My aunt has been hacked and..

Ok, I was at my grandmothers house today and my aunt was there and she started explaining to me that her computer has some problem (she's a computer illiterate). Well, the hacker first started out by when ever she would connect to the internet (through a dial-up modem) the computer would shut down. Then one day she finished using the computer and went to shut down and XP told her that she could not shut down because someone else was using the computer at the moment, that's when she started getting suspicious. The reason for this was because the hacker created an account (which she later found out when she turned her comp back on the next day). I wanted to gather some info before i go to her house to fix the problem (it's a 2 hour drive). The only info I have is the one she gave me. And also when she get's on she can only last 15mins on before the comp shuts down. So when I get over there I'm planning to first run search and destroy and all those other programs you people always mention (I'm going to burn it on a CD-RW). Since I think that she has some program installed which is telling the attacker her IP whenever she gets on. But before this I plan on doing a netstat till I get disconnected to see what hostnames are connected to the computer to then later find out the IP and whois it (if the attacker isn't using a proxy which i doubt they wouldn't be). Then I plan on reporting the hostname/IP to the ISP (don't know if they can acutally do anything about it but worth a shot) then changing her account password since she has it saved on her comp the attacker probably knows it. Then I plan on removing the created account and changing her password on the XP accounts and adding an Administrative account to create less access for her normal accounts (she doesn't have an Administrative account instead all of her accounts have administrative powers). So I wanted to know what you people think I should do besides what I have mentioned. Thank you for your time.

The netstat idea sounds good and it sounds like you've almost got everything, but maybe if you install a firewall as soon as you get onto the computer this could block the hacker? Here's a link to a sygate one :

Sygate

Also if you get this installed you can go to the site from the sygate firewall menu and there's the option of doing several scans on different parts of the PC to test for weaknesses.

I'm no expert here, a newbie myself, but i think that if you install a good antivirus, and also delete whatever temporary internet files that are there, you might block the hackers access.

Obviously though it depends on what you want to do if you don't want them knowing about the netstat you run. I'm sure someone with more knowledge will be here to help soon. :D

First thing, keep the computer offline. Run an antivirus scan, then run Spybot, AdAware, and the Cleaner. You should already know about them just from having been here.

I would advise using Grisoft's AntiVirus. www.grisoft.com It's free, and it's a good AV.

It goes without saying to delete the hackers account. Sygate is a good firewall. You need to configure it to explicitly block ports 135, 139, 435, and 439.

This will eliminate the threat of the RPC exploits that have killed Windows security.

Apply all MS security updates and have her change all the passwords.

Let us know how it goes.

All are very good ideas, how ever i think that another option would to format the Drive, then reinstall the 0s, as you don't know if the person has installed a back door of some type.?
So to make sure that everything is gone, as some programs might miss something or might not detect something, then probably a format of the drive although it take's the longest still might be the best option..

Just a thought anyhow.

cheers
..::front2back::..

forget netstat. netstat is often replaced during an attack to conceal the offending address.

get fport from www.foundstone.com. its a cmd line app that maps ports to apps and the offending app will not be hidden.

also get the pstools zip file from www.systernals.com. pslist -t will list the processes running in tree view (-t) and pskill will kill processes that windows can not (pskill <process>) so the can be deleted. look for processes with window like names running from non-standard directorys. like svchost running from drivers\etc or system32\mui and names like ntservice running from system32. this is very common. there is no windows file named ntservice but it sounds pretty good and runs from system32 to add to it credability...kill it, delete it (or rename if your so inclined)

run a complete system virus scan noteing which shes infected with then goand look in the folder that contain them. see what else is there. once a perp has access they usually install legit software thats not detected by av and rename the exe so its not real obvious in tastman or run hiden from taskmanager using third party hacker software. some favs are radmin, vnc, serv-u-ftp could be just about anything.

when your finished put a firewall on that alerts you to outgoing connections as well as incomming. i use tiny at home but many do the same thing. connect to the internet and browse for a while to make sure the firewall isnt blocking desired services like dns or an IM server and watch for outgoing alerts. incomming connection attempts are much to common to mean anything.

when in doubt, reformat

good luck!


sorry front2back you post wasnt there when i started writing mine :-)

Don't forget to check for trojans. Not sure how likely it is, but worth a check anyway. Especially if appears to be semi-randomly rebooting.

