Windows Forum

Ask something
Discussion Locked

hacked???

0 helpful
15 replies

by tio80

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Backgrond first: Have 30 computers on nt4 lan with bdc & pdc. We are behind a Linksys nat router. Sat down at my computer, it is a win xp box with service pack 1 and is hosting WS_FTP Server, and discovered that I could not open the "services" control panel. Upon further investigation after I calmed down i found I could open only "data sources" in the administrative tools folder and was locked out of computer management, event viewer, local security policy,performance and services. Also I cannot open "Add and Remove programs" or run "mmc" from the command line. I did not change anything in the local security policy it was working fine one day then I was locked out. A virus scan (Panda) was negative. The questions:Has anyone seen this problem? Does a repair from the media disk seem appropriate? Does anyone have a recomendation or ides on further investigation. I have hit a wall. I dont want to rebuild the pc but will if I can't solve this problem.Feel free to contact me and thak you in advance for any insight.

15 replies

by tio80

Poster rated this answer.
Under current admin. logon I cannot access event log or open services to reach a restore point, but the idea of using alternate admin logon is a good one. I do not want to bring the ftp site down now but will persue this later in the weekend. On the chance of the log on working what is your suggested course of action? Thanks!! will advise

by tio80

sgt_shultz---logged on with multiple admin accounts both domain and local with no change

by mikex

Boot from the XP boot CD and try to restore previous point
You can also try the recovery if you did a recovery disk

by jdlp

try to get to system restore through a side entrance run "help" and search for system restore, this will give you an option to open it up!

give this a try, might help!

by albert franco ii

Rebuild the system in order to fix this problem and at the same time dump Panda.

Panda is the cause of at least 20% of the virus and antivirus related work we do in the shop. No self respecting expert would recommend Panda. (only salesmen that get the juicy margin for moving it).

Check out BartPE to make a start up cd capable of cleanly scanning the drive without relying on the hard drive for any start up files. Or pull the HD and mount it as a slave in another computer and use McAfee, Norton, F-Prot, or trendMicro to scan it. An anti-virus is like a condom or brakes for your car--you really shouldn't trust second level products!

I have seen at least three viruses that can block access to the functions you mention. They are damned hard to get rid off. They contaminate a ton of files as well as plant a great deal of hooks in the register. One instance took over twenty hours to eradicate. It infected almost every html document on the machine with a very stealthy code that allowed the original html to display while installing a new instance of its self in the background. The key was that all of the infected html files had grown by over 70000Kb. It had hooks in the registry, win.ini, system.ini, and several other ini files.

That's just one of the three bad boys.

Do yourself a favor--don't trust the Panda scan, it's not reliable.

by tio80

Thanks guys, for taking the time to answer! A rebuild is always good (after it is over). I tried to divide the points between everyone but am not sure it worked. The crux of the problem for me was how to determine what caused this issue in the first place, since i'm sure it couldn't be operator error :) Albert if you have more info on viruii causing this type of problem feel free to contact me. Sgt, thanks, sorry if you didn't get points. My fault.

This discussion is closed to new replies.