Intruder Detected

[Guest]

Hello

Perhaps some may think I ask dumb questions, but I do not think any
question is dumb. I detected an intruder on my computer. I contacted
Microsoft Security and they confirmed that it appeared to be so, however I
was merely told that someone very smart had gotten into my computer and they
offered no suggestions as to how to get this person out. I tried to the best
of my ability to rid this person from my system. However I am a 'home user'
and this was my first experience with a security breach. I use my computer
for access to my college classes. I have had no formal training in this area.
I relied on information I found searching the net. I do believe this person
introduced a virus into my computer to render it vunerable and then dropped
in a root kit, Christmas came early this year
Good thing for backup because
I had to format my hard drive and write a new MBR. I wiped my hard drive by
writing zeroes to it but, now that I have re-istalled my OS, something is
just not right. I cannot tell you exactly what, but common sense is telling
me further investigation is needed. ( I was utilizing Windows XP Home when
this breach occurred, but I replaced this OS with Windows XP Professional) I
am getting "Failures" in my Security Audits, those weird hard to understand
Events.
I want to know if my BIOS could have been tampered with, or could
my memory contain remnants of this persons intrusion or even still could this
person have manipulated other hardware in my computer that would be
unaffected by a format
If this is so, how can I remedy this to assure I have
wiped this person totally out of my system
I may sound paranoid, but I think
a little paranoia can be a good thing, over confidence sure seems impractical
where internet security is concerned.

Thank You
Ann

 

[Peter]

Get yourself a good firewall and anti-virus, plus install Adaware SE/
CWShredder/Spybit Search & destroy and SpywareBlaster.
Boot from your OS CD with Internet disconnected and reinstall Windows using
the long format method.

 

[Peter]

corr: for Spybit read Spybot...oops

 

[Dave]

ok, a few questions....
1. how did you 'detect an intruder'. specifics, not just 'something
happened'.
2. how in the world did you contact 'microsoft security'... what office, who
did you talk to, and how did they confirm that you had an intruder? and why
couldn't they tell you the one and only real way to instantly stop the
intrusion??? somehow i don't think you really got to microsoft security.
3. no formal training and yet you detected an intruder that ms security
couldn't get rid of???
4. a virus that made you vulnerable after the intruder was in??? this makes
no sense, if the intruder is in why add a virus to the mix, they can do
anything they want already... this doesn't make sense. the rootkit would
come first, but if they were 'in' already why bother with that?
5. security audit failures usually have simple explanations, try asking
specifics on them... obviously you need to attend classes more.
6. common sense? bios tampering?? memory containing remnants??? none of
them are likely, and memory remnants are impossible once you turn the
machine off.
7. paranoia, now there is a real possibility!

 

[Shenan Stanley]

Perhaps some may think I ask dumb questions, but I do not think any
question is dumb. I detected an intruder on my computer. I contacted
Microsoft Security and they confirmed that it appeared to be so,
however I was merely told that someone very smart had gotten into my
computer and they offered no suggestions as to how to get this person
out. I tried to the best of my ability to rid this person from my
system. However I am a 'home user' and this was my first experience
with a security breach. I use my computer for access to my college
classes. I have had no formal training in this area. I relied on
information I found searching the net. I do believe this person
introduced a virus into my computer to render it vunerable and then
dropped in a root kit, Christmas came early this year!
Good thing for backup because
I had to format my hard drive and write a new MBR. I wiped my hard
drive by writing zeroes to it but, now that I have re-istalled my OS,
something is just not right. I cannot tell you exactly what, but
common sense is telling me further investigation is needed. ( I was
utilizing Windows XP Home when this breach occurred, but I replaced
this OS with Windows XP Professional) I am getting "Failures" in my
Security Audits, those weird hard to understand Events.
I want to know if my BIOS could have been tampered with, or could
my memory contain remnants of this persons intrusion or even still
could this person have manipulated other hardware in my computer that
would be unaffected by a format?
If this is so, how can I remedy this to assure I have
wiped this person totally out of my system?
I may sound paranoid, but I think
a little paranoia can be a good thing, over confidence sure seems
impractical where internet security is concerned.

*WARNING* This is a LONG spill, all in plain text and simplified so that
even non-techs should be able to understand it. Hopefully this will
assist some people in not only repairing their systems, but in making
them faster and more stable tools for them to use. It contains advice
on many things, many considered "common knowledge" to 'IT' people
everywhere. It is split into major sections, hopefully this will make
it easier to navigate. *WARNING*

Suggestions on what you can do to secure/clean your PC. Every attempt
has been made to be general and an assumption of a "Windows" operating
system is made here as well - although in some ways, this could be
adapted to any OS.


GENERAL UPKEEP AND CLEANUP
--------------------------

You should periodically defragment your hard drives as well as check them
for errors. Only defragment after you have cleaned up your machine of
outside parasites and never defragment as a solution to a quirkiness in
your system. It may help speed up your system, but it should be clean
before you do this one.

How to Defragment your hard drives
http://support.microsoft.com/?kbid=314848

How to scan your disks for errors
http://support.microsoft.com/?kbid=315265

How to use Disk Cleanup
http://support.microsoft.com/?kbid=310312

You should also empty your Internet Explorer Temporary Internet
Files and make sure the maximum size for this is small enough not to cause
trouble in the future. Empty your Temporary Internet Files and shrink the
size it stores to a size between 10MB and 360MB..

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section, do the
following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the "Amount of disk space to use:" to
something between 10MB and 360MB. (Betting it is MUCH larger right
now.)
- Click OK.
- Click on "Delete Files" and select to "Delete all offline contents"
(the checkbox) and click OK. (If you had a LOT, this could take 2-10
minutes or more.)
- Once it is done, click OK, close Internet Explorer, re-open Internet
Explorer.

Uninstall any software you no longer use or cannot remember installing
(ask if it is a multi-user PC) - but only if you are sure you do not
need it and/or you have the installation media around to reinstall if
you need to. http://snipurl.com/8v6b may help you accomplish this.

If things are running a bit slow or you have an older system
(1.5GHz or less and 256MB RAM or less) then you may want to look into
tweaking the performance a bit by turning off some of the memory
using Windows XP "prettifications". The fastest method is:

Control Panel --> System --> Advanced tab --> Performance section,
Settings button. Then choose "adjust for best performance" and you
now have a Windows 2000/98 look which turned off many of the annoying
"prettifications" in one swift action. You can play with the last
three checkboxes to get more of an XP look without many of the
other annoyances. You could also grab and install/mess with one
(or more) of the Microsoft Powertoys - TweakUI in particular:

http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx

You should also verify that your System Restore feature is enabled and
working properly. Unfortunately, if seems to have issues on occasion,
ones that can easily be avoided by turning off/on the system restore and
make a manual restoration point as one of your periodic maintenance tasks.
This is particularly important right before installing something major
(or even minor if you are unsure what it might do to your system.)
(This, of course, will erase any previous restore point you have.)

Turn off System Restore.
http://support.microsoft.com/?kbid=310405

Reboot.

Turn on System Restore.
http://support.microsoft.com/?kbid=310405

Make a Manual Restoration Point.
http://snipurl.com/68nx

Also, you should look into backing up your valuable files and folders.
http://support.microsoft.com/?kbid=308422

And keep your original installation media (CDs, disks) safe with their
CD keys and such. Make backups of these installation media sets as
well and always use strong passwords. Good passwords are those that
meet these general rules (mileage may vary):

Passwords should contain at least six characters, and the character
string should contain at least three of these four character types:
- uppercase letters
- lowercase letters
- numerals
- nonalphanumeric characters (e.g., *, %, &, !)

Passwords should not contain your name/logon name.