I'd have to concur with the previous format suggestions. There's no telling what else could be hiding in there that you may miss, especially if these problems have been occuring for a while. It's probably best just to format and start over...lot alot can live through that. Then firewall tha bastard!! I'm an Norton fan myself...

alpha

Quote:

---

Originally posted here by Tedob1
sorry front2back you post wasnt there when i started writing mine :-)

---

Ah it happens mate :D .

Anyhow after the problem is fixed i think that it might just be an idea to change your ISP or IP witchever it is, as the attacker might try to gain root on the box..
Either that or use some sorta program that would constantly change her ISP number, for instance when she loggs onto the net it might be
*213.54.78.145
Then it might change to
*145.78.54.213
Or something, as there's no sure protection. As there must be something important on Her box to make this Attacker to continuasly return, either that or it is a Boot Virus, were no matter what you do you carn't delete the virus, as it activates on Startup and like yeah, don't know much on that area, but really i'm grasping at straw to think of possible ideas.

Anyhow post an update when you can.
cheers
.:front2back:.

If ur grandma PC restarts every 15 minutes it is almost certainly because of a Virus .. If I am not wrong it is Lovegate.....

This virus was very active 6 months back.. It used to restart the PC after prompting...

It is fairly simple to remove the virus from the system... Give this a try first... Than if still the problem persists... u could think of her PC being hacked....

Frankly I would see no reasons why anyone would like to break into her PC.. still ask her to check her bandwith consumption with ISP .. bcos Incase her PC is used as a scapegoat for launching attacks..

BTW it was my aunt that hacked you aunt! :-)

OMG....its an aunt farm/war
I really think that it would be more of a spyware/virus thing than an actuall hack/crack, but you really can't tell untill you get there and have a look. Keep us informed please.
And you let your Aunt out again, Tedob1 ( 8(|)

except for the part about the message "someone else is connected are you sure you want to shutdown" which is what you get when vnc or radmin are being used. and another account being found on her computer id agree. i mean thats my aunts sig if i ever saw it.

If you are told someone else is using the computer AND you have a new account created it sounds like a hack to me, although I sincerely hope not.

Change all passwords for STRONG passwords (get your Aunt to write them down and keep them in a safe place if she cannot remember them) If she has internet financial activities she ought to change accounts.........report the problem to the banks or whoever are involved, and dont use the new account until you have resolved the problem. It is just like losing your credit cards...................you must assume that the hacker has found the password files and will brute force them eventually?

If you can find out who it is or appears to be (their IP address & the time date of connection) then:

http://www.usdoj.gov/criminal/cybercrime/reporting.htm

I am assuming that you are in the USA.................otherwise use your local equivalent.......

Use both the FBI and the Secret Service (If it is coming from a US IP use these wherever you live :)

They will probably do nothing, but as you have filed a report it covers your a$$

If it IS a hack, you MUST reformat and reinstall, there is no safe alternative:(

Good Luck

EDIT: damn Tedob1 I type too slow.............shouldn't have gone for that coffee half way through either..............but it is 0.600hrs here.

Many a times the sysadmin guys create a standby account.. which would not be even known to the end user.... (All the more as ur aunt is computer illeterate)....

The problem of computer resarting every 15 minutes is plainly because of a virus which was very active few months back....

I suggest instead of getting too very excited about the complete issue try updating her antivirus program and remove the virus... then monitor the comp behaviour.. if it still behaves erratically.... u have to make a choice.. do u want to store the evidience and try to catch the culprit...

Or if ur aunt really does not have much of data on her PC.... recommend that u format and reinstall the OS that would be fairly simple and less time consuming.. believe me forsensics needs lot of time and patience....

Anjali,

I think we have two separate problems here. The switching off bit sounds like you have said, a known virus. After all what hacker is going to "own" a machine then put something on it that cuts him off every 15 minutes :)

I don't think that there are any "sysadmins" involved...........he is going over to see her........all her accounts have admin rights?

