One way is to monitor network activity and to sniff the traffic between your PC and the Internet, using an external, known-good machine. Another option is to boot the PC from known-good (preferably read-only) media (e.g. Live CD or DVD) and do forensic analysis of the machine. A darknet is also a good way. It is essentially a subnet on your LAN that shouldn't normally have traffic routed to it, with logging machines in it, which detect which machines aren't obeying your normal network setup. Since you should know what behaviour is normal and what isn't, you will find infected machines trying to infect others. If your PC connects often to an unknown server connecting regulary to it, you can be sure that you are under control.

I good link on the topic - http://www.welivesecurity.com/2010/04/21/top-10-signs-your-computer-may-be-part-of-a-botnet/

What about if we use packet sniffing from external machine?

This external machine should be allocated at the same network segment as your PC

In a network using a hub you will be able to see all the traffic being send to every machine connected to the hub, in a switched network - only traffic to and from your PC

Thanks a lot ... Apart 0from winshark can suggest some effective monitoring tools?

Dhiman, do you mean Wireshark? We have a lot tools like Ettercap, EtherApe, Etheral, inSSIDer, Paessler's PRTG...

yeah sorry for the mistake and thankx a lot Natalia and wish u happy and prosperous 2014

Thank you, Dhiman, and all the best on 2014 to you!

First, you can't trust a compromised computer as the output of all utilities could be faked to hide the presence of malicious activities.

I would generally not expect any computer with robust security practices to be part of a bot net. One where you only install code from trusted sources, have strong passwords (that aren't used elsewhere), etc. Unless my ISP says they've received reports of unusual activity from my IP address indicating a potential bot, or a user tells me they were tricked into installing software that didn't do as advertised and they now realize was likely a trojan.

In those cases, I would start testing for signs of a potential bot:

monitor network activity. Run netstat -- do all connections more or less make sense? (ignore local connections; run whois on foreign IPs I don't recognize). Remember netstat's output could be faked, so you also run wireshark (network analyzer) from another computer (presumed safe) on my local network, and check to see if there's any unusual traffic to/from strange non-local IP addresses (that's not routine stuff from my router/network printer, etc)?

Boot into a live cd of the same distribution (so you trust the utilities), and run checksums (md5) on important utilities (/bin, /sbin/, /usr/bin/, etc.) and compare to known checksums of a safe computer with the same OS / version (or make a fresh install and run all updates and then generate checksums to compare with). (If the checksums don't match, it could possibly be due to an update of the utility; so check versions and investigate further). I've assumed linux/unix system for this answer, but presumably you could do the same for windows if you know what to check.

If you find evidence of a bot, I'd back up my data (that is non-executables), wipe the hard disk clean, and re-install the OS from a safe source with different passwords. I'd be very wary opening up documents that could contain macros (e.g., doc, pdfs) from the compromised computer (making sure to disable macros in the relevant programs before looking at these files again, not being logged in as administrator/root, and installing a virus scanner).

A joint or collaborative behavior determination may lead to some signs of group activity under same Botnet Master.

Or P2P kind of Botnets can have commands issued to Zombies from peers in network.

Are you working on system side detections or Network behaviour side?

It is possible to detect the bots by monitoring the TCP connections and their status from TCP Table Database. If the multiple passive connections (only crating connections) are crossing a particular value, it is possible to control the further connections. One can write a small program using functions available in MSDN or any other platform and keep a particular threshold value to detect the passive connections and analyze them whether it is true or false alram.

If your computer is taken over by botnet usually it slows down significantly and even the simplest task can become a pain to do. However, some computers based on the memory, hard drive space and network connectivity speed may not show any obvious slowdown signs initially. So checking network activity is a good way to determine for sure.

In addition to monitoring network activity and checking if port 25 is actively listening, run a malware scanner. I personally use the free version of Spybot, which is very good. http://www.safer-networking.org/private/

Spybot most times, will save you from having to scrub your hard drive and reload your machine if you find that it is infected. Also run a bot scanner (see 1st link for suggestions).

Here is a link that will give you helpful and straightforward details of how to tell if your computer is taken over by botnets and what you need to do and why:

http://www.ehow.com/how_8411036_tell-computer-taken-over-botnet.html

This is another link that may give you some additional info on other software you might consider using (but skip over the sponsored links and advertisements and scroll down to the information): http://askville.amazon.com/infected-Botnet/AnswerViewer.do?requestId=1355539

If you are in the same local area network (where you can reach computers without passing through gateways) you can tell to every machine that you are the default gateway (using arp protocol) so, in a transparent way, all communications will pass through your computer. This is a known attack implemented in some networking software (ettercap is one of these).

Some excellent work has been done on using data science to find anomalies in network flows.

"Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces" by Roberto Perdisci e.a.

http://static.usenix.org/event/nsdi10/tech/full_papers/perdisci.pdf

and

"Mining the Network Behavior of Bots", Cavallao e.a.,

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.153.6917&rep=rep1&type=pdf

This is more aimed at ISPs or large corporate networks.

/Mark

one of the good solutions is to conduct behavioural analysis to looks for any evidence of botnet activities. the most important part is where to look and what to look for, which is highly depends on the type of botnet and the way that bots communicate.