This is too weird...

Oh well... you put me again to hard work typing :)

I agree with sniffing part and pattern matching. I will do it ASAP.

I agree in part with nihil, but I'd rather say I'm paranoid and I think this approach is better than having a super-ego and thinking that I must be Bill Gates to be attacked by a not-so-clever hacker that tries to break in and all it succeeds is to freeze my PC... Or is it my imagination?

The video drivers part: I don't have ATI, I have a good old Nvidia TNT 2 Ultra which passed flawlesly the 24 hours burn-in test.

About DoS: I'd try to simultae an attack from another PC in my network, as I already said. Can you recommend a good, reliable flooder software? :)

Thank you again for you valuable advice. I'll keep you posted about what I will find out.

Cheers.

Quote:

---

About DoS: I'd try to simultae an attack from another PC in my network, as I already said. Can you recommend a good, reliable flooder software?

---

Mini-Me err... I mean "TS" has already told you to run a sniffer but you ain't done it. You'd think that you would have already done something like this days ago if it where really important to you and since you keep constantly pushing for it to be one thing, bark at about ten other people for pointing out another not to mention how blatantly stupid this thread is.

Its clear that you've made up your mind with the way your going about things. So it makes sense to say that everything that has been said so far was only for your amusement. Well what can I say, enjoy.

What program are you running for your stress test? Forgive me if you already posted it, but I scan the posts for key words and skip the bull. Anyho, I use a program called PC Check version 6 which is very good at detecting hardware issues. Not having an event makes me believe you are having hardware problems. I would pull any PCI cards you have and run one at a time to rule out the other. Also look at placement of the cards (like is the modem card near the AGP) these can cause issues. Last but not least replace the NIC...

As I said earlier, here's what I've found and done so far:

- installed Commview 5.0 to monitor traffic
- set Security log for failed/success logins/logouts
- stopped all automatic updates for all rezident software
- changed all passwords
- rechecked for trojans, viruses etc
- rechecked all firewall rules and tried to flood/attack it (hey, many tools outthere :) )
- stopped all services and run them one at a a time to find the culprit...

Did I miss something? Guess not...

So here are the findings AFTER I've done all the above:

- So far the system is stable :)
- There were 2 failed login attempts on both admin accounts I had!!! Well that popped my eyes out. Maybe you can advice what should I do from here to catch the thief

About the program for stressing hardware devices: check http://www.passmark.com

Cheers

Quote:

---

Yes!!!! And I thought I was the only one... I'm using WinXP SP2 plus all the updates with an ATI Radeon 9000 card. When using the mouse to, say, seek, or click a menu, the whole desktop freezes (no mouse, no keyboard) and the only way out is the PC's reset button. The XP is a relatively clean install (two weeks old).

---

Interesting,,,, you could be Rooted.. that is in light of what you have just said..

I have a VNC prog on many machines at work.. they are set that the local mouse and Keyboard are disabled when a connection is active.. this is to stop the user ****ing me around when I am remotly accessing the box....
Now many RAT's will do this.. your comment earlier is the machine.. LOCKED.. is it locked or was it kbd and mouse disabled?

now with the failed logins.. were they local or remote?
who else has/had local access to the box?
..
When you used comview.. was it on the suspect box ..or another machine sniffing the Network traffic in and out of the suspect machine?
if the access attempts were external.. you need to start some where.. an IP.. (if the person is smart it wont be their IP.. but they may not be that smart)

Hi masster I take your point about the constant state of seige that we are under. I too have firewall logs exactly like you mention.

These are automated scans and are robotic in their nature. Suppose one of these got through? Even if it were corrupted on installation I would expect it to attempt to contact its "mothership" or "botmaster" on a rather more regular pattern than you describe your freeze outs?

Also you have run scans and found nothing?

This is what led me to mention "motive" and "attack" which is a far more personal thing. You are at a university and students are quite likely to mess with hacking tools or even play pranks/practical jokes on others. You don't have to be a "Bill Gates" to attract this attention, a mathematics lecturer will do nicely :D

What puts me off this theory is that they would be freezing your system. That draws attention to the problem, which would not be what they wanted? If it were a joke then I would expect your mouse pointer to have developed a mind of its own, your screensaver to be a very realistic blue screen of death, and your wallpaper to be grossly obscene? They would want to "let you know" that is how their egos work. ;)

Und3ertak3r has given some excellent advice as usual, so please check it out and answer his questions.

I will leave you with a few links to free software. Please download them, install and update them, then reboot and run them in SAFE MODE In particular try A-Squared as that is a specialist trojan and dialler detector :)

http://www.emisoft.com/en/software/free/

A-Squared

EWIDO:

http://www.ewido.net/en/

That's a good multipurpose malware scanner. The interactive bit only works for 14 days but the updates and on demand scanning last forever.

You might also like to look at Win Patrol, it is good for checking what is running, manipulating startup and running processes and stuff:

http://www.winpatrol.com

Cheers