Printable View
What is the best way to follow a hacker from inside your computer to where they are to obtain their IP address? I believe someone is doing screen shots of what I am up to. I want them blocked out (along with everyone else). Any good freeware out there for this?
"netstat -a" should give you a list to all the machines that are connected to your machine.
well netstat will show what connections are made to your box,
get a firewall is probably the best advice you can get, dont let them attack you its that simple really
dont attack back report them to [email protected] or [email protected]
i2c
Each attacker is unique and therefore each remediation/forensic process is different. This is similar to asking, "Which roads will that car drive on and how can I tell who the driver is?" See what I'm getting at?
Rather than reinvent the wheel, simply search the site for best practices in securing whichever OS you are using. Also, look at the hundreds of posts on removing back door programs and trojans. If you feel that someone is actually using a remote control tool or trojan then you would be much better served stopping the problem unless you don't care about the integrity of the box.
Perhaps a bit more information would inspire us to give you a more informative answer geared specifically to your issue.
--TH13
try using a honeypot trap...as for keeping them out...virus scan w/ new defintions then firewall.
tiny personal firewall or black ice defender are both great firewalls as for a honeypot im not sure i have never used one before.
well right now when doing e-mails and spread sheets i hear a click and an hour-glass by my pointer. when i shutdown the programs my computer starts the background running, like a virus scan. I don't want to attack them just keep them out!!
Go to Zonelabs and download the free version of ZoneAlarm. Install it and watch for the incoming and outgoing connections. That'll tell you where it is going and this will help determine if he has access or whther it is an automated system that calls home on some kind of schedule.
Make a note of all the information Zonealarm gives you, sanitize it and post it here. Then we can give you better advice.
very cool. i am on a cable modem so i know this is the biggest problem. i just need to keep them out.
Hi Astroflux13,
Sorry to give you negative vibes, but security is pretty complex. Is your machine physically secure...like can other people get to it?
If the answer is "no" then you might like to search for AdAware6.0 and Spybot Search&Destroy,
download and update them, re-boot in safe mode then run them, and let them kill what they find :)
Do the same with your antivirus package. Or go to Trend Micro or Panda (or whoever) and run their online scan.
Now ring your cable company and ask them to change your IP address..........I am assuming that yours is fixed, being that it is cable?
This might just get them off your back.
Good Luck
BTW if you have a cable modem, please check the instructions and change the default password if you can :eek:
Johnno
since the guy seems to be in already. best bet would be to remove the system off the network and then install adaware, spybot s&D, update antivirus, os update, firewall. then run scans using adaware, spybot and antivirus to pick up anything. if you can get your hands on a trojan scanner that would be good also. once that is done remove all the offending stuff. also check if there are any tasks or programs running that shouldnt be from teh task manager if urs is windows or the equivalent. also change all passwords on the system to someting more difficult to guess then install and configure your firewall. and liekone of the guys has said, if possible get ur isp to change your system ip addr.
see if this helps in the next few weeks...if it doesnt and it is really bothering you, then the next thing would be a reinstall of the system. but i dont think this is necessary if you takethe write precautions.
Thank you to everybody who has posted for me. I am going to try everything in order. I might just be paranoid. I really hope I can be as helpful as everyone here soon. It really seems that everyone that has posted is very up to date with their stuff. I can only dream of being this smart. I guess I really need to buckle down and experiment....Thank You to everyone.
You could always try this article from AO: How To Be A Profiler but it's a lot of work.Quote:
Originally posted here by thehorse13
Each attacker is unique and therefore each remediation/forensic process is different. This is similar to asking, "Which roads will that car drive on and how can I tell who the driver is?" See what I'm getting at?
Steve
If you are trying to keep out the intruder, following the suggestions of the other posts here is a good start, but from your description it sounds like your system has already compromised. Intruders can leave any number of trojans on a system that may, or may not, be recognizable by virus scanners. Trojans can automatically append to services in order to bypass firewalls as expected programs, disable anti-virus and firewalls, or even contain a logic bomb that executes, after a given amount of tiem, if the trojan cannot communicte with its parent.Quote:
Originally posted here by Astroflux13
very cool. i am on a cable modem so i know this is the biggest problem. i just need to keep them out.
