how do you know if you have been hacked?

I know everyone here has been asked this a million times but how do you know if you have been hacked?

Here is the deal, for starters I don't know much about internet security but today this error message pops up saying that the remote procedure call was terminated unexpectedly. Now it gave like 60 seconds before it was going to restart my computer so I did not get a good chance looking over the error message I do know that it said something like NT Authorization/system? I looked up what a remote procedure call was and from what I can gather its another computer trying to link up to mine? Since it said it was terminated, does that mean they did not get in, if in fact that is what it means?

kativan

Try looking down around your ankles. If your trousers are there and you have a sore rectum you have been hacked.

P.S Read the other forums before posting crap like this.

Go to Google and type in RPC again. You'll find the answer to your question if you read a little longer.

I have to agree with Mark here. Your post lacks "meat". This is like going to the doctor and saying, "I don't feel well, do I have cancer?"

Don't worry about negative response's from some here at A/O.
Being new to computer's myself i can only suggest with my limited knowledge
to download a Personal Fire Wall to reduce the chances of future intrusion's. I
installed Sygate's P.F.W. and found it easy to set up and maintain. It has a security
log that records the time, remote host and IP details which might enable you to
get an idea of the attackers origin. Hope that this may help.



p.s. Where you looking in the mirror mark_boyle2002 ? too much info thank's.


Kativan, you might also want to read the similar threads listed below.

"Where you looking in the mirror mark_boyle2002 ? too much info thank's"

WTF are you on about. "where" ?

I'll give you a 100 to 1 chance someone tried to exploit the now infamous rpc hole.

If someone really hacked your computer (and did it properly) you would have a really hard time trying to find it (if you notice it at all that is).

it does sound like someone tryed the rpc exploit. the successful ones dont pop-up a msg they just open a reverse shell. put in a firewall so the rpc ports arent exposed and keep current up on your patches

Quote:

---

Originally posted here by mark_boyle2002
Try looking down around your ankles. If your trousers are there and you have a sore rectum you have been hacked.

P.S Read the other forums before posting crap like this.

---

Possibly the most uneccessary and stupid reply I have ever witnessed to any question from a newbie on any website ever.

Did you actually think that was funny.

God AntiOnline has degraded so badly that its scary.

Thank's for the negg's mark_boyle2002, just goes to show the the maturity that
"some" senior's like yourself greatly lack. kativan made his first post with a simple
question that could have been answered easily by any curtious person that could
help. Instead you were a smartypants. Why? Do you get off on showing you are
smarter than a newbie? Maybe you should think back when you were less than
knowledgable in this field and be more helpfull.

p.s. I think that i can speak fine english thank's, so with an attitude like your's toward
new member's maybe you should do an anger managment course and start hugging some
tree's. cheerio.

Most of the time you wont know you have been hacked if you dont have a firewall or anything running. Some one may use your computer as a jump point to get into another computer or use your computer to try and crack codes with you ever knowing.

If you are connected through DSL or Cable broadband, then a personal firewall is essential to make it harder for the bad guys to get in.

Quote:

---

Originally posted here by TidaLphasE23
Thank's for the negg's mark_boyle2002, just goes to show the the maturity that
"some" senior's like yourself greatly lack. kativan made his first post with a simple
question that could have been answered easily by any curtious person that could
help. Instead you were a smartypants. Why? Do you get off on showing you are
smarter than a newbie? Maybe you should think back when you were less than
knowledgable in this field and be more helpfull.

p.s. I think that i can speak fine english thank's, so with an attitude like your's toward
new member's maybe you should do an anger managment course and start hugging some
tree's. cheerio.

---

Tidal I'll give you some greens but I recently did so I have to spread them around. The fact that anyone would get negged for a post like this is incredible. Im going to start collecting posts like this then post a huge link of idiotic threads that will show how bad AO has gone.

I didnt get negged for this post which is odd.

Not to thread jack, but why do you have to spread them around, its like a "politicly correct" thing to do, when points should be used to indicate the worthiness of a topic, or a reply.

Quote:

---

Originally posted here by jadetiger
Not to thread jack, but why do you have to spread them around, its like a "politicly correct" thing to do, when points should be used to indicate the worthiness of a topic, or a reply.

---

The system won't let a user give points to another user without first giving points to a number of other users.. Hence, 'spreading' your points around..

Once again another thread has degenerated into antipoint wars, people bitching about antipoints etc. etc.