UPDATES and PATCHES
-------------------

** Side Note: *IF* you are about to install Service Pack 2 (SP2) for
Windows XP, I suggest you clean up your system first. Uninstall any
applications you do not use. Update any that you do. Download the
latest drivers for your hardware devices. Defragment and run a full
CHKDSK on your hard drives. Scan your system and clean it of any
Spyware/Adware/Malware and for Viruses and Trojans. Below you will
find advice and links to applications that will help you do all of
this. If this advice helps you, please - pass it on. Print it,
email it, forward it to anyone you think it might help. A little
knowledge might help prevent lots of trouble.

This one is the most obvious. There is no perfect product and any company
worth their salt will try to meet/exceed the needs of their customers and
fix any problems they find along the way. I am not going to say Microsoft
is the best company in the world about this but they do have an option
available for you to use to keep your machine updated and patched from
the problems and vulnerabilities (as well as product improvements in some
cases) - and it's free to you.

Windows Update
http://windowsupdate.microsoft.com/

Go there and scan your machine for updates. Always get the critical ones as
you see them. Write down the KB###### or Q###### you see when
selecting the updates and if you have trouble over the next few days,
go into your control panel (Add/Remove Programs), match up the latest
numbers you downloaded recently (since you started noticing an issue) and
uninstall them. If there was more than one (usually is), install them back
one by one - with a few hours of use in between, to see if the problem
returns. Yes - the process is not perfect (updating) and can cause trouble
like I mentioned - but as you can see, the solution isn't that bad - and is
MUCH better than the alternatives.

Windows is not the only product you likely have on your PC. The
manufacturers of the other products usually have updates as well. New
versions of almost everything come out all the time - some are free, some
are pay - some you can only download if you are registered - but it is best
to check. Just go to their web pages and look under their support and
download sections. For example, for Microsoft Office update, you should
visit:

Microsoft Office Updates
http://office.microsoft.com/
(and select "downloads")

You also have hardware on your machine that requires drivers to interface
with the operating system. You have a video card that allows you to see on
your screen, a sound card that allows you to hear your PCs sound output and
so on. Visit those manufacturer web sites for the latest downloadable
drivers for your hardware/operating system. Always (IMO) get the
manufacturers hardware driver over any Microsoft offers. On the Windows
Update site I mentioned earlier, I suggest NOT getting their hardware
drivers - no matter how tempting. First - how do you know what hardware
you have in your computer? Invoice or if it is up and working now - take
inventory:

Belarc Advisor
http://belarc.com/free_download.html

Once you know what you have, what next? Go get the latest driver for your
hardware/OS from the manufacturer's web page. For example, let's say you
have an NVidia chipset video card or ATI video card, perhaps a Creative
Labs sound card or C-Media chipset sound card...

NVidia Video Card Drivers
http://www.nvidia.com/content/drivers/drivers.asp

ATI Video Card Drivers
http://www.atitech.com/support/driver.html

Creative Labs Sound Device
http://us.creative.com/support/downloads/

C-Media Sound Device
http://www.cmedia.com.tw/e_download_01.htm

As for Service Pack 2 (SP2) for Windows XP, Microsoft has made this
particular patch available in a number of ways. First, there is the
Windows Update web page above. Then there is a direct download site
and finally, you can order the FREE CD from Microsoft.

Direct Download of Service Pack 2 (SP2) for Windows XP
http://snipurl.com/8bqy

Order the Free Windows XP SP2 CD
http://snipurl.com/8umo

Microsoft also have a bunch of suggestions, some similar to these,
on how to better protect your Windows system:

Protect your PC
http://www.microsoft.com/security/protect/


FIREWALL
--------

Let's say you are up-to-date on the OS (operating system) and you have
Windows XP.. You should at least turn on the built in firewall. That will
do a lot to "hide" you from the random bad things flying around the
Internet. Things like Sasser/Blaster enjoy just sitting out there in
Cyberspace looking for an unprotected Windows Operating System and jumping
on it, doing great damage in the process and then using that Unprotected OS
to continue its dirty work of infecting others. If you have the Windows XP
FW turned on - default configuration - then they cannot see you! Think of
it as Internet Stealth Mode at this point. It has other advantages, like
actually locking the doors you didn't even (likely) know you had. Doing
this is simple, some helpful tips for the SP2 enabled firewall can be found
here:

http://www.microsoft.com/technet/community/columns/cableguy/cg0204.mspx

If you read through that and look through the pages that are linked from it
throughout - I think you should have a firm grasp on the basics of the
Windows XP Firewall as it is today. One thing to note RIGHT NOW - if you
have AOL, you cannot use this nice firewall that came with your system.
Thank AOL, not Microsoft. You HAVE to configure another one.. So we
continue with our session on Firewalls...

But let's say you DON'T have Windows XP - you have some other OS like
Windows 95, 98, 98SE, ME, NT, 2000. Well, you don't have the nifty built in
firewall. My suggestion - upgrade. My next suggestion - look through your
options. There are lots of free and pay firewalls out there for home users.
Yes - you will have to decide on your own which to get. Yes, you will have
to learn (oh no!) to use these firewalls and configure them so they don't
interfere with what you want to do while continuing to provide the security
you desire. It's just like anything else you want to protect - you have to
do something to protect it. Here are some suggested applications. A lot of
people tout "ZoneAlarm" as being the best alternative to just using the
Windows XP FW, but truthfully - any of these alternatives are much better
than the Windows XP FW at what they do - because that is ALL they do.

ZoneAlarm (Free and up)
http://snipurl.com/6ohg

Kerio Personal Firewall (KPF) (Free and up)
http://www.kerio.com/kpf_download.html

Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/download/

Sygate Personal Firewall (Free and up)
http://smb.sygate.com/buy/download_buy.htm

Symantec's Norton Personal Firewall (~$25 and up)
http://www.symantec.com/sabu/nis/npf/

BlackICE PC Protection ($39.95 and up)
http://blackice.iss.net/

Tiny Personal Firewall (~$49.00 and up)
http://www.tinysoftware.com/

That list is not complete, but they are good firewall options, every one of
them. Visit the web pages, read up, ask around if you like - make a
decision and go with some firewall, any firewall. Also, maintain it.
Sometimes new holes are discovered in even the best of these products and
patches are released from the company to remedy this problem. However, if
you don't get the patches (check the manufacturer web page on occasion),
then you may never know you have the problem and/or are being used through
this weakness. Also, don't stack these things. Running more than one
firewall will not make you safer - it would likely (in fact) negate some
protection you gleamed from one or the other firewalls you run.


ANTIVIRUS SOFTWARE
------------------

That's not all. That's one facet of a secure PC, but firewalls don't do
everything. I saw one person posting on a newsgroup that "they had
never had a virus and they never run any anti-virus software." Yep - I used
to believe that way too - viruses were something everyone else seemed to
get, were they just careless? And for the average joe-user who is careful,
uses their one to three family computers carefully, never opening unknown
email attachments, always visiting the same family safe web sites, never
installing anything that did not come with their computer - maybe, just
maybe they will never witness a virus. I, however, am a Network Systems
Administrator. I see that AntiVirus software is an absolute necessity given
how most people see their computer as a toy/tool and not something
they should have to maintain and upkeep. After all, they were invented to
make life easier, right - not add another task to your day. You
can be as careful as you want - will the next person be as careful? Will
someone send you unknowingly the email that erases all the pictures of your
child/childhood? Possibly - why take the chance? ALWAYS RUN ANTIVIRUS
SOFTWARE and KEEP IT UP TO DATE! Antivirus software comes in so many
flavors, it's like walking into a Jelly Belly store - which one tastes like
what?! Well, here are a few choices for you. Some of these are free (isn't
that nice?) and some are not. Is one better than the other - MAYBE.

Symantec (Norton) AntiVirus (~$11 and up)
http://www.symantec.com/nav/nav_9xnt/

Kaspersky Anti-Virus (~$49.95 and up)
http://www.kaspersky.com/products.html

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

AVG Anti-Virus System (Free and up)
http://www.grisoft.com/

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

AntiVir (Free and up)
http://www.free-av.com/

avast! (Free and up)
http://www.avast.com/

Trend Micro (~$49.95 and up)
http://www.trendmicro.com/en/home/us/personal.htm
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/

Did I mention you have to not only install this software, but also keep it
updated? You do. Some of them (most) have automatic services to help you
do this - I mean, it's not your job to keep up with the half-dozen or more
new threats that come out daily, is it? Be sure to keep whichever one you
choose up to date!


