LAN hacked ! Ahh!

I attend the University of Connecticut and today I found out that my computer has been hacked into by another computer on the network. The university has told me this because they have blocked me from being on the server, because i guess someone set up some sort of server onto my computer and this is dangerous to the other users on the server. They told me it may take a week for them to fix this problem because they are so backed up. Basically all i want to do is figure out how to get this "server" off of my computer so I can take it down to the computer whizzes who fix students computers here at uconn and show them that its fixed so that I can get back onto the LAN connection rather then waiting for them to do it, because finals are coming up next week and they might not have my computer finished being fixed until next week. I have very limited knowledge of firewalls and the like. All i know is that I am using a dial up connection and i wish to use my broadband connection. Please help!

First things first...

Take a deep breath and don't panic. I know it's hard because you have just found out how much you use your computer but it's probably the best place to start.

Now, we need some info to help you:

• - what is your operating system and when did you last patch?
  - if you are running windows, are you running updated antivirus software (and actively running it)
  - do you have a firewall installed and running?
  - do you have spyware detection software?
  - do you share this computer with others?
  - do you use Peer-to-Peer (P2P) software like Kazaa, eDonkey, etc.? (not interested in whether you pirate or not but rather the software can open possibilities)

That said, we can probably find out what's running with a simple command. Go to start-->run and type in cmd (I'm going to guess that you're using a variation of Windows XP). Once the command window opens type in netstat -ao. Copy and paste that into a post here, removing your IP from the posting. You've probably been "0wned" and might have a ftp server running.

Now possible reasons:

• - someone has broken in to your machine and "0wned" you
  - your infected with a worm
  - your infected with a trojan
  - your P2P, if you have any, is sharing
  - you have setup the computer with default settings and have something like IIS running

This should get us started in the right direction. :D

What operating system are you using? Then I can start asking intelligent and helpful questions.... ;)

[Edit]

Ms. M: You gotta get a life gal...... You beat me to it again...... ;)

[/Edit]

I'd start with a virus/spyware/trojan scan to try and see if some one has put a backdoor on your machine.

OK Mate, everyone here is going to need a lot more info in order to help you out.

1) What's the operating system?
2) What's your hardware?
3) What kind of LAN are you on?
4) Are you running Antivirus software (which one)?
5) Do you have a firewall?

And last, what was the name of the 'server ' they said was installed on your system? Was it a Trojan, or a p2p server? or just a virus?

Fill us in with a little more info, and somebody should be able to give you a hand.

Cheers:


/EDIT As usual, everybody else beat me to it, I am just getting to damm old. :rolleyes:

im using windows xp, ive updated my norton antivirus and it runs every night, and it doesnt have a new virus, and i download every critical security patch that windows offers me. I dont exactly know what type of LAN I am on, its not wireless i can tell you that and umm i believe is 10 megabites per second, i have spyware detection and ive run it, i use peer- to- peer software but the peer to peer software only allows people from the Uconn Network to use the program

Quote:

---

i use peer- to- peer software but the peer to peer software only allows people from the Uconn Network to use the program

---

Is this software approved by UConn itself?

they really didnt give me much information about what was set up on my computer, i believe they said it was an FTP server or something like that if i recall correctly... which makes me believe someone has "owned" my computer

I don't believe Uconn endorses the software, but from my understanding it does not take up any bandwith because it allows no outside users at all.

