am i being hacked?

have been chatting to someone from a chat room in the last few weeks..during an im chat he was able to tell me exactly what song i had on my windows media player..a friend of mine reckons he is definately hacking me...I have done a trojan scan and not found anything but this friend reckons I am definately being hacked by somebody....the other night my downloads kept dropping out even on broadband. i have zonealarm on but is there anything else i should be doing? Sorry if this seems like a daft question but am new to all this!!!! Any other tips you can give me about detecting unwanted guest would be greatfully received!! thanks x

sounds like some retard script kidie downloaded some program that would tell him what kind of mp3 people were listenning to...anyways you are doing the right things, go to microsofts website and download the latest security patches, update your anti-virus, run it, check your firewall's log, also check your task manager to see what programs are running and end all of the processes that you dont know or you dont need....hope this helps, i am sure other AO members will have tons of input :)

I'm pretty sure that there's a security hole in WMP that allows a remote user to view your playlist. Try going to Windows Update and seeing if there any patches available (you should do this on a regular basis anyway if you're in charge of a Windows workstation) - they shouldn't take too long to download if you have broadband.

Make sure that Zone Alarm is up to date.

Get AdAware6.0 from Lavasoft update and run it.

Get SpyBot Search & Destroy, update and run it.

I have written a couple of tutorials on additional security measures...........have a look and try some.

Panda and PC-Cillin (Trend Micro) are amongst some firms that offer online malware scanning, They can be worth a try, as not all AVs find the same thing at any given point in time.

You must be using some sort of P2P software for your chatroom?

Please go to http://www.bitdefender.com and look in the free downloads section. They do protection tools for a variety of chatroom applications.

Good Luck

Ugh...zone alarm.

I can't exactly tell you HOW he is able to see your playlist (pwaring's notion is pretty valid), but I might know why your downloads are dropping.

First of all, sounds like you're on IRC. Not the most noobie-friendly atmosphere, but what the heck.

Zone alarm is susceptible to syn floods, causing the system to become unstable. This may cause your downloads to drop, even if you're on a broadband modem. Check more out here: http://www.securityfocus.com/bid/5975/info/

As nihil recommended in his infinite wisdom, ( :) ) get a different firewall, like PC-Cillin.

Good Luck

P.S. This may sound dumb, but make sure your "friend" isn't the one "hacking" you.

I know that you posted the same question about 2 weeks ago. Without actually looking at your box, the chances of getting the right answer is slim. I can rattle off about 100 things that he/she could be doing to get the info you say is leaking.

The only *sure* way to stop the madness is to get out your install disks and reload the OS. If anyone tells you different, then they are wrong. Any senior security person will tell you the exact same thing.

Good luck.

--TH13

Quote:

---

Originally posted here by White_Eskimo
sounds like some retard script kidie downloaded some program that would tell him what kind of mp3 people were listenning to...anyways you are doing the right things, go to microsofts website and download the latest security patches, update your anti-virus, run it, check your firewall's log, also check your task manager to see what programs are running and end all of the processes that you dont know or you dont need....hope this helps, i am sure other AO members will have tons of input :)

---

Telling him to shut down whatever he has running and isnt sure of is bad too. He may not know what system processes need to be ran and may shut them down with that advice, which would be a bad thing.

If you still believe you have a trojan, try fport from http://www.foundstone.com

Run it, and see if any peculiar programs are binding to peculiar port numbers.

I noted thehorse13's comment................this is the final and absolute solution so in the end you may have to go for it.

One last shot from me though :) Try booting into safe mode and running the AV and anti spyware that I suggest. Gore's response to White_eskimo made me think of that.

The general idea is to make sure that the damn thing isn't loading at boot?...........safe mode will quite often do that, depending on what "it" is?

Just a thought guys?

Cheers

Wow!!! thanks everybody for replying to my question....am off to bed now cos some of us have to be uo early and work!!! ; ( am really gratefull for any help...have done both a recent virus scan and a trojan scan using pestcontrol but found nothing...my computer is working fine tonight but ill keep or your suggestions in mind next time!!!! thanks guys (and girls)

Good grief.....don't wait untill the 'next' time. Do it long befor there can be a next time.

One thing I would recommend, since you say you have broadband, is to not allow any connections, that were no initiated by your computer. If your not running any type of servers, there is no reason that you would want to allow any incoming connections.


--PuRe

here's a idea, check your file and printer sharing.
Make sure that none of the boxes are ticked.
I had a similiar problem and it turned out to be my best friend that was hacking my computer, and just causing one problem after another..
So cheak it you never now that could be the problem

Quote:

---

If you still believe you have a trojan, try fport from http://www.foundstone.com

Run it, and see if any peculiar programs are binding to peculiar port numbers.

---

True, it *may* be a trojan but without getting infront of the box, none of us will ever know. Like I mentioned, the only sure solution that can be offered is to reload the OS if he can't figure out what is going on.

A good attacker will surely upload hacked versions of netstat so I wouldn't rely on *any* system info (ports and services) using the local netstat exe or such. I keep a recovery disk with known clean versions of exes like this so that when stuff like this happens I have at least a decent shot of finding the cause.

Again, trying to pinpoint the issue from here is like asking someone to guess what is clogging your toilet - it could be anything.

--TH13

:)

Quote:

---

what is clogging your toilet - it could be anything.

---

yah thats pretty sick dude :) About my shutting down any unwanted processes, i intended that the user knew what processes you needed to keep your machine running, but if the user is a n00b then here is a nice list of what processes do what (http://www.3iii.dk/pc-mod/tasks+services.htm)...by the way what os are you running?

To expand on what Hoss said. When you reload the box do _not_ have it attached to the internet. Download Zonealarm and cut it to CD prior. Load the box, make the recovery disks, load Zonealarm then attach the box and go immediately to windows update and do all patches. Then make the disks again..... Now you have a clean install and patched recovery disks and you are at a known starting point. From there follow M$'s recommendations for hardening a box and you will be in business......

Then; Be careful out there......

It would help to know what chat program you are using. All these suggestions are great and good tips, but most likely none of them will work. Are you in IRC? are you useing mIRC or some scripted version of mIRC or what? or are you in MSN? Did you install any plugins on it? It is most likely a script kiddie program that they are using and no firewall or anything else will work because it is exploiting your chat program directly.

thanks again for all your advice...like i think i may have mentioned before am really new to all this.. (and i mean really new!!!) so I have to admit I didnt quite understand all of it (sad but true but, hey, we all have to start somewhere.....)havent had any probs for a few days now, but like i said being new am trying to learn, so have printed off all your tips for future refernce and will try a couple of the dls you suggested just to double check i dont have any nastys lurking.... cheers all!!! x

Do NOT use mirc v. 6.01 anymore !!!
Do NOT trust any mirc versions not downloaded from official site.
Do NOT trust any scripts given to you.
Disable auto-get dcc

check out: http://www.moosoft.com/thecleaner/download.php

Disable auto-get dcc


i got hacked last month and that piece of **** named zonealarm asked me
when they tried to ftp with a script.
zonealarm did not save me from intrusion.
(i'm using kerio now but this won`t save you from intrusion by sripting, too)
the file downloaded automatically and was then executed after downloading,
i never set up to execute downloaded files .

so take care.
Do NOT trust anyone on IRC ;)