You are right about forensics, particularly if the hacker is any good. Reporting it to the Authorities is easy and covers you if the hacker has used your machine for criminal activities.

Cheers

Nihil.... out of curiosoty tell me who all are the authorities to whom you can report such an incident..... Do we have any global authority for the same ?

Is it country based.... Frankly in the country where I stay.. i.e INDIA I am atleast not aware of such authorities.. so can we register our complain with an international organization or something like that....

Coz.. what you said is very true.... But I guess if it is based only on law governing authorities of country.... then users who are in countries which does not have such forums are at loss in event of our PC's being used to launch such attacks.....

Quote:

---

Originally posted here by Raion
Ok, I was at my grandmothers house today and my aunt was there

---

--- When it starts out like this you know its STORY TIME... :rolleyes:

Quote:

---

Originally posted here by Raion
Well, the hacker first started out by when ever she would connect to the internet (through a dial-up modem)

---

--- So you know it is a HACKER (This hacker must have a lot of time on his/her hands to wait for your Aunt to sign on via DIal-Up. :rolleyes:

Quote:

---

Originally posted here by Raion
So I wanted to know what you people think I should do besides what I have mentioned.

---

--- I think you should do a quick virus scan, update the patches, delete the mysterious account, run some ad-ware/spyware program, and install a small firewall. I also suggest a nice course in explaining situations without the whole story line...

Quote:

---

They will probably do nothing, but as you have filed a report it covers your a$$

---

I was reading a post where someone had posted over a year ago. He actually heard back with a generic sender thing. seems it autoresponds saying we can't do anything. that ISP was outside our duristiction at that time.

I personally think us starting our own task force to deal with these issues would be a great idea.

The AO anti Spam/Hackers/Crackers league of Extrordinary l33t super computer guys.

sounds like MSBLASTER to me, thats why its shutting down ever x number of seconds, get some AV on there and clean it up, then put a firewall on there, ie - sygate,

RPC exploits sound like the thing behind this

i2c

Interesting idea Mark, but how do we get the American Taxpayer to fund it? :)

You may get an automated response if it does not fall into the right category.........you will be told who to forward it to. For example a lot of Spam is fraud related, but there are different sorts of frauds..........some belong to the SEC (Securities Exchange Commission) others to the police. In these instances you are probably better off going straight to the IFCC (Internet Fraud Complaint Center), they act as a sort of clearing house and farm them out to the appropriate authority.

Other stuff I send to the FBI and Secret Service. Last one (19th January) got me a reply which said "THIS IS NOT AN AUTOMATED RESPONSE" and signed off by a "Supervisory Special Agent"

Obviously I only send stuff that has crossed US borders, or appears to have a direct impact on US interests.

MSBlaster?............that is odd...........it usually only takes a few minutes, not 15?

Cheers

Quote:

---

Originally posted here by mark_boyle2002
I personally think us starting our own task force to deal with these issues would be a great idea.

The AO anti Spam/Hackers/Crackers league of Extrordinary l33t super computer guys.

---

Now that would be Something, not only would this place be the PLACE for computer Security, but it would also have an on-line l337 group saving the World, from spammers and any other skiddies that might be lurking in the dark..

Oh yeah love the Avator mark :D


cheers
..::front2back::..

Sorry for taking so long to reply, don't have a lot of time on my hands. Thanks to all who replied. A lot have mentioned to update her antivirus but the problem is she is on a dial-up connection and it restarts every 15 minutes and I doubt her antivirus would update that quickly on a dial-up. And I dont live in the US so that rules out contacting the FBI. And I do plan on formatting but my aunt wants to catch whoever this is so I have no other choice as me and my brother are the computer gurus in my family (all a bunch of computer illeterates as for i only know about computers but only know a few things about security.) and i doubt it's the MSBLASTER worm don't know exactly why but I just don't think it. It could possibly be a virus since it is true what nihil said, no hacker would put a virus on somebody's computer to shut it down every 15mins. But if it is a hacker in my opinion she has a virus since she has dial-up her IP changes and the hacker is getting her IP when she gets on. And my first thought was to download a firewall for her, which i am going to do and burn on cd but the problem with formating is that she doesn't have the WinXP installation CD and no formatting disketts since her HD caught some weird thing and she bought a new one and her Win95 computer was updated to WinXP but no installation CD was included in the upgrade. and info tech geek, i would explain it without the whole story but i decided the more detail the better :P and anjali, the account appears on the log-in prompt she told me the account name but i forgot it, started with a C. I will keep you posted as to what happens when I go over there (No exact date at the moment.)

