Printable View
Twice in the last six months an unknown computer has shown up on our home network. We had a machine running ME that may have been hacked in some fashion, plus 3 XP boxes. What might have allowed them to actually set themselves up on our network (behind a router/firewall and zonealarm (may have been inactivated on the ME box). If the network is cleaned up now what would it take for someone to set themselves up again and how can I secure against this.
Wait hold on, huh? First off, I take it your network is wireless, no? Second, when you mean appear's on your network, what exactly do you mean? A whole other box? Trace that IP's location and see where it's coming from to determine what exactly it is. I need more specific information to help you.
One other odd thing when I type: run - cmd - it seems that I used to go to C:> prompt now I get C:\ Documents and Settings\(my name)> Maybe this has been but I don't think so.
That's alway's the way it is because it goes to the specific drive file on your network. Whatever your logged on as (or logged into with) it will say that when you go to C:/ at the DOS prompt.
In response to #2 on the ME box I went to the network connection area where it shows icons with something like a pipeline and folders off of them. The forst time the extra item was called some name that included one of our stste university names. The second time I deleted it too soon to notice but it was diffenernt than the first time. No my network is hardwired LAN
hmm....very strange indeed. Is it a new user (in documents and settings, with all files showing-a new folder under users that you can't explain)? or a new computer on the network (shows up in enumeration and can be pinged from command line)?
Are you on a Domain?
Are you an administrator/using administrator account?
Does it have a name?
Open cmd prompt and use ping, nbtbstat, nslookup etc to gather info if you can.
Just some thoughts....
Faqt- It was a new computer on my network listed with the other 4 in the "my network places" window (I wish I had at least written info down but I was so startled that I deleted it right away). Hasn't happened since it unplugged the messed up ME box.
Have you emptied your recycle bin?
Could it have possibly been a shortcut to an ftp site? Those sometimes appear in my network places.
Is it anywhere on the ME box? (as a standalone...not on your network)?
if it's not still there to gather the info about, there's reallly not much I can suggest.
hold on.....
" Hasn't happened since it unplugged the messed up ME box."
Do you mean since you unplugged?
Faqt- Yes I unplugged. Tell me more about FTP sites showing up as part of network. These do not go away. I may have been to an FTP site trying to get some historical info. Why would it stay and look like it was part of my network?
Faqt (or anyone)- One final question I backed up 3 files onto another machine on my network a couple of months ago. Two of them show up as regular files and one shows as a network file (don't think it did when first backed up). When I try to open it it asks for a password. I have never password protected any files. The reason this concerns me is the file name makes it look like the file has potentially interesting data (unlike the other two backed up files). Is there a work around for password, it wants user name and password.
Do this....
-Open your network places....make sure you know what is in there right now.
-close network places
-open this url with Internet explorer:
ftp://ftp2.freebsd.org/pub/FreeBSD/
-Scroll to bottom of page, double click on README.TXT
-close notepad
-open network places....there is now a shortcut to this ftp site in your network places.
Is that the same as or similar to the one you're concerned about?
If it happens in the future, don't delete it until you've examined the situation and gathered info...then you'll have a starting point for searching for an answer.
General first steps any time something is suspicious or concerns you....
-run spyware/adware removal tools ('Adaware' and 'Spybot-Search and Destroy' are two of the most commonly used programs. Both can be found and downloaded at http://www.cnet.com )
-update your virus definitions and run a virus scan
-Something to remember about hardwired LAN's.....remove the wiring and there's no connectivity. If you're concerned, unplug the cable and collect the info you need without having to worry about it.