So unless you are seriously intrested in attempting to gather intelligence on an existing intruder.......I strongly recommend that you consider reformating the system, and then re-building the system as secure as possible from the ground up.
Between nihil and OverdueSpy i dont think i can sleep again
I am running Zone Alarm Spy sweeper Adaware and win patrol . After running all these programs is it possible to have your system comprimised.
Yes.Quote:
Originally posted here by MrDoscy
Between nihil and OverdueSpy i dont think i can sleep again
I am running Zone Alarm Spy sweeper Adaware and win patrol . After running all these programs is it possible to have your system comprimised.
Something written by the hacker that these programs don't detect can still be there.
A good hacker can mess up Zone Alarm, Spy Sweeper, Adware, netstat and Taskmanager etc. etc. so that they don't even report problems when they do detect them.
Steve
Hi,
1. The main problem is that most detect and destroy AV/AT software is reactive. It relies on the threat having been identified and included in what it detects so it is vitally important that you UPDATE regularly. Most have an automatic or easy update feature in them. The good guys are always going to be one step behind the bad guys. I am afraid that is a fact of life.
2. Try to run your detection software in "safe mode" with your internet connection unplugged. This can prevent some malware loading. As Steve has said, some of them will try to kill your defences.
3. Check what is running when you boot up normally. Has your AV and Firewall been switched off, and when you run the AV, does it take a reasonable amout of time or finish almost immediately?
4. Make sure that your AV options are set to maximum security. That is heuristics = ON, scan all files = ON, scan compressed files = ON, and so forth. IMHO partial scanning is worse than useless...it gives you a false sense of security.
5. A lot of malware will try to alter the Registry. Go to http://www.diamondcs.au and get their free Registry protection software. This will warn you of attempts to change the Registry. If you are loading new software/updating, you can expect this. If you have just been reading your e-mails, visiting websites etc and you get a warning say "NO". If something doesnt work after that just try it again and say "yes" :) YOU NEED TO INSTALL THIS ON A "CLEAN" MACHINE
6. Go to http://www.spywareinf.com/~merijn/index.html and get his "Hijack This" and "Startup List". THESE DO NOT IDENTIFY MALWARE SO BE CAREFUL. They will show you what is running on your machine and getting started up with it. As Steve said, Task Manager can be compromised as it is an obvious target.
7. Go to http://www.swatit.org and get swatIT v2.1..............another spyware/trojan detector (free)
8. Go to http://www.wilderssecurity.net or http://www.javacoolsoftware.com You want SpywareBlaster and SpywareGuard. Might as well try to stop them getting in? rather than trying to catch them afterwards. Preferably load these onto a clean machine.
Just a few ideas to tighten things up ;)
Good Luck
just out of curiousity, do you even know for sure that its a hacker yet? you really havent given us that much information. personally, the first thing i would do is start on layer one. unplug yourself from all networks - physically - just to see if you still get the clicking noise and stuff. if you do, then youll know its not anything going on over the net like someone watching you.
one side point, if you thought that someone was watchoing that machine, you really should have used a different one to post about it on the forums. were you try!n9 to intimidate th3m or something?
Jedi Master....................once again....................please do not use the funny spelling...you will upset people.
Disconnecting will only stop noises if they are caused by a SUCCESSFUL connection attempt. If it is just what happens on your machine, I am afraid that it will tell you nothing...I will click away, even if it cannot "phone home"
No, our friend was not trying to intimidate anyone.............I always wanted the hackers name, address, social security numer, licence plate number, and a recent photograph.............I collect those sort of things because I am interested in history :rolleyes:
Good luck folks
Screenshots? you sure someone is'nt getting in using something like pcanywhere or backorfice? Just asking cause I'm wondering why anyone would break into a computer to take screen shots.Quote:
Originally posted here by Astroflux13
What is the best way to follow a hacker from inside your computer to where they are to obtain their IP address? I believe someone is doing screen shots of what I am up to. I want them blocked out (along with everyone else). Any good freeware out there for this?