SPYWARE/ADWARE/POPUPS/HIJACKS
-----------------------------

So you must be thinking that the above two things got your back now - you
are covered, safe and secure in your little fox hole. Wrong! There are
more bad guys out there. There are annoyances out there you can get without
trying. Your normal web surfing, maybe a wrong click on a web page, maybe
just a momentary lack of judgment by installing some software packages
without doing the research.. And all of a sudden your screen starts filling
up with advertisements or your Internet seems much slower or your home page
won't stay what you set it and goes someplace unfamiliar to you. This is
spyware. There are a whole SLEW of software packages out there to get rid
of this crud and help prevent reinfection. Some of the products already
mentioned might even have branched out into this arena. However, there are
a few applications that seem to be the best at what they do, which is
eradicating and immunizing your system from this crap. Strangely, the best
products I have found in this category ARE generally free. That is a trend
I like. I make donations to some of them, they deserve it!

Two side-notes: Never think one of these can do the whole job.
Try the first 5 before coming back and saying "That did not work!"
Also, you can always visit:
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.

Spybot Search and Destroy (Free!)
http://www.safer-networking.net/en/download/index.html

Lavasoft AdAware (Free and up)
http://www.lavasoft.de/support/download/

CWShredder (Free!)
** No longer updated as of July 29, 2004 - however, still a great
product and should still be ran **
http://www.softbasket.com/download/s_8114.shtml

Hijack This! (Free)
http://mjc1.com/mirror/hjt/
( Tutorial: http://hjt.wizardsofwebsites.com/ )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html

IE-SPYAD (Free!)
https://netfiles.uiuc.edu/ehowes/www/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/

Browser Security Tests
http://www.jasons-toolbox.com/BrowserSecurity/

Popup Tester
http://www.popuptest.com/

The Cleaner (49.95 and up)
http://www.moosoft.com/

That will clean up your machine of the spyware, given that you download and
install several of them, update them regularly and scan with them when you
update. Some (like SpywareBlaster and SpyBot Search and Destroy and
IESPYAD)
have/are immunization utilities that will help you prevent your PC from
being
infected. Use these features!

Unfortunately, although that will lessen your popups on the Internet/while
you are online, it won't eliminate them. I have looked at a lot of options,
seen a lot of them used in production with people who seem to attract popups
like a plague, and I only have one suggestion that end up serving double
duty (search engine and popup stopper in one):

The Google Toolbar (Free!)
http://toolbar.google.com/

Yeah - it adds a bar to your Internet Explorer - but its a useful one. You
can search from there anytime with one of the best search engines on the
planet (IMO.) And the fact it stops most popups - wow - BONUS! If you
don't like that suggestion, then I am just going to say you go to
www.google.com and search for other options. Please notice that Windows XP
SP2 does help stop popups as well. Another option is to use an alternative
Web browser. I suggest "Mozilla Firefox", as it has some great features
and is very easy to use:

Mozilla Firefox
http://www.mozilla.org/products/firefox/

One more suggestion, although I will suggest this in a way later, is to
disable your Windows Messenger service. This service is not used frequently
(if at all) by the normal home user and in cooperation with a good firewall,
is generally unnecessary. Microsoft has instructions on how to do this for
Windows XP here:

http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp


SPAM EMAIL/JUNK MAIL
--------------------

This one can get annoying, just like the rest. You get 50 emails in one
sitting and 2 of them you wanted. NICE! (Not.) What can you do? Well,
although there are services out there to help you, some email
servers/services that actually do lower your spam with features built into
their servers - I still like the methods that let you be the end-decision
maker on what is spam and what isn't. If these things worked perfectly, we
wouldn't need people and then there would be no spam anyway - vicious
circle, eh? Anyway - I have two products to suggest to you, look at them
and see if either of them suite your needs. Again, if they don't, Google is
free and available for your perusal.

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

As I said, those are not your only options, but are reliable ones I have
seen function for hundreds+ people.


DISABLE (Set to Manual) UNUSED SERVICE/STARTUP APPS
---------------------------------------------------

I might get arguments on putting this one here, but it's my spill. There are
lots of services on your PC that are probably turned on by default you don't
use. Why have them on? Check out these web pages to see what all of the
services you might find on your computer are and set them according to your
personal needs. Be CAREFUL what you set to manual, and take heed and write
down as you change things! Also, don't expect a large performance increase
or anything - especially on today's 2+ GHz machines, however - I look at
each
service you set to manual as one less service you have to worry about
someone exploiting. A year ago, I would have thought the Windows Messenger
service to be pretty safe, now I recommend (with addition of a firewall)
that most home users disable it! Yeah - this is another one you have to
work for, but your computer may speed up and/or be more secure because you
took the time. And if you document what you do as you do it, next time, it
goes MUCH faster! (or if you have to go back and re-enable things..)

Task List Programs
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Black Viper's Service List and Opinions (XP)
http://www.blackviper.com/WinXP/servicecfg.htm

Processes in Windows NT/2000/XP
http://www.reger24.de/prozesse/

There are also applications that AREN'T services that startup when you start
up the computer/logon. One of the better description on how to handle these
I have found here:

Startups
http://www.pacs-portal.co.uk/startup_content.php


That's it. A small booklet on how to keep your computer secure, clean of
scum and more user friendly. I am SURE I missed something, almost as I am
sure you won't read all of it (anyone for that matter.) However, I also
know that someone who followed all of the advice above would also have less
problems with their PC, less problems with viruses, less problems with spam,
fewer problems with spyware and better performance than someone who didn't.

Hope it helps.

 

[Guest]

ok, a few questions...
1. how did you 'detect an

intruder'. specifics, not just 'somethin

happened'
2. how in the world

did you contact 'microsoft security'... what office, wh

did you talk to,

and how did they confirm that you had an intruder? and wh

couldn't they

tell you the one and only real way to instantly stop th

intrusion???

somehow i don't think you really got to microsoft security

3. no formal

training and yet you detected an intruder that ms securit

couldn't get rid of??
4. a virus that made you vulnerable after the intruder was in??? this make
no sense, if the intruder is in why add a virus to the mix, they can d
anything they want already... this doesn't make sense. the rootkit woul
come first, but if they were 'in' already why bother with that
5.

security audit failures usually have simple explanations, try askinspecifics on them... obviously you need to attend classes more

6. common

sense? bios tampering?? memory containing remnants??? none o

them are

likely, and memory remnants are impossible once you turn th

machine off

7. paranoia, now there is a real possibility

"(e-mail address removed)" <[email protected]@discussions.microsoft.com
wrote in message news:[email protected]..