:mad:

So to try and get a reply from the poster, before they run away in a panic wondering WTF is going on round here with flame wars and antipoint madness...

Kativan, has any of this been of any use to you at all?

Please let us know.

This confirms how bad AO has become. I never thought this community would have come this way so far but it did.

Guys can't we just go back to how things use to be? How hard is it to just give someone direction without all the flack? How hard is it to ask someone a question before jumping to conclusions? We can all do this if we try and make this place the way it use to be. I would love that, wouldn't you?

Guidance...

ok, if they did manage to hack my computer, what exactly could they get from my computer? I went and looked at the event log and they have been doing this over 1800 times in the last 2 days.

kativan

Quote:

---

Originally posted here by kativan
ok, if they did manage to hack my computer, what exactly could they get from my computer? I went and looked at the event log and they have been doing this over 1800 times in the last 2 days.

kativan

---

They could get alot of things. For example They could run a program to get cached passwords on your machine, they can scan through documents where you may have sensitive info such as credit cards or passwords. Most likely though, they would do 1 or more of these three things. Setup a ftp server, irc client, or use your box to scan other networks for insecure servers.

While some of the comments above tell you what exploit was probably used, rpc, and what can be done in the future to protect yourself, personal firewalls, you still have not been told how to detect if something was put on your machine.

Most remote hacks involve leaving a program behind that would allow them to get back into your box in the future. Therefore, they will run a program that will start when you boot up your computer and listen on some port for connections. Then the hacker can get into your computer whenever he wants.

I am making the assumption that your box is a windows based computer. There are a few great programs out there that make it very easy to find running programs.

First one is fport which can be found at :
Foundstone

Download fport. THis is a command line program that will listen all programs that are listening on tcp/udp ports on your computer. You can then determine if something doesnt look quite right.

Another program is tcpview which can be found at:
Sysinternals

Download TCPview. This is a similar program as the above fport, but I have found that it actually sometimes finds programs that fport does not.

You can also download Process Explorer from the above site. This will list the various processes on your machine and the other processes that they spawn.

When using these tools you can find those programs that are running on ports that dont look right, or post them on here for people to see what they think.

Another place to look for programs that are added to your system is the registry. Though i dont advise you really delete anything from there unless you know what your doing a very popular key for people to put programs that run on startup is :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

That is one of the keys that lists the programs that will start when you boot your computer.
You should also check the machines services to see if there is anything there out of place.

One of the hardest trojans/hacks to detect is if they put a root kit on your box. These programs make it very hard to detect as they actually hide services, files, directory, and processes from being seen. One of the best ways to detect and see these hidden objects is to connect to your box from another machine. When you do that, you will then be able to see the hidden files/directories.

Hope this helps.

Grinler

Hey Kativan...chill out huh? Most probably there was no real harm done, or your machine would not work?

You must change all your passwords, and do NOT let your system rememember them for you...write them down and put them in a safe place, preferably locked. If someone breaks,or picks that lock...they are now in serious crime territory?...most would not have the courage. I guess you also have to assume that any personal data on your system is compromised, so theft of identity is a posssibility?

They may have loaded a whole raft of remote access stuff on your machine.............they failed their swimming lessons in the human genetic pool, so this is their way of compensating....

I would suggest that you find the PC-cillin website and run their "housedoctor" online malware detection program. Also get SpyBot Search & Destroy (you will have to find this as I do not have the link at the moment..just moved house..this is a old PII I am using!!!!) Update the detection file, then run that.

I have put a pair of items in tutorials under "countermeasures"....or something, including that...try some of the links...they may help?


Good Luck...Be Safe...Stay Safe

Johnno

Is there any way to find out who did this?

It depends on what you have on that machine, do you have something other than the event log that would record traffic/connections to your machine? If not you should install something like the win32 port of Snort (http://www.snort.org/dl/binaries/win32/), I don't know if you can use MySQL and ACID like on Linux, but Snort records attacks into the MySQL database, and you use ACID to view what those attacks were. I also have awstats (http://awstats.sourceforge.net) interprets my Apache log files, where I can see some of the maclious url for exploits coming to my webserver. On my XP Pro boxes I have PC-cillin, which logs attacks like that and has the fire wall. Of course so does my home router. If you have all the registration numbers and CD's for your installed software, reinstall the OS, patch, reinstall application software and then harden your system. Then you will know you are safe.