OK Raion let me get a few things clear in my mind............

1. The machine restarts after 15 minutes, it does not just shut down? [shutdowns after a set period of time can be an overheating problem, but it would not immediately restart] To make sure that there is no confusion, go into BIOS and the display manager and disable all power saving and screensavers.

2. Does the machine only restart if there is an internet connection, will it run normally if not connected to the internet? Get your aunt to switch it on (NOT connected to the internet) and leave it for an hour or two......if there is a logon screen then it has obviously rebooted, if not, then the problem is internet related. If it is a virus, it should shut down irrespective of the internet connection???

3. When your aunt got the someone else using it message, had it been running for more than 15 minutes? :cool:

SUGGESTED SCENARIO:

> I write a trojan aimed at dial up connections
> It "wakes" every 15 minutes and looks for an active internet connection
> If there is no connection it "sleeps" for 15 minutes
> If there is a connection, it "phones home"
> If I am "at home" (online) I am in!!!
> If I am not "at home" it sleeps for 15 minutes

But I have screwed up my coding, and instead of sleeping, it re-boots

I think we need a little more information on what happens when the PC is offline?

Good Luck!

EDIT: You might try booting into "safe mode with network support"...........this might let you onto the internet without activating malware. Also check the running processes and try to kill whatever it is before it re-boots you?

Yea, I was also thinking about pressing ctrl+alt+del to remove any suspicious tasks although I forgot to mention it. And, according to my aunt, it works normally offline but when it connects, 15mins later it restarts. And how do I run safe mode in XP? (I'm running 2k, and never really needed to use safe mode so I don't really know.) And, when she got that message, she only got online to check her email (which I doubt takes 15mins) then she went to shut down since she had no new e-mail messages that message came up. And the problem isn't offline instead online. The only problem is that she has an extra account which will be the first thing I try to remove as soon as I get over there, but before going to check what's in his account by changing his password (if possible). And my aunt didn't specify if it shutdown immideatly or after a period of time I will have to check that out for myself.

You're problem sounds more and more like " I have this problem, and the computer does weird things, help, and then there is some other ambiguous symptom coupled with an abstract condition and thanks for the advice but I won't try any of it because I know better"

Ok, what exactly have you tried? For starters, I'm really confused. Is it your grandmother's computer, or your aunts? Does your aunt still live with your Grandmother? Why? :D

I'll apologize now if I am reading too much into this. Info Tech Geek's advice ( and .:front2back:. ) is probably the best. Reformat, then set up everything. I really can't at all tell what the problem may be.

If you have access to another computer, download a free antivirus (like AntiVir), it will be up to date. Download any other apps you feel you may need (adaware, spybot, firewall, whatever) they should be up to date.... burn them to a CD rom and take them with you.


On the off chance that the box has been rooted (which I think possible) running netstat on that box isn't going to do you any good (reiterating tedob1) . It may have been altered. As far as that goes, cmd.exe might be corrupted too. I'm simplifying greatly, but hopefully you get the idea.

With all due respect, reinstall the OS and start fresh. I don't think you are going to achieve the results you want. You may very well have a hardware issue. I had a box awhile back that would crash after about 10 minutes...turned out that was how long it took for the cable inside to warm up enough to seperate.

You said another account had been created... does it show up on the login screen, or did you find the users icon in the control panel? XP by default has some extra accounts that are supposed to be there. Be careful.

Now I'm going to do something to earn my paycheck, drink some kind of liquid, and probably scratch myself somewhere....

Good luck.

EDIT: In retrospect, I have nothing to add to this discussion at all.... I couldn't let a little detail like that deter me though.

