-
My WinXP box got r00ted?
Recently I noticed whenever my machine was connected to the internet it would start sending as much data as it could. After I noticed this I switched off the router it was behind and started poking around the registry and my software firewall. I noticed that my Norton Personal Firewall had had an administrator password set on it. I always set OS level passwords, but I never use application passwords. Also, I use the NT style logon for XP. I was not even able to enable the firewall (it had been disabled) because of the password. I'm not sure what would have caused this and it has driven me to a new level of paranoia. Hopefully it was spyware or an update I missed. I keep my Norton AntiVirus up to date automatically and do Windows updates every week or so. I of course totally reformatted and wiped that drive and now I am up and running like normal. Does anyone know anything that could have caused this, for example, any kind of popular malware? This is another reason I use my Apple running OS X 10.3 for anything financial or extremely private.
-
I would definetly do something to re-enable your firewall, although if something was done once it can be done again. So I would do whatever you have to do to get that running, even uninstall then reinstall it. Then scan for everything you can think of, spyware/adware, viruses, registry, etc. Does anyone have physical access to your computer that would play a joke on you or would do bad things to your computer? I would also backup all your data. Just watch out for anything out of the ordinary like new folders, check your processes running via ctrl+alt+delete. There are tons of threads floating around this place on things you can do, check out the search utility. Good luck.
-
I reformatted my system partition after I realized it had been severely 0wn3d. I keep all my data backed up all the time on DVDs and isolated hard drives. Also, nobody has physical access to my computer. I lock it everytime I get up from the desk. [Edit] New Idea: My wireless was wide open at the time. However, none of the other machines on my network have any symptoms of being rooted and the machine that was rooted is does not have a wireless NIC, therefore it is not directly on the wireless section of the network. Just to call to mind another possibility.
-
its very possible that someone was able to get into your system and change the firewall password, especially if you had open ports to begin with and whoever penetrated your system simply turned off your firewall then was able to more directly access your computer. i would suggest checking this site out https://grc.com/x/ne.dll?bh0bkyd2
scans your comp for ports and vulnerabilities, definatly helped me lock down my system
-cheers
-
I think I am going to go back to running Zone Alarm Pro. I went with Norton's firewall for a while but I did notice it had a nasty habit of leaving ports open.
-
Quote:
Originally posted here by Pasty
I think I am going to go back to running Zone Alarm Pro. I went with Norton's firewall for a while but I did notice it had a nasty habit of leaving ports open.
Oh dear God no. Zone alarm pro sucks. actually all of their products suck. It's not very secure, and it isn't exactly on the list of stable software either. Macfee firewall seems to work well for Windows machines. I would recommend that. You can set the number of pings, either dont allow a responce, or even to set a maximum number you can recieve per second, and a few other things that make it worth the few bucks it costs.
Just whatever you do, don't go back to Zone alarm.
-
If you're going to use a software firewall, use Sygate's. It's the best I've seen.
-
I'll second the Sygate.
I run it on two of my machines right now.
Just a thought, pardon me if it's stupid, is it still considered "rooted" if it was a _Windows_ box?
-
Yes, windows boxes can be rooted also. APIHijack comes to mind, but there are others.
Pasty, a firewall doesn't just "leave" ports open. It functions according to the rules you specify. And it doesn't really sound like you got rooted, but you really haven't given enough information...it sounds more like spyware. But I could be wrong.
Mandrake, for grins and giggles, do you have that list of stable software you are talking about? I'd like to see it, because I had some compatibility issues, but other than that, it worked just fine, easy to configure...
-
Umm i have a question about your title of the the thread was "My WinXP box got r00ted". I was wondering why you choose that title but u didnt mention anything about being rooted in your question? And are we thinking of the same meaning of rooting. ohwelll!!!! I would definitly put your firewall back up, and i would check to see if you have any open ports. Then change your password !!!!!!!!!!!!!!!!!!!!!!!!
-
I would get to know the sysinternals line of tools. Get some of their free tools. Like the tcpview, or the pstools, and the procexp.
Also get and learn to use Cain from Oxid.it These will let you know who knocks and who comes in.
My guess is that you're paniking a bit and that you PC just got infected with a lot of adware, malware and simmilar. Be more cautious downloading and installing free stuff. Get to know your services(disable the useless ones) and your registry, and you'll have a better grip on your box.
-
Quote:
Originally posted here by groovicus
Mandrake, for grins and giggles, do you have that list of stable software you are talking about? I'd like to see it, because I had some compatibility issues, but other than that, it worked just fine, easy to configure...
Even though Ive used ZoneAlarm(years ago) in the past without problems. With all the reports comming from people on AO. I would not trust it,too many people have personally made statements on how unstable it can make your machine. But here are some polls from brodband /dls reports.com. Groovicus Ive been comming here for awhile http://www.dslreports.com/forum/security,1 . Just hit on the polls and reviews to the right of the K9 units.
-
I never heard of Windows having a root account.
-
There are so many wonderful posts here that show people what steps to take no matter what phase your in from prevention to forensics. A packet capture of the flurry of traffic you stated your box was sending would have been usefull as well as firewall logs and Windows auditing logs if those were enabled. Better luck next time I guess.
-
I will second the notion of using McAfee's firewall software it works very well and keeps things locked down. If you are using Windows you always have to be prepared to protect it because Windows is so easy to mess with. Now if you use FreeBSD that changes.
-
As for the ranting about Windows not having a root account, I know. When I use rooted I mean owned by someone other than me. I'll try out everything other than ZoneAlarm to try to lock down my machine. I know Windows is horrible on security, that is why I run Unix based Mac OS X for anything crucial. I also don't think it was any popular spyware because after it was happening Spybot Search & Destroy and AdAware 6 (both updated with the latest definitions) found nothing.
-
Did you have SQL server running on your machine? I know that SQL server will sometimes suck all your bandwidth trying to broadcast as fast as it can. Just an idea.
Adiz
-
If it is enabled by default in XP Pro probably, I never turned off any services. But that still doesnt explain the password being set on my firewall. Any reccomendations on what specific services can be disabled?
-
I'm going to go throught the routine, someone asks about what services to disable in XP, then I say, go to www.blackviper.com , it is a really good site that helps you get rid of unnecessary services. Go there and feel better about your system.
