address is the IP address and port number of the remote computer connected to this port, and the State indicates the TCP connection status. You can see that the listening ports of the next three rows are UDP, so there is no State. from the above, we can see that port 7626 of the machine is open and listening is waiting for connection. In this case, it is very likely that the machine has been infected with glaciers! Therefore, we should quickly disconnect the network and Use anti-virus software to scan for viruses.