Phantom drive

[Guest]

How would I find a hidden, encrypted phantom drive that a hacker installed on
my Dell Dimension 2400 Windows XP-running computer? Someone is on with me and
manipulates the screen and cursor. Right after I reformatted, before Windows
was installed, it showed about 33 MB of space in use. No antivirus can find
this Trojan or whatever it is, but of course the antivirus couldn't check
another partition. Partition magic shows only one partition and no
unpartitioned space. I installed only one partition. Thank you.

 

[GHalleck]

How would I find a hidden, encrypted phantom drive that a hacker installed on
my Dell Dimension 2400 Windows XP-running computer? Someone is on with me and
manipulates the screen and cursor. Right after I reformatted, before Windows
was installed, it showed about 33 MB of space in use. No antivirus can find
this Trojan or whatever it is, but of course the antivirus couldn't check
another partition. Partition magic shows only one partition and no
unpartitioned space. I installed only one partition. Thank you.

An anti-virus program by itself might not be able to detect
the entire gamut of spyware, adware or malware. There are
applications specifically for these and they should be run
concurrently with an anti-virus program. Some of the apps
are Lavasoft Ad-Aware SE Personal Ver. 1.06, Spybotg S&D,
etc. In addition, using an external scanner, such as Trend
Micro's Housecall, might detect unwanted apps that have gotten
by the usual anti-virus agent. Finally, to protect against
unwanted intrusions, also install a good, 2-way firewall.

 

[Nepatsfan]

How would I find a hidden, encrypted phantom drive that a
hacker installed on my Dell Dimension 2400 Windows
XP-running computer? Someone is on with me and manipulates
the screen and cursor. Right after I reformatted, before
Windows was installed, it showed about 33 MB of space in
use. No antivirus can find this Trojan or whatever it is,
but of course the antivirus couldn't check another
partition. Partition magic shows only one partition and no
unpartitioned space. I installed only one partition. Thank
you.

Recent Dell Dimension systems, including the 2400, all have a
small hidden partition that contains diagnostic software that
can be run when the computer first boots by hitting the F12
key. I don't know if that partition would be visible in PM but
it does show up in Disk Management. Go to Start -> Run and
enter diskmgmt.msc in the open box. Find your hard drive in the
lower pane. The diagnostic partition shows up at the beginning
of the drive and I think it's listed as type unknown.

That said, what makes you think someone is accessing your
computer? Sometimes what people think is the work of a hacker
turns out to be a problem with their mouse, especially a
wireless one.

Good luck

Nepatsfan

 

[Guest]

Thank you for the information about the Dell hidden partition. I had no idea
it existed.

I don't have a wireless mouse. The arrow jumps around some on the screen.
Also, another something changes the website I'm looking at to another (not
just a popup ad) with no input from me. Sometimes it gets so bad I can't use
the computer. I have Norton antivirus. Every time I connect to the Internet,
Norton tells me that Bla Trojan horse worm has been blocked. Also, RegDefend
allows me to block a registry entry that would change networking settings.

 

[Guest]

I'm using also SpyBot search and destroy, which has never found spyware.
Neither has Ad-Aware. Thank you for telling me about Trend Micro's Housecall.
I'll check it out. I was unable to use Norton's online scanner because my
machine wouldn't load their Active X, even when I disabled anything that
might be blocking the download. I've tried just about every firewall, and
they don't work for me. I've been told that they don't block all of the
high-numbered ports. I wouldn't know how to set up one to do this unless
somewhere online there's a list of every port and what it does. I'm not a
computer expert. What I've learned, I've learned trying to block this
persistent hacker. Right now I'm using the Windows XP firewall. I can't
really afford one from Norton.

I recently found out that Linux can boot without a boot partition. Is it
possible to run Linux in Windows? Perhaps the antivirus can't detect
malicious programs written in Linux?

 

[Guest]

I just tried to use Trend Micro Housecall. Initially Active X wouldn't
download. Then it did. The program files downloaded. But the scan got to 7%
and stopped. It said zero files were scanned, but the program kept running. I
finally turned it off after 10 minutes. Windows said the program wasn't
responding.

 

[Nepatsfan]

For starters, you might want to post this question to the
following newsgroup:

Discussions in Security Virus
http://support.microsoft.com/newsgr...dg=microsoft.public.security.virus&sloc=en-us

In researching the Bla trojan, I've come across many references
to it being a false postive reported by Norton. That said,
here's two courses of action you can try.

Options # 1, Major surgery:

Keep in mind that the only way to be 100% certain that you've
removed any sort of virus/trojan/worm is to wipe out the entire
hard drive and start from scratch. That means removing all the
partitions, including the hidden Dell partition, partitioning
the hard drive, formatting the drive and reinstalling Windows.

The first thing to do after installing Windows is to install
your AV software and get the Windows Firewall running. Don't go
on the internet until you've got some protection in place.
Update your AV software first, then update Windows. Once those
steps are completed, reinstall your applications and whatever
data you salvaged from the old system. I'd be very careful as
far as importing old email messages. Odds are, that's how your
computer got infected in the first place.

Option #2, Minor surgery:

Here are some online scanners. All of them require ActiveX
downloads. Hopefully, they won't be blocked.

Run both the AntiVirus and the AntiSpyware scan on this site:
http://housecall.trendmicro.com/

Click on the "Scan your PC button" while holding down the CTRL
key (to override any popup stoppers):
http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

McAfee FreeScan
http://us.mcafee.com/root/mfs/default.asp?WWW_URL=www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/sscv6/default.asp?productid=symhome&langid=ie&venid=sym

If you're unable to run any of these scans go to this web site
and follow the procedures outlined there:

http://www.claymania.com/removal-trojan-adware.html

Finally, go to this web site and download HijackThis:

HijackThis 1.99.1
http://www.merijn.org/files/hijackthis.zip

Run the program and save the log. There are a number of web
sites where HijackThis logs should be posted. Here are some of
the more popular ones:

CastleCops HijackThis Forum
http://castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html

Aumha Forums - HijackThis Logs
http://forum.aumha.org/

HijackThis Logs and Analysis
http://www.bleepingcomputer.com/forums/HijackThis_Logs_and_Analysis-f22.html

HijackThis Logs and Spyware/Malware Removal
http://forums.tomcoyote.org/index.php?showforum=27

Spyware Warrior HijackThis Logs
http://spywarewarrior.com/viewforum.php?f=5

These forums are staffed by volunteers who have demonstrated
their ability to interpret these logs and provide safe and
helpful assistance. Also, the forums are moderated, adding a
degree of assurance that the advice given is valid. Please do
not post a HijackThis log on one of these newsgroups. You have
no guarantee that the advice given would not make a bad
situation worse.

Good luck.

Nepatsfan

 

[Guest]

Thank you for the information. My solution has always been to reformat, but
it seems like this last time the spyware somehow stayed on. Incidentally, I
couldn't find the small Dell partition with disk management. It showed only
the C: drive.

Instead of reformatting this time, I'll use the tools you suggested. If I
could only find where he's putting his files, I could delete them manually. I
wonder if he might be editing a Windows file to open an executable file
somewhere that antiviruses don't normally look.

It couldn't be my email. I don't use Outlook Express. I go to ATT and report
as spam every file that I'm not certain of. I never open attachments.

Thanks again.