IRC Bot Detector

2008 Oct 12


Have following as a *.bat file on windows (F:\Security&Forensics\doc\IRC\ircbot_det.bat):
@echo off
@echo The commands this batch file executes will check for the
@echo presence of IRC Bots.  Each test will let you know how to
@echo whether or not your system passed the test.
 
@echo Make sure any valid IRC program is closed down before
@echo you run this or you might get a false positive.  (If you
@echo don't know what IRC is, chances are you don't have to
@echo worry about closing down any programs.)
pause
 
@echo Test #1:
@echo on
netstat -an | find ":6667"
@echo off
@echo Test #1 complete.  If there is no line between this and the
@echo command above, your system passed the test.
pause
 
@echo Test #2:
@echo on
netstat -an | find ":113 "
@echo off
@echo Test #2 complete.  If there is no line between this and the
@echo command above, your system passed the test.
pause
 
@echo Test #3:
@echo off
c:
cd c:\
@echo on
dir rundil.exe /s
@echo off
@echo Test #3 complete.  If "File Not Found" is displayed your
@echo system passed the test.
 
@echo Tests Completed.
pause

2005-2008