Hacker question

The are several detectors available on the web. look for BO ( Back orafice or Netbus detector some of them have built in detector which can help you track the ip address of the intruder).
2. You can use Mcafee firewall to stop and track down the ghost.

3. Update your virus scanner most of the virus scanner are capable of finding BO previous versions. Try using Norton with a all file option instead of the usual execute only option.

Hope this will help

The first thing I would suggest is to go and download ZoneAlarm and install it on her system. It is free and pretty much sets itself up. Then the only way someone can use her system over the Internet is with her permission. You can get the program here: http://www.zonelabs.com/ Hope this helps you out. Jerry

People often "ghost" especially in yahoo and on AOL. If she is connected straight to the net through an ISP she needs to inform the ISP of the activity. Next I would suggest a visit by you, not her (she'll be scared to death), to L0pht Heavy Industries' website. These guys are THE (and I repeat THE) guru's. There you will find the info you need on BO. Finally, make certain your AntiVirus software is current. Scan ALL files and make sure she knows not to ever ever disable the icon in the systray. It's sad that people do this thing, but maybe you can stop this one from doing it to her.

I have seen a similar hack program using telnet. Make sure that the ports that you are not using are disabled.

You want to catch him/her?
1) Go to the police and ask them to help in getting the info from the ISP. They hack her computer; then they must have an internet connection; and the IP will reveal their connection. And the logging and info in the ISP can track the source of control.

2) If you want anti-hacking program: you can try "The Cleaner" from moosoft or others.

Back Orifice is detected by all the major virus scanners.

In order to install Back Orifice, or any similar program that I've ever heard of, you have to have physical access to the computer. I would first question all the practical jokers in the office.

Does she have any other messaging software installed (AOL, MSInstant Messenger, IRC, PCAnywhere, etc.)? Try to uninstall it. It may not be a hacker at all.

Unfortunately, unless he contacts her repeatedly, there is nothing you can legally do to him for simply opening a chat window that was already installed on her computer.

Back Orifice is actually 100% legal and is available at http://www.cultdeadcow.com/tools/bo.html

It may be BO, sub7, netbus, BO2K, or another trojan.
BO does NOT require physical access to install, as it can be sent inside a trojaned file (movie clip or game). It will install while the "game" or "movie" plays. You can detect back orifice from changes it makes to the system.
The BO setup:
1. Installs the BO server in the system directory (c:\windows\system) either as
" .exe" or a specified file name.
2. Creates registry key under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
with file name of the server and description field of either "(Default)" or specified description. The server listens on UDP port 31337, or specified UDP port. You can configure a sniffer for network traffic on the default UDP 31337 port. In order to determine if you are infected:
1. Start regedit(c:\windows\regedit.exe)
2. Look at key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
3. Look for services not intentionally installed on the machine and check file size of executables (BO is about 124,928 give or take 30 bytes).

To determine password/configuration of BO:
1. Use a text editor (notepad) and view the server exe file;
2. If thelast line of the file is '8 8$8(8,8084888<8@8D8H8L8P8T8X8\8'8d8h8l8', the server is using default configuration;
3. Otherwise, configuration data is last part of this file, in this order:
[filename]
[service description]
[port number]
[password]
[optional plugin information]

BO can be removed by deleting the server and its registry entry. You should back up all user data, format the hard drive, and reinstall all operating systems and software on the infected machine. However, if BO is on your machine, it may be part of a larger security breach. You should contact authorities in accordance with your site security policy.

the first thing to do is to go to ms dos prompt and type the command netstat -a this will tell you all
the connections you have on your PC , it would be best to do this after shutting down your browser and any IM apps such as aim, ym,
icq as not to get confused with other connections . If you find someone connected on a suspicious port then it is time to take action .

The next command to type is netstat -n this will give you the hackers IP number and with this you can
trace the hacker back to where he or she has come from . A little trick I learned by accident , that will allow
you to get the hackers icq number is, placing their IP number into your browser e.g. if there IP number is
255.255.255.255 then you would do this http://255.255.255.255 and try and connect to it . If the intruder has
icq99 with the icq home page enabled then you will be able to retrieve there icq number from the message
center on their page . ( note this doesn't always work )

Once you've done this then disconnect , don't stick around on the net any longer , the longer you stay online
the more damage can happen . Run a good virus scanner and a trojan scanner immediately and try and
remove the trojan straight away .

After finding the trojan and removing it you may want to trace the hacker back to his/her ISP , to do this
you need his/her IP number ( you should write it down when you do netstat ) .If you have the IP number of
the intruder then take it to this site www.samspade.org you will be able to find out all about the intruder
including information about the administration of there ISP , which you can email with your complaint. then get a personal firewall, ZoneAlert is a good one.

This question was closed by the author