Microsoft Security and they confirmed that it appeared to be so, however

was merely told that someone very smart had gotten into my computer an
the th a 'hom
user training in thi
area net. I do believe thi
perso render it vunerable and the
droppe

hard drive and write a new MBR. I wiped my hard driv

b

not right. I cannot tell you exactly what, but common sense i

tellin

me further investigation is needed. ( I was utilizing Windows XP Home whe

this breach occurred, but I replaced this OS with Windows XP Professional weird hard t
understan

persons intrusion or even still coul

thi

paranoia can be a good thing, over confidence sure seem

impractica

where internet security is concerned

Ok

Dave
I will be most happy to explain, what I have written

1. The reason I
know there was an intruder was because, I have a 100mbps cable connection and
my speed was at 54k, hmmmm
Also, after investigation, I found that my
Anti-virus update file had been relocated hmmmmm?, migrated and with a nice
new name as well, thus leaving me without protecion, but the intruder was
devious enough to hide this ugly deed by tweaking the anti-virus to run as
if nothing were wrong. I also found IP addys in my firewall log that were
suspicious, just a thought but, shouldn't only 'MY' IP addy be opening my
ports especially since I had my firewall enabled and even if the latter was
not necessarily true, surly the IP that opened the port should be known to
me. I had an IP Blocker engaged also, and it keep blocking guess who
255.255.255.0, my subnet mask, hmmmm? I also found a nice little
connection/service running in my registry with guess who?, the culprits IP,
which was not this persons location I'll betcha but, it was on a server
called "The Black Hole", looked it up in Whois database.
Had anonymous logons
in the security log, which were not related to Lanmanserver or any valid
anonymous logon, I read up on it. There were other things but, these were
most prominent, oh yes, before my system was actually breached, I had many
Failed logon attempts in my Security Event Log, guess that might have been
their 'brute attack', huh?
I tried to stop the attacks and protect my system
with software but, someone wanted my bandwidth really bad I would venture to
say.
If someone wants into your system, they "will' get in and if you believe
otherwise, you are sorely misinformed.

2.I contacted MS using the contact
info I found on the Security Website and no I was not hijacked/re-driected to
a bogus site and given the wrong number, I checked the URL. G
Actually when I
contacted them they told me to run my anti-virus and Sbybot S&D programs in
Safe Mode, which I had already done after I made sure I had a valid copy (I
repeated the procedure as they directed) and when the checks yielded nothing,
I called them back and gave them my case number. I was then asked to go to an
online website where some sort of scan was located. The guy I spoke with said
to look at this incident as a challenge, I said sure! So, I thought hey this
guy is really nice, together we will work this out. But when the scan showed
nothing negative, he then said, It "wouild not" show anything wrong, it would
just take care of any descripencies it might have found. Hummmm, now 'that'
did not make sense? This is where he said someone very smart has gotten into
your computer and the only offer he was giving was to re-dirct me to customer
support and bring out the credit card. So much for look at it as a
challenge, he bailed quickly, but not before he told me that it sounded like
I definitely had a breach. Let me clarify right now that I do not wish to
flame anyone but you asked and I am telling you, I have no reason or purpose
to lie, especially on a MS site or anywhere for that matter However, you may
believe what you wish.
I have nothing against paying someone
for help but,
I suppose I took the words written on the Security website to literally, you
know where it says"Support for secrity issues are available at no cost?
Oops!
My misunderstanding.

3. I do not have any formal training in such matters
and despite what you think of me, I have spent numerous hours surfing and
reading as much about pc security as I possibly can. The articles were
written by good and competant people with great advice on how to spot
intrusion attempts and how to spot an actal break. I am thankful for these
people for caring enough to give of their time to help keep others informed.
So, yes Dave, even someone such as myself can gain this knowledge by just
searching for it and if I had found reference to the questions I asked in my
original post, I would not be here bothering anyone. I have always been
concerned with security on my PC because it is each persons responsiility to
keep their systems free of pests and not spread them about. As far as why
they coud not tell me the'ONE' and only way to instantly stop an intruder, I
cannot say, perhaps you should ask them if you wish to know. Hey even I know
to just disconnect from the internet, but that does not get the intruder out,
it is only good until you re-connect.
Not the point anyway, you need to be
able to trace the intruders tracks, if possible so you can fix the area that
this person exploited to gain access to your system, that requires a
professional, if you plan on reporting the break-in to the police, it also
requires a profession to assre the integrety of that evidence. This is why I
called MS.
As for the virus, True I was always vunerable as long as I was
connected to the net, but I was saying that a person can send one a virus
through different methods to exploit certin vunerabilities thus making it
easier for them to gain access. I know it would not make sense for them to
risk infecting themselves.
Just think of it this way, 'It Is Always Easier To
Gain Victory If The Enemy Has Been Weakened.'
No one said MS could not get
rid of the intruder, they just did not give it much of a try.
As for the
remark you made about my paranoia, ever read any of Peter Norton's books ie
his 'Complete Guide to Microsoft Windows XP'?
Read his networking security
chapter, you may be surprised.
As far the remark you made concerning my
education or lack of, what purpose was this suppose to serve?

Thanks for
the help Dave.
Ann

 

[Guest]

Hello

Perhaps some may think I

ask dumb questions, but I do not think any

question is dumb. I detected

an intruder on my computer. I contacted

Microsoft Security and they

confirmed that it appeared to be so, however I

was merely told that

someone very smart had gotten into my computer and they

offered no

suggestions as to how to get this person out. I tried to the best

of my

ability to rid this person from my system. However I am a 'home user'

and

this was my first experience with a security breach. I use my computer

for

access to my college classes. I have had no formal training in this area.I relied on information I found searching the net. I do believe this person

introduced a virus into my computer to render it vunerable and then dropped
in a root kit, Christmas came early this year
Good thing for backup because
I had to format my hard drive and write a new MBR. I wiped my hard drive by
writing zeroes to it but, now that I have re-istalled my OS, something is
just not right. I cannot tell you exactly what, but common sense is telling
me further investigation is needed. ( I was utilizing Windows XP Home when
this breach occurred, but I replaced this

OS with Windows XP Professional) I

am getting "Failures" in my Security

Audits, those weird hard to understand

Events.
I want to know if my

BIOS could have been tampered with, or could

my memory contain remnants of

this persons intrusion or even still could this

person have manipulated

other hardware in my computer that would be

unaffected by a format
If

this is so, how can I remedy this to assure I have

wiped this person totally out of my system
I may sound paranoid, but I think
a little

paranoia can be a good thing, over confidence sure seems impractical

where

internet security is concerned.

Thank You
An

Thank you Peter for
the information and for the time you spent responding to my post
You
introduced some new applications to me through your post and I will be sure
to utilize them

Ann

 

[Guest]

Ann wrote

*WARNING* This is a LONG spill, all in plain text and simplified so tha

even non-techs should be able to understand it. Hopefully this wil

assist

some people in not only repairing their systems, but in makin

them faster

and more stable tools for them to use. It contains advic

on many things,

many considered "common knowledge" to 'IT' peopl

everywhere. It is split

into major sections, hopefully this will mak

it easier to navigate. *WARNING

Suggestions on what you can do to secure/clean your PC. Every attemp
has been made to be general and an assumption of a "Windows" operatin
system is made here as well - although in some ways, this could b
adapted to any OS


GENERAL UPKEEP AND CLEANU
-------------------------

You should periodically defragment your hard drives as well as check the
for errors. Only defragment after you have cleaned up your machine o
outside parasites and never defragment as a solution to a quirkiness i
your system. It may help speed up your system, but it should be clea
before you do this one

How to Defragment your hard drive
http://support.microsoft.com/?kbid=31484

How to scan your disks for error
http://support.microsoft.com/?kbid=31526

How to use Disk Cleanu
http://support.microsoft.com/?kbid=31031

You

should also empty your Internet Explorer Temporary Interne

Files and make

sure the maximum size for this is small enough not to caus

trouble in the

future. Empty your Temporary Internet Files and shrink th

size it stores

to a size between 10MB and 360MB.

- Open ONE copy of Internet Explorer
- Select TOOLS -> Internet Options
- Under the General tab in

the "Temporary Internet Files" section, do th

following
- Click on "Delete Cookies" (click OK
- Click on "Settings" and change the "Amount of disk space to use:" t
something between 10MB and 360MB. (Betting it is MUCH larger righ
now.
- Click OK
- Click on "Delete Files"

and select to "Delete all offline contents

(the checkbox) and click OK.

(If you had a LOT, this could take 2-10

minutes or more.)
- Once it is

done, click OK, close Internet Explorer, re-open Internet

Explorer.

Uninstall any software you no longer use or cannot remember installing

(ask

if it is a multi-user PC) - but only if you are sure you do not

need it

and/or you have the installation media around to reinstall if

you need to.

http://snipurl.com/8v6b may help you accomplish this.

