How can I tell if I've been hacked?

Just curious if there are any tell tale signs of whether or not I've been hacked? One thing that concerns me is that my CD Drive is missing and I cannot use it. I do have a firewall and anti-virus, but I am wondering if maybe a keylogger was placed on my compluter prior to getting the firewall (although I now run two spyware programs that both come up clean)? I have a friend whose computer was hacked and the hacker took info from her computer, generated an email using an email address almost identical to mine and attached a virus, then sent it out to members of a forum we all frequent. This is why I feel I am at risk. Sorry if this is a simple question, but, really, I'm not too sure how all this stuff works. Today alone, my firewall has blocked 26 Backdoor/SubSeven Trojan horse attempts mostly from different IP's so I feel like someone is trying to get in.....maybe through other people's computers (???) Also, how can I find out through tracing exactly who is doing this? Thank you very much.

Try a netstat? Im thinking your using windows.

Go to your command prompt ( Start >> Programs >> accessories >> command prompt)
Type in -netstat a
Check if any of the IPs are the ones that your firewall is blocking

You might want to try the Symantec security check

If this keeps up, you might want to contact your ISP and ask to change your IP address.

Good luck.

-Edit
You might want some anti spyware software to take care of the keyloggers -
Spybot
Adaware

Both are free and highly recommended..
Check out Wilders Security for more free anti spyware solutions.

What kind of network are you on? How long have you been unable to access your CD drive? It could be something simple like your hardware just died on you....maybe try another drive and see if it works. Other than that, if there is any other info you can pass along, the more the better. Hope this helps and let us know of any changes!

Quote:

---

Today alone, my firewall has blocked 26 Backdoor/SubSeven Trojan horse attempts mostly from different IP's so I feel like someone is trying to get in.....maybe through other people's computers (???) Also, how can I find out through tracing exactly who is doing this?

---

To find out who is doing it if you think it is someone remotely connected to the computer hitting you, I believe you would have to have access to that computer, then you could do a netstat -n from that computer to see who is connected. I don't believe you can trace it beyond the last ip from your computer. I could be wrong though.
Also, it's kind of wierd that you are getting all those attempts for Subseven. I'm guessing that it was installed before you got the firewall, and the person is still trying to connect and is now getting blocked. You should do a quick google search on how to confirm that you have subseven then another one on removing it.
Since it is multiple ip's maybe the person who put subseven on your comp(if you go by my assumption above that it's on there) told his friends so they could all use your computer to hack from. Definitely check for subseven or any other trojans on your comp and remove them immediately.
good luck

Go to The Cleaner and download the 30 day trial. Use it, and it will tell you (and remove) any trojan you might have.
If you CD problem is not related to any trojan, you might check your ribbon cables to see that they are plugged in correctly and not damaged or broken (ribbon cables are relatively cheap also).

"One thing that concerns me is that my CD Drive is missing and I cannot use it."

Assumptions - The CD Drive worked before and you are using some variant of Windows.

Have a look in the Device manager to see if any devices are installed incorrectly / not functioning. You're looking for devices with Red Cross's on, or yellow exclamation marks. If there are any this could point you in the right direction.

On bootup check in the BIOS that the CD Rom drive can still be seen. Older BIOS's wont, but certainly machines manufactured in the last couple of years tend to list them. If its listed, check to enure that Plug'n'Play is still On.

Boot into Windows safe mode ( F8 at startup - Select Safemode ) - open the device manager and delete any references to CDRoms. I have found that some CDRoms arent listed there as they are Plug'n'Play. Allow windows to redetect them upon the next normal reboot.

Check "Add New Hardware" and see if the CDRom is redetected.

Failing that .. you could always reinstall Windows :D

Its always tedious to establish whenever you think you've been hacked. CDrom device disappearance can be a simple hardware failure, or an IDE cable becoming disattached via joggling of the CPU unit. However, h3r3tic and fatphantom have a good point, netstat is a very useful tool to monitor incoming traffic hits. Now in the days of broadband, you always have those curious many that just hit random addresses to see who's open and who's not. Its not even methodical anymore, more like brute force scanning. Another useful tool to use is netmon (on windows 2000)...If you're really good at understanding just basic protocols, you can establish at what frequency, and what type of packets are coming through...although thats only if you want to take it to extremes and interpret raw packet data. Just a thought though! Doesn't hurt to be thorough.

I wouldn't think that I have been trojaned just because of a missing CD drive. I would definately think it was a problem with the hardware or a Winblows problem first. If someone put something on your computer they are definately going to want to connect to it. I would use some of the techniques from the previous posters and also if you know what you are looking for use something like Ethereal http://www.ethereal.com to sniff your traffic. You can also use Fport http://www.foundstone.com/knowledge/proddesc/fport.html to see what services are using certain ports.

