Windows Forum

Ask something
Discussion Locked

Fighting unauthorized remote control

0 helpful
9 replies

by dmont

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have some computer settings being remotely changed. I am sure it is internal and I think, but I am not absolutely sure, the intruder is using netbios. How can I safely disable netbios and is there a way to trace the activity back to the desktop creating the problem?

9 replies

by lyf

To safely disable netbios, I would refer you to Gibson's excellent "Shields Up" site, in specific the section on "Network Bondage"
(http://grc.com/su-bondage.htm)

Then, use his Port & Shields scans to ensure that your machine is really locked down.

As far as tracking is concerned, enlist the services of your network/security admins if you are in a corporate setting.

If not, then install and use a great (and free !) personal firewall, such as ZoneAlarm (http://www.zonelabs.com).
Ensure that "logging" is enabled, and that you have set Security settings high enough to detect your intruder.

Couple ZoneAlarm with ZoneLog Analyzer from http://www.zonelog.co.uk/ . This is another excellent and free tool that helps you understandand report intrusions.

Hope this all helps.

by dragonfly

Sounds like you are in dire need of a FireWall.

Check out the Gibson Research WebSite for a product called ZoneAlarm. It is free and very powerful.

Also, this site will test your system for security leaks.

Shields Up!
https://grc.com/x/ne.dll?bh0bkyd2

The site goes through a detailed explanation of Internet Security and how this relates to you !!!

Page 5 (Network Bondage) in particular, talks about NETBIOS and closing "your system to all NetBIOS name and resource sharing leakage"
http://grc.com/su-bondage.htm

Good Luck.

KR

by paidhima

The above replies are excellent ways to get your system relatively secure. To disable NetBIOS over TCP/IP, you might want to try getting into Network Properties, and look in the options for your TCP/IP protocols for the option to enable NetBIOS. Make sure this isn't checked.

by wizkid0109

first check to see if it is in the startup directory on your computer. Goto start then programs then startup, if it is delete it. If that doesn't work goto start click run type in "msinfo32" this will take you to a special program that controls mostof your computer be very careful and only change what i tell you to. go to tab called tools scroll down to system configuration. click startup tab go through those files and anything that looks weird uncheck it(anything that u might accidently uncheck you will be able to re check it by repeating steps from above. anything you uncheck will not be loaded during windows startup it will and should disable the netbios program, which should fix your problem

This discussion is closed to new replies.