Explain the complications created by node.js server-side javascript virus.

430    Asked by AnishaDalal in Cyber Security , Asked on Apr 6, 2022

I've noticed in my task manager, an unclosable instance of server side Node.js running on my HP Laptop (running windows 10), after a little digging around I was wondering if it means I'm now unwillingly taking part in a botnet, and if so, if I can I trace the server it's coming from?

Regarding the node.js server-side javascript virus -

If you do have a process that starts automatically and that cannot be properly traced to a binary you installed or configured I would suspect malware alright. Just note that a complex OS like Windows 10 does have several ways of building a service, the most common way should be the Startup directory (which has its own tab in the task manager). Nevertheless, you should install Wireshark (or similar) and monitor the traffic of the machine in question. Although competent malware (e.g. rootkits) can hide itself from monitoring made on the same machine, your malware does not appear to be very good at hiding anyway.

(By monitoring traffic on an intermediate machine, e.g. a machine acting as router, you can even find traffic generated by well hidden malware.) Monitoring the traffic you can show to what your machine is talking and (often) what is the content of the communication. Yet that does not really provide a solution to the problem of having malware (for that see: Help! My home PC has been infected by a virus! What do I do now?) Extra note: I'll repeat again, check first all the system services. Notable the Startup tab. Installers of a good deal of software today do install a Node instance, and make it run on startup.



Your Answer

Interviews

Parent Categories