Here's a thought..... The question was "how can I tell if I've been hacked"? Let's make a list of signs that either singly or together are potential signs of this problem. Then we can put them all together and sticky it in the "beginners" forum for all to see...... It'll be helpful and a good exercise..... Let's try to avoid things that could be simple system problems caused by a bad/unknowledgable user..... I'll start.... Please add to either category.

Notes prior to assessing these symptoms:-

1. If multiple people use the computer make sure none of them changed anything.
2. Listen to your computer when you use it. You'll then know when the drives are working too hard for example.
3. Observe your internet connection speed at different times of day, then you know what it should be like when it starts to go "funny".
4. If your desktop is cluttered look carefully at it from time to time so you know what is there.
5. Same with the system tray.... look at it to see if it changes.

Symptoms:

1. You changed nothing but you begin to get an error message at startup.
2. Startup suddenly takes significantly longer than it used to.
3. Your modem dials on startup or without input from you.
4. Your internet connection has been stable but is now is consistently or intermittently slower.
5. You're doing nothing on your computer but your drive lights are on too much for comfort.
6. You're available drive space seems to have reduced for no reason.
7. Icons appear on your desktop or in the system tray, apparently by magic.
8. You come back to your computer to find a command prompt open and commands in it, (or not).
9. Error messages start to appear at shutdown whenn you changed nothing.
10. Someone mentions information that could have _only_ been got from your computer.

OK.... My brain is tired.... I'm old... OK.... :p

Anyone want to add to this..... They need to be somewhat generic or every bloody windows error will look like a hack..... If you want to be specific about "what you are doing at the time" then maybe we can break it into categories and come up with a score system... You know.... Like a Cosmo questionaire.... If you scored > 10 on this you are safe.... if you scored more > 90 on this you are pwn3d...... :eek:

There are diffrent things you can do.

Normaly you can check your "netstat" program (windows users) as mentioned before to check all users on your network, mind you that you may be surfing or reciving images from a website, they may appear on your netstat.

After an attack signs may be new/removed/modified files or directories, checking the "last accessed" portion of file properties is useful on files not used by the system.

If you are being hacked you can always tracert the user and hope they aren't using a spoofed IP, this way you can keep the IP as refrence and if you see a constant attack from them on your PC, you can do one of these two things:
1. Fight fire with fire.
2. Report to their ISP.

However you should not give false attack repports since they will more then likely stop listening to you and eventualy others... they will normaly invistigate but they are corperations, and if they need to they won't waste their time on users who send them notices that one of their users are attacking them again and again when it may just be that they are not and you are doing somthing you have no idea about... but I'm begining to ramble on here, this isn't directed towards anyone (incase some one sees somthing here offencive to them).

heres a nice free antivirus if you dont already have one http://www.grisoft.com/us/us_dwnl_free.php

Hmmm..... I've seen a couple of these "use netstat" replies..... That's all very well if the attacker connects to you or you connect to them all the time.... It doesn't do any good in a lot of situations.... If the connection isn't current it doesn't exist so you can be so pwn3d and never see it in netstat........

How about installing some sort of IDS such as snort. This would solve the netstat problem of only seeing connections when you type the command. But, since it sounds like the firewall is blocking the attempts there shouldn't be anyone connectioning to the computer, although you should never think that. I really think that someone had installed subseven before you installed the firewall and now all their connections are getting blocked. It would be nice to here some feedback from you, like if you checked the cables on your cd-rom, or did a scan for trojans. Hopefully you've solved your problem and that's why there is no update on the situation.

I like to do a periodic netstat, also. The netstat -o option is very good because it will identify
domains, etc that you may be using and dispel any doubt about the addresses that you commonly are using. If you notice higher activity on your cable modem lights, It is a good time to do a netstat -a and a netstat -o. Just don't do it when Kazaa is connected or you will have a heart attack.
:)

I forgot to mention in my post to check out www.grc.com's SheildsUp! feature, it's very useful.

Thank you very much for all of your replies, I'm still trying to decipher a lot of what was said. I'm not that "up" on computers. In the last 24 hours I have now had 82 SubSeven attempts; most of the IP addy's are different, but some are duplicated. I checked my records of the past 24 hours and compared them to my friends who frequents the forum I mentioned last night as well. Four of the IP Addy's matched mine where she had also had these attempted intrusions the past twenty four hours. In fact, in the three minutes I've been typing this my firewall has blocked three Trojan attempts.

Here is some more information for you:

I did do the netstat -a and it appears the only open connections are to 127.0.0.1 and 205.188.146.146 and, of course, my IP is there too.

My O/S is ME and I am on AOL

Every morning when I start the computer, it completely freezes. I can't even use the ctrl-alt-del function so I end up just turning it off manually, then allowing it to scandisk (or whatever that is called). Of course, this also wipes out my firewall logs so I am really careful to save the logs all the time.