First for a pro hacker it dont matter if you have Dial-up, Cable or DSL. So it wont make it harder for him. IT only makes it harder for a ScriptKiddie
Second, you should have a antivirus,firewall and at least one trojan scanner.

Quote:

---

I know everyone here has been asked this a million times but how do you know if you have been hacked?

---

Well....It's sometimes simple. If many programs crash too often and you cannot run other software, then you should do a virus scan and see what you can get rid off.
If it fails to delete some files, you should end their process and delete them manualy.

while in the event log I found this

The user [email protected] successfully established a connection to MSN explorer using COM3.

what does this mean? And since I am not that computer literate, do you recommend taking the computer in for service?

about com3it means that you are using MSN as a ISP and that your modem connected you via COM3 (modem port) to MSN ... it basicly means you are online :) ..nothin dangerous

about tracing them : if you have the IPs of the attacker loggen just trace them ...http://www.antionline.com/tools-and-toys/ip-locate/ .....

about servicei dont think there's need to take your box to a service ;) ....we are everything you need

where would I find it? the IP that is

do you have a firewall .?

I think so but I am not for sure, where should I look for it if I do in fact have one?

well you could download a firewall like www.zonealarm.com or got o www.google.com and type in "download free firewalls"(without the quotes).....install it, when somebody attacks you the firewall logs the IP in a file called log.txt or something like that in the install directory of the firewall ...

:thumbsup: Great post Grinler, very helpfull and informative. I'm sure that
all who are just starting to learn how their own computers operate (like myself)
were grateful for the info. I see that you have only two posts under your belt, well
with postings like this you will be a most respected member at A/O, and maybe an
example of the high standards that this site should promote. Keep em comin.

Thanks again TidaL. :)

Apologies to all and those who got the brunt of my anger yesterday.

Ennis, Thanks for pointing out I was being an ass.

Once again apologies to all but I'm sick of seing the same forums over and over again. Do people no longer search the archives before posting.

I'm sure when I just started I got negged lots of times for asking bone head questions

Mark: I have to say that this is hardly the first time you have made inane or inappropriate posts on AO. Your longtime barrage of Star Trek posts was a wonderful example of your sometimes puerile behavior.

You need to understand when a new user asks a question such as "How do I know if I have been hacked" they probably have no clue how to search or what to search for. If they put in the word "hacked" thay are going to get a list of posts as long as their arm none of which seem relevant. Since they don't know much else it becomes hard for them to narrow the search to find something of use. Thus you will always get questions like this. Remember back when you didn't know that RPC existed or what a port was let alone a port scanner or ping sweep? It's kind of like trying to find the word for "dog" in a French dictionary..... Bit hard to find if you don't know the word is "chien"......

The title of the post was quite clear..... If you don't want to read them don't click on them!!!!

Tiger Shark,

I disagree. I believe that you should familiarise yourself with your surroundings before commiting to post. I didn't do this when I just started and got negged for it.

So I don't see why anyone else should be any different.

BTW What star wars posts ?

Quote:

---

BTW What star wars posts ?

---

Sorry, my bad..... It was the Terminator posts...... 'nuff said?

Quote:

---

I believe that you should familiarise yourself with your surroundings before commiting to post

---

Ahh..... I see..... Here's poor little Joe and Josephine Brown who have diligently worked away on their taxes and online banking and a whole host of other stuff on their computer who suddenly think that it has been compromised. But they don't have a clue as to the how, why or wherefore that it could have happened. They have no idea how computers and the internet work...... They simply went out and bought all these pretty, easy to use tax programs etc and away they went. Right now the _only_ thing going through their mind is the fact that they have probably had their identity stolen and right now their life savings are going down the drain right behind their credit rating........

Your suggestion is they pop onto good old AO and hang out for a few weeks until they "get a feel" for how to ask the question or search for information. I submit that you have never been in a situation where you have paniced.... But Joe and Josephine are in that situation right now. AO is a resource for people to use. I for one pride myself in being a contributor to AO and therefore as a useful resource to others. If we all took the attitude you took in this thread then AO would cease to be a resource and simply become a chat-house for the elite.... I don't think that is what AO is for. If that's what you are looking for their are plently of elite lists out there and that is probably what you would want to subscribe to. But then you will still see post's like this one there too...... 'cos not everyone is really elite and there will always be questions that you think are dumb.....

Quote:

---

I didn't do this when I just started and got negged for it.

---

I can assure you that Joe and Josephine don't give a flying.... well, you know.... about being negged...... They want to know if they have been hacked and what they can do about it and, more importantly, should they start calling their credit card companies, bank etc. to try to mitigate the damage.