If things are

running a bit slow or you have an older system

(1.5GHz or less and 256MB

RAM or less) then you may want to look into

tweaking the performance a bit

by turning off some of the memory

using Windows XP "prettifications". The fastest method is:

Control Panel --> System --> Advanced tab --> Performance section,
Settings button. Then choose "adjust for best performance" and you
now have a Windows 2000/98 look which turned off many of the annoying
"prettifications" in one swift action. You can play with the last
three checkboxes to get more of an XP look without many of the

other annoyances. You could also grab and install/mess with one

(or more)

of the Microsoft Powertoys - TweakUI in particular:

http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx

You should also verify that your System Restore feature is enabled andworking properly. Unfortunately, if seems to have issues on occasion,

ones

that can easily be avoided by turning off/on the system restore and

make a

manual restoration point as one of your periodic maintenance tasks.

This is

particularly important right before installing something major

(or even

minor if you are unsure what it might do to your system.)

(This, of course,

will erase any previous restore point you have.)

Turn off System Restore.
http://support.microsoft.com/?kbid=310405

Reboot.

Turn on System Restore.
http://support.microsoft.com/?kbid=310405

Make a Manual Restoration Point.

http://snipurl.com/68nx

Also, you

should look into backing up your valuable files and folders.

http://support.microsoft.com/?kbid=308422

And keep your original

installation media (CDs, disks) safe with their

CD keys and such. Make

backups of these installation media sets as

well and always use strong

passwords. Good passwords are those that

meet these general rules (mileage may vary):

Passwords should contain at least six characters, and the character
string should contain at least three of these four character types:
- uppercase letters
- lowercase letters
- numerals

- nonalphanumeric characters (e.g., *, %, &, !)

Passwords should

not contain your name/logon name.

UPDATES and PATCHES
-------------------

** Side Note: *IF* you are about to install Service Pack 2 (SP2) for
Windows XP, I suggest you clean up your system first. Uninstall any
applications you do not use. Update any that you do. Download the
latest drivers for your hardware devices. Defragment and run a full
CHKDSK on your hard drives. Scan your system and clean it of any
Spyware/Adware/Malware and for Viruses and Trojans. Below you will
find advice and links to applications that will help you do all of
this. If this advice helps you, please - pass it on. Print it,

email it, forward it to anyone you think it might help. A littleknowledge might help prevent lots of trouble.

This one is the most

obvious. There is no perfect product and any company

worth their salt will

try to meet/exceed the needs of their customers and

fix any problems they

find along the way. I am not going to say Microsoft

is the best company in

the world about this but they do have an option

available for you to use to

keep your machine updated and patched from

the problems and vulnerabilities

(as well as product improvements in some

cases) - and it's free to you.

Windows Update
http://windowsupdate.microsoft.com/

Go there and

scan your machine for updates. Always get the critical ones as

you see

them. Write down the KB###### or Q###### you see when

selecting the

updates and if you have trouble over the next few days,

go into your

control panel (Add/Remove Programs), match up the latest

numbers you

downloaded recently (since you started noticing an issue) and

uninstall

them. If there was more than one (usually is), install them back

one by

one - with a few hours of use in between, to see if the problem

returns.

Yes - the process is not perfect (updating) and can cause trouble

like I

mentioned - but as you can see, the solution isn't that bad - and is

MUCH better than the alternatives.

Windows is not the only product you likely have on your PC. The
manufacturers of the other products usually have updates as well. New
versions of almost everything come out all the time - some are free, some
are pay - some you can only download if you are registered - but it is best
to check. Just go to their web pages and look under their support and
download sections. For example, for Microsoft Office update, you should
visit:

Microsoft Office Updates
http://office.microsoft.com/
(and select "downloads")

You also have

hardware on your machine that requires drivers to interface

with the

operating system. You have a video card that allows you to see on

your

screen, a sound card that allows you to hear your PCs sound output and

so

on. Visit those manufacturer web sites for the latest downloadable

drivers

for your hardware/operating system. Always (IMO) get the

manufacturers

hardware driver over any Microsoft offers. On the Windows

Update site I

mentioned earlier, I suggest NOT getting their hardware

drivers - no matter

how tempting. First - how do you know what hardware

you have in your

computer? Invoice or if it is up and working now - take

inventory:

Belarc Advisor
http://belarc.com/free_download.html

Once you know

what you have, what next? Go get the latest driver for your

hardware/OS

from the manufacturer's web page. For example, let's say you

have an

NVidia chipset video card or ATI video card, perhaps a Creative

Labs sound

card or C-Media chipset sound card...

NVidia Video Card Drivers
http://www.nvidia.com/content/drivers/drivers.asp

ATI Video Card Drivers
http://www.atitech.com/support/driver.html

Creative Labs Sound Device
http://us.creative.com/support/downloads/

C-Media Sound Device
http://www.cmedia.com.tw/e_download_01.htm

As for Service Pack

2 (SP2) for Windows XP, Microsoft has made this

particular patch available

in a number of ways. First, there is the

Windows Update web page above.

Then there is a direct download site

and finally, you can order the FREE CD from Microsoft.

Direct Download of Service Pack 2 (SP2) for Windows XP
http://snipurl.com/8bqy

Order the Free Windows XP SP2 CD
http://snipurl.com/8umo

Microsoft also have a bunch of suggestions, some similar to these,
on how to better protect your Windows system:

Protect your PC
http://www.microsoft.com/security/protect/


FIREWALL
--------

Let's say you are up-to-date on the OS (operating system) and you have
Windows XP.. You should at least turn on the built in firewall. That will
do a lot to "hide" you from the random bad things flying around the
Internet. Things like Sasser/Blaster enjoy just sitting out there in
Cyberspace looking for an unprotected Windows Operating System and jumping
on it, doing great damage in the process and then using that Unprotected OS
to continue its dirty work of infecting others. If you have the Windows XP
FW turned on - default configuration - then they cannot see you! Think of
it as Internet Stealth Mode at this point. It has other advantages, like
actually locking the doors you didn't even (likely) know you had. Doing
this is simple, some helpful tips for the SP2 enabled firewall can be found
here:

http://www.microsoft.com/technet/community/columns/cableguy/cg0204.mspx

If you read through that and look through the pages that are linked from itthroughout - I think you should have a firm grasp on the basics of theWindows XP Firewall as it is today. One thing to note RIGHT NOW - if youhave AOL, you cannot use this nice firewall that came with your system.Thank AOL, not Microsoft. You HAVE to configure another one.. So wecontinue with our session on Firewalls...

But let's say you DON'T have

Windows XP - you have some other OS lik

Windows 95, 98, 98SE, ME, NT,

2000. Well, you don't have the nifty built i

firewall. My suggestion -

upgrade. My next suggestion - look through you

options. There are lots

of free and pay firewalls out there for home users

Yes - you will have to

decide on your own which to get. Yes, you will hav

to learn (oh no!) to

use these firewalls and configure them so they don'

interfere with what

you want to do while continuing to provide the securit

you desire. It's

just like anything else you want to protect - you have t

do something to

protect it. Here are some suggested applications. A lot o

people tout

"ZoneAlarm" as being the best alternative to just using th

Windows XP FW,

but truthfully - any of these alternatives are much bette

than the Windows

XP FW at what they do - because that is ALL they do

ZoneAlarm (Free and up
http://snipurl.com/6oh

Kerio Personal Firewall (KPF) (Free and up
http://www.kerio.com/kpf_download.htm

Outpost Firewall from Agnitum (Free and up
http://www.agnitum.com/download

Sygate Personal Firewall (Free and up
http://smb.sygate.com/buy/download_buy.ht

Symantec's Norton Personal Firewall (~$25 and up
http://www.symantec.com/sabu/nis/npf

