Security

Ask something
Discussion Locked

Unveiling a hacker..or just paranoid??

0 helpful
9 replies

by bob123

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

For good reason I understand my home pc is being hacked - I believe by an IT programmer at work. I am not in their league in this area so I need help.

I have been advised to down load start up cop to check my initial start up programmes which appear to be disabling my Norton antivirus start up scan. But i am not sure which programmes to disable - I don't want to creat boot up problems. Every time I am on line my Zone Alarm Pro reveals Net Bias (?) approaches and a range of FTP attempts to various ports (port 137 last night for example. I understand that alot of traffic will show initailly on the firewall - but it has been in place 6 months!! and the attacks are happening when simply downloading email - not only when surfing. I have also downloaded pest patrol and the mapping programme Virtual Map. Interestingly when I try to check Whois on Zone Alarm at each attempt- my PC is going offline immediately...am I paranoid....??? I think there may be some form of trojan - but I am struggling to get at it...I need peace of mind...please help!

9 replies

by techserf

based on what you have said, I offer this simple solution:
1. unplug your computer from the cable or dsl modem.

2. get a clean boot disk with delpart.exe and wipe your entire hard drive. make a new partition and format it.

3. keep your pc offline for now, install your OS. if 98/Me, don't allow file/print sharing. if 2000/xp, rename the administrator account and set a strong password. then make a user level account for your day to day use. log in as this.
also, disable netbios over tcp/ip. in 2000/xp, set services like telnet to disabled. also, go here: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q288164 and follow the steps.

4. install zone alarm (free or pro) set to high

5. install norton

6. bring machine on line, download ALL windows updates and virus defs

7. in outlook express, go to tools options security, check don't allow potential virus files
if you use MS outlook 2000, go to office.microsoft.com and run all the updates for security.
8. open windows explorer, tools, folder options, show all files types, show file extensions

9. log off the admin account, and only use your user level account.

10. do not accept any files over instant messenger or icq.

11. go to analogx.com and download script defender

you'll be safe with this set up.

by techserf

based on what you have said, I offer this simple solution:
1. unplug your computer from the cable or dsl modem.

2. get a clean boot disk with delpart.exe and wipe your entire hard drive. make a new partition and format it.

3. keep your pc offline for now, install your OS. if 98/Me, don't allow file/print sharing. if 2000/xp, rename the administrator account and set a strong password. then make a user level account for your day to day use. log in as this.
also, disable netbios over tcp/ip. in 2000/xp, set services like telnet to disabled. also, go here: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q288164 and follow the steps.

4. install zone alarm (free or pro) set to high

5. install norton

6. bring machine on line, download ALL windows updates and virus defs

7. in outlook express, go to tools options security, check don't allow potential virus files
if you use MS outlook 2000, go to office.microsoft.com and run all the updates for security.
8. open windows explorer, tools, folder options, show all files types, show file extensions

9. log off the admin account, and only use your user level account.

10. do not accept any files over instant messenger or icq.

11. go to analogx.com and download script defender

you'll be safe with this set up.

by techkid

the first answer provided a lot of good tips. You will see probes on your machine all the time. The port 137 probes are somewhat normal. Disabling Netbios over TCP/IP should resolve that. Internet worms such as klez, Code Red and Nimbda are still around and they could be hitting your computer looking for holes. If you're running file sharing programs (Morpheus, iMesh) your firewall is sure to go off while running those. An occasional alert from your firewall is normal. Start tracking the IP theprobes are coming from.

by madmark

You are probably being paranoid, and observant. It is unlikely that the 'IT boyz' have found you out amongst the huddled throng without you having either given them physical access to your PC to install the Trojan De Jeur, or revealed your IP address or system name to them in conversation.

It is too late to install a firewall AFTER a breach. The firewall will be asking you if you want to allow 0utlook.exe (that IS a zero) to be allowed to access the internet. Of course you do. It looks like Outlook. Must be normal.

Personal Firewalls will only offer you protection from known inbound attacks that you recognize, or outbound attacks that you configure them for. First time you inadvertantly let a trojan have outbound access and configure a permanent rule, you're open for business once more.

DO follow the other fellas direction and start clean. And get the A/V and F/W software on before connecting to the internet.

This discussion is closed to new replies.