Sounds like a hacking task scheduler to me!

groovicious; No it's nothing like you think, the problem is that I'm gathering all of the information before I head over to her house since she lives about 3 hours away from me and she doesn't live in my grandmothers house, she was visiting and I went to pick up my little sister who was there. As soon as I get over there I'm planning on trying all of the advice you all have given me.

My Grandmother reckons she can crack both the Aunts lol

Can i just add before doing anything and connecting to the net, look at the internet properties and see if it has a disconnect time activated, quite a few companys can set these themselves like bt.

If this all seems fine maybe look in your system 32 and other common folders used by the sys that a back door could have been stored in (if it is infact a hacker), run anti virus software incase there using a known trojen. The probabilaty that there using an im alert (if infact it is a hacker) is quite high. the server file will probably be named somthing like server.backdoor.bat if it is a silly trojen, for all you know it could be some one using buffer overflows and the works in wich case formatt back to 0 and install every thing again.

Or use somthing more stable like umm LINUX!
(joke)

Hi Raion,

1. If you keep hitting f-8 whilst XP is booting it will give a menu from which you can select "safe mode" & "safe mode with network support"

2. InfoTechGeek has suggested you set up a firewall. Try burning ZoneAlarm free edition to a CD. You download an installation executable and can load the whole application offline. A new version came out yesterday :) Set it to"high" security"...........when you go online it will pop up a prompt asking if the browser can connect..........give it an OK.....BUT NOT A PERMANENT ONE!!! You may also get various apps wanting to update themselves..........say "no"............you should also get the "bad guy" trying to connect.......make a note of the IP address and the program but don't answer the message. Just click and hold on the message box and move it out of your way. [GET A COPY OF THE PROGRAM!.......we may need it for analysis purposes].

You should be able to use the internet, and the trojan proggy will NOT have had a "cannot connect message" :D ..............hopefully, it will just sit there doing nothing..............you should then be able to update, download and do all the things that have been suggested.

3. I am suspecting that you have possibly got a virus and a trojan, so try to get rid of the virus first.

4. Your aunt is using XP.................this has a remote access support facility.....so maybe you should look at this to save yourself a long drive in future? I use this box to support one in London, which is about 5 hours away......

5. Change ALL passwords!!!!!!!!!

6. Take a copy of HijackThis with you, and post the log when you are done.

7. Get SpyBot Search & Destroy and AdAware and run them.................if she has viruses and trojans, God knows what else is there?

IF YOU HAVE A LEGITIMATE COPY OF XP YOU WILL HAVE THE CD AND THE PRODUCT KEY LABEL.
If your aunt does not have these then it is a pirate copy, and may well be the source of her problems? Have a "word" with the supplier? :rolleyes:

Good Luck

Thanks, and she does had a legitimate copy of XP as far as I'm concerened, either way we are going to buy the XP installation CD to format the HD. Still no exact dates as to when i will be heading over there though. So keep on giving me as much advice possible. Thanks

Just a thought, but a friend of mine had a computer with a failing power-supply that kept blinking out and in pretty regularly, it could be possible that the shut downs are hardware related. In your first post you said that it would shut down whenever you connected to the internet.. Which doesn't make much sence for a hacker to do, but (i'm not really sure of this) possibly it could be caused by the drain the modem causes on the P.S.
As for the extra user account.. Is it anyway possible that someone created an account and started some stuff up, didn't shut it down and then did a switch user leaving the operations open. I'm not sure if XP will restore other users operations after it gets shut down or not though.
Just my 2 cents...

Raion,

It would be an idea to get hold of the free Microsoft security update CD............that will save you a lot of downloading, and can be done offline so you won't get infected whilst you are doing it :)

cheers

Nihil, I can't order it since, my country isn't listed on there. :(

Raion,

Keep checking...............first time I did the UK and Republic of Ireland weren't there.....they are now!!!

Also, you might be listed with another neighbour...........like Ireland is ordered from the same site as the UK.

Cheers

I doubt that this country will ever appear on that list because of the fact that it's a very poor country. Very few sites ship over here. But I'll see what I can do without it.