BlackICE PC Protection ($39.95 and up

http://blackice.iss.net

Tiny

Personal Firewall (~$49.00 and up

http://www.tinysoftware.com

That

list is not complete, but they are good firewall options, every one othem. Visit the web pages, read up, ask around if you like - makedecision and go with some firewall, any firewall. Also, maintain itSometimes new holes are discovered in even the best of these products anpatches are released from the company to remedy this problem. However, iyou don't get the patches (check the manufacturer web page on occasion)then you may never know you have the problem and/or are being used througthis weakness. Also, don't stack these things. Running more than onfirewall will not make you safer - it would likely (in fact) negate somprotection you gleamed from one or the other firewalls you run

ANTIVIRUS SOFTWAR

facet of a secure PC, but firewalls don't d

everything. I saw one person

posting on a newsgroup that "they ha

never had a virus and they never run

any anti-virus software." Yep - I use

to believe that way too - viruses

were something everyone else seemed t

get, were they just careless? And

for the average joe-user who is careful

uses their one to three family

computers carefully, never opening unknow

email attachments, always

visiting the same family safe web sites, neve

installing anything that did

not come with their computer - maybe, jus

maybe they will never witness a

virus. I, however, am a Network System

Administrator. I see that

AntiVirus software is an absolute necessity give

how most people see their

computer as a toy/tool and not somethin

they should have to maintain and

upkeep. After all, they were invented t

make life easier, right - not add another task to your day. Yo
can be as careful as you want - will the

next person be as careful? Wil

someone send you unknowingly the email

that erases all the pictures of you

child/childhood? Possibly - why take

the chance? ALWAYS RUN ANTIVIRU

SOFTWARE and KEEP IT UP TO DATE!

Antivirus software comes in so man

flavors, it's like walking into a Jelly

Belly store - which one tastes lik

what?! Well, here are a few choices

for you. Some of these are free (isn'

that nice?) and some are not. Is

one better than the other - MAYBE

Symantec (Norton) AntiVirus (~$11 and up
http://www.symantec.com/nav/nav_9xnt

Kaspersky Anti-Virus (~$49.95 and up
http://www.kaspersky.com/products.htm

Panda

Antivirus Titanium (~$39.95 and up

http://www.pandasoftware.com
(Free

Online Scanner: http://www.pandasoftware.com/activescan/

AVG

Anti-Virus System (Free and up)

http://www.grisoft.com/

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

AntiVir (Free and up)
http://www.free-av.com/

avast! (Free and up)
http://www.avast.com/

Trend Micro (~$49.95 and up)
http://www.trendmicro.com/en/home/us/personal.htm
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

RAV

AntiVirus Online Virus Scan (Free!)

http://www.ravantivirus.com/scan/

Did I mention you have to not only install this software, but also keep itupdated? You do. Some of them (most) have automatic services to help youdo this - I mean, it's not your job to keep up with the half-dozen or morenew threats that come out daily, is it? Be sure to keep whichever one you

choose up to date!


SPYWARE/ADWARE/POPUPS/HIJACKS
-----------------------------

So you must be thinking that the above two things got your back now - you
are covered, safe and secure in your little fox hole. Wrong! There are
more bad guys out there. There are annoyances out there you can get without
trying. Your normal web surfing, maybe a

wrong click on a web page, maybe

just a momentary lack of judgment by

installing some software packages

without doing the research.. And all of

a sudden your screen starts filling

up with advertisements or your Internet

seems much slower or your home page

won't stay what you set it and goes

someplace unfamiliar to you. This is

spyware. There are a whole SLEW of

software packages out there to get rid

of this crud and help prevent

reinfection. Some of the products already

mentioned might even have

branched out into this arena. However, there are

a few applications that

seem to be the best at what they do, which is

eradicating and immunizing

your system from this crap. Strangely, the best

products I have found in

this category ARE generally free. That is a trend

I like. I make

donations to some of them, they deserve it!

Two side-notes: Never think

one of these can do the whole job.

Try the first 5 before coming back and saying "That did not work!"
Also, you can always visit:
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.

Spybot Search and Destroy (Free!)

http://www.safer-networking.net/en/download/index.html

Lavasoft AdAware (Free and up)
http://www.lavasoft.de/support/download/

CWShredder (Free!)
** No longer updated as of July 29, 2004 - however, still a great
product and should still be ran **
http://www.softbasket.com/download/s_8114.shtml

Hijack This! (Free)
http://mjc1.com/mirror/hjt/
( Tutorial: http://hjt.wizardsofwebsites.com/ )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html

IE-SPYAD (Free!)
https://netfiles.uiuc.edu/ehowes/www/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/

Browser Security Tests
http://www.jasons-toolbox.com/BrowserSecurity/

Popup Tester
http://www.popuptest.com/

The Cleaner (49.95 and up)
http://www.moosoft.com/

That will clean up your machine of the spyware, given that you download and
install several of them, update them regularly and scan with them when you
update. Some (like SpywareBlaster and SpyBot Search and Destroy and
IESPYAD)
have/are immunization utilities that

will help you prevent your PC from

being
infected. Use these features!

Unfortunately, although that will lessen your popups on the Internet/while
you are online, it won't eliminate them. I have looked at a lot of options,
seen a lot of them used in production with people who seem to attract popups
like a plague, and I only have one suggestion that end up serving double
duty (search engine and popup stopper in one):

The Google Toolbar (Free!)
http://toolbar.google.com/

Yeah - it adds a

bar to your Internet Explorer - but its a useful one. You

can search from

there anytime with one of the best search engines on the

planet (IMO.) And

the fact it stops most popups - wow - BONUS! If you

don't like that

suggestion, then I am just going to say you go to

www.google.com and search

for other options. Please notice that Windows XP

SP2 does help stop popups

as well. Another option is to use an alternative

Web browser. I suggest

"Mozilla Firefox", as it has some great features

and is very easy to use:

Mozilla Firefox
http://www.mozilla.org/products/firefox/

One more

suggestion, although I will suggest this in a way later, is to

disable your

Windows Messenger service. This service is not used frequently

(if at all)

by the normal home user and in cooperation with a good firewall,

is

generally unnecessary. Microsoft has instructions on how to do this for

Windows XP here:

http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp


SPAM EMAIL/JUNK MAIL

annoying, just like the rest. You get 50 emails in one

sitting and 2 of

them you wanted. NICE! (Not.) What can you do? Well,

although there are

services out there to help you, some email

servers/services that actually

do lower your spam with features built into

their servers - I still like

the methods that let you be the end-decision

maker on what is spam and what

isn't. If these things worked perfectly, we

wouldn't need people and then

there would be no spam anyway - vicious

circle, eh? Anyway - I have two

products to suggest to you, look at them

and see if either of them suite

your needs. Again, if they don't, Google is

free and available for your perusal.

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

As I said, those

are not your only options, but are reliable ones I have

seen function for hundreds+ people.


DISABLE (Set to Manual) UNUSED SERVICE/STARTUP APPS

arguments on putting this one here, but it's my spill. There are

lots of

services on your PC that are probably turned on by default you don't

use.

Why have them on? Check out these web pages to see what all of theservices you might find on your computer are and set them according to yourpersonal needs. Be CAREFUL what you set to manual, and take heed and writedown as you change things! Also, don't expect a large performance increaseor anything - especially on today's 2+ GHz machines, however - I look at

each
service you set to manual as one less service you have to worry about
someone exploiting. A year ago, I would have thought the Windows Messenger
service to be pretty safe, now I recommend (with addition of a firewall)
that most home users disable it! Yeah - this is another one you have to
work for, but your computer may speed up and/or be more secure because you
took the time. And if you document what you do as you do it, next time, it
goes MUCH faster! (or if you have to go back and re-enable things..)

Task List Programs
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Black

Viper's Service List and Opinions (XP)

http://www.blackviper.com/WinXP/servicecfg.htm

Processes in Windows NT/2000/XP
http://www.reger24.de/prozesse/

There are also

applications that AREN'T services that startup when you start

up the

computer/logon. One of the better description on how to handle these

I have found here:

Startups
http://www.pacs-portal.co.uk/startup_content.php


That's it. A small

booklet on how to keep your computer secure, clean of

scum and more user

friendly. I am SURE I missed something, almost as I am

sure you won't read

all of it (anyone for that matter.) However, I also

know that someone who

followed all of the advice above would also have less

problems with their

PC, less problems with viruses, less problems with spam,

fewer problems

with spyware and better performance than someone who didn't.