I believe I am missing a driver to my CD Rom. My CD Rom has always worked fine, but around the time I realized one of my friends had been hacked and the virus email was sent out using an email addy close to mine, is when I started having problems. This may or may not be a coincidence. I can't figure out how to find the driver, let alone install it.

There are a few members who particiapte on the other forum with me who HAVE received Trojans and had to reformat their harddrive.

I have noticed the lights blinking on my computer when it is not in use.

I noticed today that some of the items in my tool bar are missing which has not happened before.

I have Norton Anti-Virus and Norton Firewall which I am religious in the Live Updates. I also use SpyCop and Spybot. All come up clean.

I am the only person who uses this computer.

Okay, this one is going to show my true lack of computer knowledge, but I can't remember how to get into my Device Manager. This is all so foreign to me. But at bootup, the CD Rom IS still there.

I'm scared to reinstall Windows because won't I lose everything? I also use this computer for work and because my CD Rom has not been working, I have everything on my hard drive. The place I bought the computer from said they can look at it, but they are running three to four weeks right now and I can't poossibly be without my computer as it's my only means of income.

I did a search on the IP's today and one is repeatedly showing as "Loopback". What does that mean? It's tracing to China, but the IP trying to Trojan me doesn't appear as a Chinese IP; it begins with 61. and the "Loopback" is going to a 218. IP.

I TRULY appreciate all of your help. If I have missed something I will post again. It's so difficult to even use the computer with all these Firewall flags going off, now, I've had 12 Trojan attempts since I began this post. Again, thank you very much :)

I believe the loopback ip is 127.0.0.1 which is the localhost ip which is the ip your computer uses for connections. It's nothing to worry about because it's an ip from your comp, not a remote machines ip. for the device manager right click my computer and select properties. go to one of the tabs, i'm not sure which on ME just check them all and you should see the device manager button. I have 98 and device manager has its own tab. I'm assuming your ip is available on the board you and your friend frequent. As for the connection attempts, i wouldn't worry about them if you have a firewall and all your a/v and other scans come up clean. Other than your cd-rom not working I would say your all clear. Another tip, get winXP pro or Home, I have heard ME is the worst of all windows OS's. Also, you could get an external hard drive to back up your data, or if you're on a network you could transfer what you need to another comp.
That's all for now.

Thank you for the instructions. I did go to Device Manager and my CD Rom is NOT there, but there is info at StartUp on it. I had found out that the 127.0.0.1 was not something to worry about. I just didn't understand why a "Loopback" was being reference in the IP trace. The IP that attempted an intrusion on my computer with a Trojan is 61.172.3.25 (also same IP ending in .23). When I did the trace it gave me a "Loopback" IP of 21.1.10.178 (and also .177) registering in China. I thought maybe whoever has been doing all these Trojans MAY be doing so through other people's computers in order to avoid getting caught. I am at an endless search as to how to figure out who it is or even prove it; especially with my lacking computer knowledge :)

Thank you again, I really appreciate everyone's help :)

I wouldn't worry about it as long as you're safe. Hopefully someone else will nail them. As far as your cdrom, I hope you get all that sorted out soon. When I replaced my old cdrom with a different one, I didn't have to install any drivers, it just worked. I'm sure yours used to work also. Have you tried unplugging and replugging in both the IDE and power supply cables(of course your comp will be off when you do this, put this in just to be safe). Hopefully, if all else fails you can try installing drivers from your manufacturers website.
Good luck.

Quote:

---

Originally posted here by Drakain Zeil


If you are being hacked you can always tracert the user and hope they aren't using a spoofed IP, this way you can keep the IP as refrence and if you see a constant attack from them on your PC, you can do one of these two things:
1. Fight fire with fire.
2. Report to their ISP.

---

Attacking back is never a good idea and for two reasons. First, the ISP (or machine) that the attack is orginiating from might just be another victim, someone the attacker is using as a launching point. Attacking back could just get innocent people caught in a crossfire. Second, it's legal and is less likely to get you into oodles of trouble. Attacking back with <enter attack name here> is likely to get you frowned upon by the source ISP, your ISP, and quite possibly, some scary looking guys in dark suits and dark sunglasses.

Think first before engaging fingers...

alpha

about cdrom:
it's an old problem on 98 os to loose your cdrom.
to get it back install the dos drivers incl. mscdex ,
if mscdex line got remarked just remove the remark from the spec. line
in autoexec.bat.
boot to dos commandprompt by pressing F8 and choose that you want dos.
chegg if the cdrom works
start windows by typing "win" at the prompt.

about sub7:
do a
netstat -a -n
is your machine listen on 0.0.0.0 :27374 ?