Joe and Josephine have enough problems when they post their "dumb" post...... I think you do them, yourself and AO a disservice when you fly off the handle at them.....

That's my story and I'm sticking to it..........

That's very right Tiger Shark! I agree with that 101%... :cool:

When you're paniced.. it's like your out of your mind due to the pressure of your problem.. those people who got problem don't even have a time to search or don't know how to search... :)

Kativan , you need to install a security device , but i don't why people choose to live their gate wide open for the bad guy to intrude , well but Katvan you should not forget to close your mouth because of flies.

O.K Tiger shark.

I get the picture but all the same I still disagree.

Shall we agree to disagree ?

I believe the antipoints system is the communities way of self policing itself.

E.G yesterday I was an ass and I got negged.

The day before I helped people and got +s

The day before I wrote a bad post which was poorly worded and contained incorrect terminology and grammer. I was negged.

Can't believe I had spelling mistakes in this post (D'OH)

Mark: As I said above..... "that's my story and I'm sticking to it"...... Yeah, we can agree to disagree and while we continue to disagree I will continue to try to help people no matter how "dumb" their questions are, (except, of course, if they ask how to hack hotmail..... ;) ), you are free to be an ass to the same people if you wish but it's you you are hurting not them.

As to antipoints, yeah, you are right, it's the community's way of policing itself. But let's be a tad realistic. Joe and Josephine are gonna come in once, get the answers they need, (hopefully), and never return. They are not part of the community, they are visitors with a problem just the same as a tourist in Glasgow who has a breakdown . You don't go yelling at them 'cos their car broke down do you? You either fly by and ignore them or you try to help. It's the same for Joe and Josephine..... They just need help..... They aren't trying to become a part of your community and, as such, neither care nor know about antipoints and what they mean.

Ok I was going to leave this one alone but, I decided against it. Tiger you are right but the least a person could do whe the first come to the site is read the FAQ's I mean come on.

Now to be honest if the person where to take ten seconds they would be able to find the answer to there question with out ever having to post there question the Forums here have all types of info. If you take 5 minutes then you will have everything that you need and more. Now I will say just to play devils Advocate I understand that when you are panic you don't want to wait you want it. NOW. But that is the first hting that you learn about anything never panic.

I will help just because, I like to help but, even if they do get flamed to death and banned you can come on as a guest and read the post that people gave to your post. So they still get what they want because, someone is going to post the answer. That is probably the single greatest strength of AO so many different people so you will get the answer some way or another, even if you don't get your answer you are just about guaranteed to get a source to go to. So you can get the answer.

Whizkid2300

Whiz: They may read the FAQ's...... and if they don't know what it is they are looking for they are no better off..... These people aren't noobs...... They aren't even that well versed in computer science..... They are below noobs.....

As far as negging people who neither know nor care about antipoints..... Who's time are you wasting..... sure as hell not theirs..... But hell, if it makes you feel good to sneer at someone because they don't understand what you understand then go ahead..... I will guarantee you that the person that you sneer at would be able to reverse the situation if another subject was brought up.

Antipoints are a way of rewarding posts of value and punishing posters who prove over multiple posts that they deserve to have it pointed out that they are being an ass/pain/wally or plonker. I don't think anyone need waste their time negging someone on their first post, unless it is of the "how do I hack X" ilk...... Then I'm in there with you negging away..... :D

Yeah that is what Negs are for but come on. Be honest how many people actually read the FAQ's. But I have to go the same as Mark we are going to have to agree to Disagree. Now if a person were to ask a nice question ie. what is a proxy server? Yeah I would help them I just can't stand it when the same damn question comes up. I think I have been Hacked. It would do nothing to that person that I negger for two reasons one my points are worth much and two why would you care about points if you don't come here that often. But you need to be curtious to all. So Neg or Flame or Tell them nicely.

Agree to Halfly Disagree.

Whizkid2300

Fair go whizkid2300 come on, imagine starting a new job that you have no
experience in what so ever and asking the boss a question only to have him
frown at you, call you stupid and tell you "go read the manual". Be realistic.
I was always taught that you can never ask too many questions to advance
your knowledge in something. Why would A/O have a newbee section at all?
if everyone had your attitude this section would be useless. Maybe they should
advertise that dumb, lame ass, uneducated questions wont be answered here
due to the tantrum spitting episodes of a few high and mighty. I hope not.