I Think I've been hacked

Okay I don't want to jump to conclusions or anything but I was surfing the web for sandman comics. And desided to empty the trash I colud not do this because my computer said .trash in use, at first I didn't find this att all strange but then I desided to check my firewall logs just in case and they were all GONE! I'm running a virus scan on the system and checkin if anything is changed but sofar I've failed to find anything.
Am I making any sense or do I just come out paranoid?
If I was hacked how can i trace the intruder?
Right now my only open connections are the one to internet and my messenger connection other than that ther's no trafic at all…

This is srange to me,
what do you guys/girls think?

Uhmm, making sense? Not exactly, but maybe you deleted a file and it's in the trash can, it's in use, so they won't let you delete it. Definitely run those scan's to make sure everything is okay though.

Hmm, first off, do you have your firewall set to clear its logs at certain intervals? It is odd that you cant empty your trash, I've never heard of that happening before. A good suggestion would be to think back to the last piece of software you installed/downloaded, and try uninstalling it just to see if that had a hand in whats going on.

I have my firewall clearing the logs every monday at 1:25 (It's not monday nor 1.25)
I was not deleting any files I was about to but the system just said .trash in use And I was not abble to empty it moments later about 30 sec ago it cleared just fine (I'm beginig to think this is irrelevant) and some files are also missing I have saved all the logs but even all the saved logs are gone
I'm new to security but is it possible that wile I was trying to empty the trash someone was clearing my logfiles?

scan your system for trojans,i once had such problemo and it turned out to be a trojan ho.
which could run from the recycle bin!
------------------------------------------------------------------------------------------------------------------------As far as the laws of mathematics refer to reality, they are not certain, and as far as they are certain, they do not refer to reality.-- Albert Einstein

Hackers have no real power- Just Unplug your computer.

What firewall are you using?
Download the Cleaner from http://www.moosoft.com/ .And see what it says.

I'm using the native unix firewall that ships with MACosX and have now checked for trojans and viruses found none.
This is realy creeping me out because about 40 megs of files have been deleted (mainly school realted material) and I'm starting to suspect it's someone i know from school.
Is it possible to do this and clear all logs? Or is there allways some trace left?

I would run an anti-spy promgram just in case... if you have been hacked he might have installed a key-logger etc.. on your system. (It's okay to be paranoid) :cool:

This is really strange but when I once was hacked, I just unplugged the modem and then pluged it again, this will remove the hacker from your computer unless he is using a trojan which reconnects when a a connection happens on your computer, u should also look for some anti-trojan program and run a scan to ensure that your computer is clean.

Theoboa

I'm making a guess here that you're on a school network. If you're not, then this post is irrelevant. But if you are, make sure you're not sharing your hard drive. Surprisingly, a lot of college students do share their hard drive over the network, and it gives them problems similar to this.

You've been hacked AHHHHH! Quick unplug it!

Yeah if I were you i would unplug your computer or download a firewall! thats how you can trace a hacker just get a firewall

Yeah, to me it sounds like you're on a school network too. If you're sharing any files from your computer, you're open to someone finding a way in through NetBIOS. So check to see if you're sharing files. You might only have a couple programs running, but might have extra ports open. Go to command line and type netstat -an to find out what ports are open. The Recycle bin issue. Whenever I have a problem deleting something, such as a document, I'll usually bust out the command line and delete the file that way. Or just restart in safe mode and see if I can delete it then. And if you're on a Mac.... good luck, I can't help you there, lol. peace. PM me if you have any other questions.

From what you are saying, files are gone, logs are deleted and no traces of a trojan can be seen. Well maybe you have been hacked and the hacker was clever enough to delete his tracks before leaving your system.

Was your system left unnatended for a while? You don't have to use a network connection to delete files when you have physical access to the computer...

i'm guessin that checking what connections are open in dos won't work becuase this guy is using os x if i was you i would unplug my computer and turn off any file sharing. not unsharing any drives or folders but also disabling it in the network options. i don't know much about macs but i do know that a hacker can't do much harm if your not connected to the network so my advice is unplug your computer untill you figure out what is going on

To clear this up:

I have a firewall (Brickhouse(It's a gui for opperating the firewall in unix that ships with MACosX ))
I have checked for trojans,viruses and keyloggers.
I was on my computer when this happend and even if I was not my screen saver has a password and I ALWAYS start it when I leave the computer.
I'm on a home network with a dsl internet connection. (not sharing my harddrive or anything else for that matter)
My logs are gone. (deleted)
Some of my school papers are gone. (about 40 megs)
I unpluged my computer and changed all the passwords.

I'm wondering if an atacker leaves any other trace than what is stored in the logs?

Tried to check for rootkits ??

http://www.chkrootkit.org/

Will check for changed programs..
(don't know if it works on MacOsX though.. )

I'm currently at work so I'm not able to do anything untill I get home but If something runs under unix I can run it at home :D .
Thanks for all the help so far.
I'm still trying to figure out how someone got in :confused:
And i've closed all incoming trafic with the firewall, does that help?

Hey Java,

If i were you, i would download the updates for the AV prog and other downloaded you need (firewall and stuff), then disconnect your modem then attack the problem while you are offline (well if i was that paranoid that wot i would do ;), but it is ok to be paranoid :))

Ok, later dudes...

Quote:

---

Originally posted here by tampabay420
Hackers have no real power- Just Unplug your computer.

---

Well said !

Crimina1

well that was REAL helpful, wasn't it? <-----Spineless Coward

The hacker (don't know if it's the same one) tried again only this time my firewall stopt him so I got an ip number. I noticed he/she was port scanning me so I took the ip and sent an email to the isp. They said the issue should be resolved shortly and there hasn't been any attacks since. I hope this resolves the whole issue but i'm still wondering how he/she got in the first time :confused: And if thers a trace somewhere else then the logs?

Thanks for all the help

There could be traces of the hacker still. Check the modification dates and times of all executable files, and compare the checksums, if you know what the original checksums were, or can find out.

You should pay particular attention to su, ifconfig, and the netstat executable files, and check in xinetd.conf for any unusual entries, or services that you didn't specifically start.

Of course, this might not apply to OSX. I've no experience with it, and am just assuming it is still sufficiently unix-like.

Sorry...it was I who hacked your system. I used the very little known 'flux-capacitor' exploit. I'll stop now. :D

http://www.atstake.com/research/tools/task/
TASK is a post-incident forensic toolkit brought to you by our good friends at @stake. Yes it compiles on OS X

This oughta help you gather some evidence of what happened.