Hope it helps.

it is suggested you research for

yourself before you take any advice - you are the one ultimately
responsible for your actions/problems/solutions. Know what you are
getting into before you jump in with both feet.

Wow, thank you Shenan for all the great information you posted,
fantastic!
Ann

 

[null]

You will want to install Windows' critical updates and Service Packs
before you actually connect the PC to the network or the Internet. This
will protect your PC from crackers that might attack before you've
installed appropriate Windows patches. So, go to someone else's PC that
has a writeable CD drive and with IE:

Go to v4.windowsupdate.microsoft.com/catalog and selectFind updates for
Microsoft Windows operating systems, selecting your OS. Select Search,
then click on Critical updates and service packs. SelectAdd for each one
you want and it will be added to your download basket.

Click on Go to download basket. Click on the browse button to find a
location to which you can download the files. Fill it in and click on
Download Now.

Copy the downloaded files to a CD, put the CD in your own PC, and run
the updates you downloaded.

--
The reader should exercise normal caution and backup the Registry and
data files regularly, and especially before making any changes to their
PC, as well as performing regular virus and spyware scans. I am not
liable for problems or mishaps that occur from the reader using advice
posted here. No warranty, express or implied, is given with the posting
of this message.

 

[Dave]

thats what i thought. all those symptoms you describe could be from a
single virus. and you really didn't talk to microsoft security and get
anyone who knew anything, you just got the phone answering team setup to
tell you to go buy someone else's products to fix ms holes. you don't talk
to the real ones until you start paying, those guys you got just run a
script and get you off the phone as fast as possible.

 

[Guest]

You will want to install Windows' critical updates and Service Packs
before you actually connect the PC to the network or the Internet. This
will protect your PC from crackers that might attack before you've
installed appropriate Windows patches. So, go to someone else's PC that
has a writeable CD drive and with IE:

Go to

v4.windowsupdate.microsoft.com/catalog and selectFind updates forMicrosoft Windows operating systems, selecting your OS. Select Search,then click on Critical updates and service packs. SelectAdd for each oneyou want and it will be added to your download basket.

Click on Go to

download basket. Click on the browse button to find a

location to which

you can download the files. Fill it in and click on

Download Now.

Copy the downloaded files to a CD, put the CD in your own PC, and run

the updates you downloaded.

--
The reader should exercise normal caution and backup the Registry and
data files regularly, and especially before making any changes to their
PC, as well as performing regular virus and spyware scans. I am not
liable for problems or mishaps that occur from the reader using advice
posted here. No warranty, express or implied, is given with the posting
of this message.

Thanks null for the tip, will

do.
Ann

 

[Guest]

Hello-
To me it isn't clear that you have a virus or that there is an intruder.
Let me explain, I had similar things going on with my computer and after I
described it to a computer technician he told me that the computer had been
hacked into.
Further investegation tought me that I had no intruders or viruses.
Everything showed that the internet accellerator was actually logging onto my
computer and into the internet whenever I logged on.
however it is clear that you are concernd about this and that your not clear
as to what your actions have created.
Writing zeros to the drive will destroy everything in it's path. so you have
cleared any viruses that may have been ligering on the drive. Trust me, i've
written zeros to hard drives over 40 times in the last year. ( A little side
work) The memory is cleared each time you shut your computer off.
as far as the hardware being manipulated in some way, it's not likely or
impossible.
Many times I found that it's software descrepencies that create failed
audits. Do you belong to a network?
How did you learn of the failed audits on win xp home ed. ?? Just curious.
Can you write a little more on the symptoms? what other software programs
are you using to a high degree??

 

[Guest]

hi

wow! gr8 one dude

1. what

made u think there is an intruder

2. did u detect any ip
3. who in

microsoft did u contact and what were u told

4. which AV are u running

5. which firewall u have installed and if u have one, please post th

log

reffering to the intruder alert

please post these details alongwith

which MS patches u have installe

using windows update

vishal kadakia's Profile:
http://forums.tech-arena.com/member.php?userid=181

 

[Guest]

hi,

wow! gr8 one dude,

1. what

made u think there is an intruder?

2. did u detect any ip?
3. who in

microsoft did u contact and what were u told?

4. which AV are u running?

5. which firewall u have installed and if u have one, please post the

log

reffering to the intruder alert.

please post these details alongwith

which MS patches u have installed

using windows update.

vishal kadakia's Profile:
http://forums.tech-arena.com/member.php?userid=1816

View this thread: http://forums.tech-arena.com/showthread.php?t=15884
Tech-Arena - http://www.tech-arena.com

Oops!

Hello Vishal Kadakia,

The answer to
your question 1, I have

already answered, please see my reply to DAVE.
Since it is quite lengthy, I

will not duplicate it here.

In answer to your
question 2, YES, I utilized

the 'net stat' cmd from the command prompt and
found a suspicious

connection. It was not mine nor did it's IP addy belong
to anyone on my
LAN,
in fact the IP did not even belong to my provider!
However, it was
identical
to the suspicious IP in my firewall log that was
opening and
closing m ports.
It was also a match to the one found in my
registry. I
tried to report this
incident to my ISP and found that they
only investigate
IP's in their own
network. I should have just reported
the incident to the
police and let them
determine what had actually
occurred. What I have
learned was after the
fact, I was not as informed
about security as I
thought. One thing is for
sure, intruder or not, it
woke me up!

In
answer to your question 3.
I
called the telephone number
found on the MS
Security website that can be
accessed throught the
Microsoft Security Center
that was installed with SP2.
Please see my reply
to DAVE also.

NOTE:
Please don't ask me anything more
concerning my
contact with MS, it does not
pertain directly to the problem of
intruder
detection or remedy. My mistake
for even mentioning it. I only did
so to
share my experience, so others
would know beforehand what could occur.

Notice I said "COULD", not
definite.

Your Question 4, I was running AVG
Free
Edition and before you
ask, yes I kept the definitions and the
application
updated, religiously, I
checked daily for new definitions.
However, when
your AV app has been
rendered useless, as mine was, updates
mean nothing.


Your question 5. I
was using the Windows XP firewall. I
do have the in
question firewall log
intact on an extenal HD, however I
cannot access it
until I install my new
OS and get online, but I can post
it by next week,
that is a guesstimate
that I will be back online by then.
Rest assured, I
will post it, this is
why I came here for analysis of this
event.

Again, I
cannot post the
patches for you because they were wiped
out when I rewrote my
drive, however
I do have a paper hand-written copy I
kept, just in case. I
can scan it
into my computer and send it this way,
if you want.
I kept my OS
updated
just as religiously as my programs.

It
is good to be curious and
question
things, this is why I came here. If I
am wrong, I want to know it.
I would
be relieved to know that I was
mistaken.

Thank you for your
reponse.

Ann

Oops!

Hello Vishal
Kadakia,

The answer to your question 1, I have

already answered, please
see my reply to DAVE. Since it is quite lengthy, I

will not duplicate it
here.

In answer to your question 2, YES, I utilized

the 'net stat' cmd
from the command prompt and found a suspicious

connection. It was not
mine nor did it's IP addy belong to anyone on my
LAN,
in fact the IP did
not even belong to my provider! However, it was
identical
to the suspicious
IP in my firewall log that was opening and
closing m ports.
It was also a
match to the one found in my registry. I
tried to report this
incident to
my ISP and found that they only investigate
IP's in their own
network. I
should have just reported the incident to the
police and let them
determine
what had actually occurred. What I have
learned was after the
fact, I was
not as informed about security as I
thought. One thing is for
sure,
intruder or not, it woke me up!

In
answer to your question 3.
I
called
the telephone number found on the MS
Security website that can be
accessed
throught the Microsoft Security Center
that was installed with SP2.
Please
see my reply to DAVE also.

NOTE:
Please don't ask me anything more

concerning my contact with MS, it does not
pertain directly to the problem
of
intruder detection or remedy. My mistake
for even mentioning it. I
only did
so to share my experience, so others
would know beforehand what
could occur.
Notice I said "COULD", not
definite.

Your Question 4, I was
running AVG Free
Edition and before you
ask, yes I kept the definitions and
the application
updated, religiously, I
checked daily for new definitions.
However, when
your AV app has been
rendered useless, as mine was, updates
mean nothing.


Your question 5. I
was using the Windows XP firewall. I
do have the in
question firewall log
intact on an extenal HD, however I
cannot access it
until I install my new
OS and get online, but I can post
it by next week,
that is a guesstimate
that I will be back online by then.
Rest assured, I
will post it, this is
why I came here for analysis of this
event.

Again, I
cannot post the
patches for you because they were wiped
out when I rewrote my
drive, however
I do have a paper hand-written copy I
kept, just in case. I
can scan it
into my computer and send it this way,
if you want.
I kept my OS
updated
just as religiously as my programs.

It
is good to be curious and
question
things, this is why I came here. If I
am wrong, I want to know it.
I would
be relieved to know that I was
mistaken.

Thank you for your
reponse.

Ann

Oops!

Hello Vishal
Kadakia,

The answer to your question 1, I have

already answered, please
see my reply to DAVE. Since it is quite lengthy, I

will not duplicate it
here.

In answer to your question 2, YES, I utilized

the 'net stat' cmd
from the command prompt and found a suspicious

connection. It was not
mine nor did it's IP addy belong to anyone on my
LAN,
in fact the IP did
not even belong to my provider! However, it was
identical
to the suspicious
IP in my firewall log that was opening and
closing m ports.
It was also a
match to the one found in my registry. I
tried to report this
incident to
my ISP and found that they only investigate
IP's in their own
network. I
should have just reported the incident to the
police and let them
determine
what had actually occurred. What I have
learned was after the
fact, I was
not as informed about security as I
thought. One thing is for
sure,
intruder or not, it woke me up!

In
answer to your question 3.
I
called
the telephone number found on the MS
Security website that can be
accessed
throught the Microsoft Security Center
that was installed with SP2.
Please
see my reply to DAVE also.

NOTE:
Please don't ask me anything more

concerning my contact with MS, it does not
pertain directly to the problem
of
intruder detection or remedy. My mistake
for even mentioning it. I
only did
so to share my experience, so others
would know beforehand what
could occur.
Notice I said "COULD", not
definite.

Your Question 4, I was
running AVG Free
Edition and before you
ask, yes I kept the definitions and
the application
updated, religiously, I
checked daily for new definitions.
However, when
your AV app has been
rendered useless, as mine was, updates
mean nothing.


Your question 5. I
was using the Windows XP firewall. I
do have the in
question firewall log
intact on an extenal HD, however I
cannot access it
until I install my new
OS and get online, but I can post
it by next week,
that is a guesstimate
that I will be back online by then.
Rest assured, I
will post it, this is
why I came here for analysis of this
event.

Again, I
cannot post the
patches for you because they were wiped
out when I rewrote my
drive, however
I do have a paper hand-written copy I
kept, just in case. I
can scan it
into my computer and send it this way,
if you want.
I kept my OS
updated
just as religiously as my programs.

It
is good to be curious and
question
things, this is why I came here. If I
am wrong, I want to know it.
I would
be relieved to know that I was
mistaken.

Thank you for your
reponse.

Ann

Oops!

Hello Vishal
Kadakia,

The answer to your question 1, I have

already answered, please
see my reply to DAVE. Since it is quite lengthy, I

will not duplicate it
here.

In answer to your question 2, YES, I utilized

the 'net stat' cmd
from the command prompt and found a suspicious

connection. It was not
mine nor did it's IP addy belong to anyone on my
LAN,
in fact the IP did
not even belong to my provider! However, it was
identical
to the suspicious
IP in my firewall log that was opening and
closing m ports.
It was also a
match to the one found in my registry. I
tried to report this
incident to
my ISP and found that they only investigate
IP's in their own
network. I
should have just reported the incident to the
police and let them
determine
what had actually occurred. What I have
learned was after the
fact, I was
not as informed about security as I
thought. One thing is for
sure,
intruder or not, it woke me up!

In
answer to your question 3.
I
called
the telephone number found on the MS
Security website that can be
accessed
throught the Microsoft Security Center
that was installed with SP2.
Please
see my reply to DAVE also.

NOTE:
Please don't ask me anything more

concerning my contact with MS, it does not
pertain directly to the problem
of
intruder detection or remedy. My mistake
for even mentioning it. I
only did
so to share my experience, so others
would know beforehand what
could occur.
Notice I said "COULD", not
definite.

Your Question 4, I was
running AVG Free
Edition and before you
ask, yes I kept the definitions and
the application
updated, religiously, I
checked daily for new definitions.
However, when
your AV app has been
rendered useless, as mine was, updates
mean nothing.


Your question 5. I
was using the Windows XP firewall. I
do have the in
question firewall log
intact on an extenal HD, however I
cannot access it
until I install my new
OS and get online, but I can post
it by next week,
that is a guesstimate
that I will be back online by then.
Rest assured, I
will post it, this is
why I came here for analysis of this
event.

Again, I
cannot post the
patches for you because they were wiped
out when I re-wrote my
drive, however
I do have a paper hand-written copy I
kept, just in case. I
can scan it
into my computer and send it this way,
if you want.
I kept my OS
updated
just as religiously as my programs.

It
is good to be curious and
question
things, this is why I came here. If I
am wrong, I want to know it.
I would
be relieved to know that I was
mistaken.

Thank you for your
reponse.

Ann

 

[Guest]

ann@anonymouslogon ppl keep on asking you questions because what you say
about contacting microsoft does not make any sense as of they not even
offering you a solution as as of how and why you say you have been hacked
into. your entire posting is suspicious..many things that you say simply do
not make any sense.

 

[Guest]

Hello Joe
I can only say, I have been completely honest in all I have
composed
I did not come to this forum to defend what I know to be fact. I
came her to speak with 'professional and knowledgeable' people who would,
instead of judging what I say as having a hidden agenda, be open-minded and
be genuinely interested in helping me recover from a security breach. In
other words I expected the posters to conduct themselves in a professional
way.
Negativiy is a waste of time and energy and leads to nothing
A
newsgroup lacks all the essentials that make a complete and clear
commuication, just because I may have been misunderstood by a few, does not
mean my words should be totally discredited
Why even have the newsgroup if
the people participating in it sit in judgement of anyone they might not
agree with. To act in such a negative manner cheapens the Newsgroup and in
essences makes the newsgroup a glorified Chat Room
Each individual was not
born with total knowledge of everything, we all were beginners at one point
and time. Hmmm? How soon some forget
Perhaps instead of judging, you should
have asked constructive questions about the incident. You might just get bit
on the old tush with the same hack one day. Never say never.
Instead of
the negative responses why didn't you just ask for clarification
No one
knows everything
As far as the MS issue, get over it, I have
In the future
if anyone wishes to comment in a negative way, be my guest, just know that
you will be ignored, by me

Thanks
(e-mail address removed)

 

[Guest]

Hello SHenan
Don't know if you will read my reply, but I wanted to let you
know that I did indeed read your entire post and found some very good
information
I especially learned alot fom the mvps.org website, thank you
very much for your input

Sincerely
(e-mail address removed)

 

[Shenan Stanley]

Hello Shenan,
Don't know if you will read my reply, but I wanted to let you
know that I did indeed read your entire post and found some very good
information.
I especially learned alot fom the mvps.org website, thank you
very much for your input.

You are very welcome.