heres what it came up with when i did the netstat -ao thing

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Dan Travis>netstat -ao

Active Connections

Proto Local Address Foreign Address State PID
TCP DanTravis:epmap DanTravis:0 LISTENING 880
TCP DanTravis:microsoft-ds DanTravis:0 LISTENING 4
TCP DanTravis:1025 DanTravis:0 LISTENING 904
TCP DanTravis:1026 DanTravis:0 LISTENING 1476
TCP DanTravis:1029 DanTravis:0 LISTENING 4
TCP DanTravis:2667 DanTravis:0 LISTENING 904
TCP DanTravis:2869 DanTravis:0 LISTENING 1216
TCP DanTravis:2908 DanTravis:0 LISTENING 904
TCP DanTravis:2979 DanTravis:0 LISTENING 1924
TCP DanTravis:3256 DanTravis:0 LISTENING 35400
TCP DanTravis:3261 DanTravis:0 LISTENING 1048
TCP DanTravis:4332 DanTravis:0 LISTENING 224
TCP DanTravis:5000 DanTravis:0 LISTENING 1148
TCP DanTravis:7600 DanTravis:0 LISTENING 1040
TCP DanTravis:1030 DanTravis:0 LISTENING 1924
TCP DanTravis:4707 DanTravis:0 LISTENING 1048
TCP DanTravis:7979 DanTravis:0 LISTENING 1040
TCP DanTravis:11523 DanTravis:0 LISTENING 36204
TCP DanTravis:11523 adcreative.tribuneinteractive.com:1811 TIME_WAI
T 0
TCP DanTravis:11523 adcreative.tribuneinteractive.com:2589 TIME_WAI
T 0
TCP DanTravis:11523 adcreative.tribuneinteractive.com:2652 TIME_WAI
T 0
TCP DanTravis:11523 adcreative.tribuneinteractive.com:3363 TIME_WAI
T 0
TCP DanTravis:11523 adcreative.tribuneinteractive.com:4134 TIME_WAI
T 0
TCP DanTravis:netbios-ssn DanTravis:0 LISTENING 4
TCP DanTravis:2508 VTOT.proxy.aol.com:11523 TIME_WAIT 0
TCP DanTravis:2653 VTOT.proxy.aol.com:11523 TIME_WAIT 0
TCP DanTravis:2716 VTOT.proxy.aol.com:11523 TIME_WAIT 0
TCP DanTravis:3250 DanTravis:0 LISTENING 10580
TCP DanTravis:3250 berp-de06.dial.aol.com:13784 ESTABLISHED 10
580
TCP DanTravis:3256 64.12.25.212:5190 ESTABLISHED 35400
TCP DanTravis:3261 unknown.sagonet.net:6667 ESTABLISHED 1048
UDP DanTravis:microsoft-ds *:* 4
UDP DanTravis:isakmp *:* 716
UDP DanTravis:1034 *:* 1076
UDP DanTravis:1645 *:* 904
UDP DanTravis:1646 *:* 904
UDP DanTravis:1753 *:* 1076
UDP DanTravis:1756 *:* 1076
UDP DanTravis:1758 *:* 1076
UDP DanTravis:1759 *:* 1076
UDP DanTravis:1760 *:* 1076
UDP DanTravis:1761 *:* 1076
UDP DanTravis:1762 *:* 1076
UDP DanTravis:1763 *:* 1076
UDP DanTravis:radius *:* 904
UDP DanTravis:radacct *:* 904
UDP DanTravis:ntp *:* 904
UDP DanTravis:1032 *:* 904
UDP DanTravis:1033 *:* 904
UDP DanTravis:1085 *:* 904
UDP DanTravis:1862 *:* 216
UDP DanTravis:1900 *:* 1148
UDP DanTravis:3754 *:* 35400
UDP DanTravis:4182 *:* 364
UDP DanTravis:4205 *:* 1892
UDP DanTravis:4596 *:* 904
UDP DanTravis:ntp *:* 904
UDP DanTravis:netbios-ns *:* 4
UDP DanTravis:netbios-dgm *:* 4
UDP DanTravis:1900 *:* 1148
UDP DanTravis:4595 *:* 904
UDP DanTravis:ntp *:* 904
UDP DanTravis:1900 *:* 1148
UDP DanTravis:4594 *:* 904

C:\Documents and Settings\Dan Travis>

Quote:

---

I don't believe Uconn endorses the software, but from my understanding it does not take up any bandwith because it allows no outside users at all.

---

Go check UConn's AUP. I wouldn't be surprised if this is the software they are having issue with. Most Universities and Colleges won't allow P2P software not because of bandwidth issues but because of copyright issues. Try uninstalling that and asking them again. Also, you should do the netstat command just in case something else is running.

Well would that program be considered and FTP server? All of my friends use the same program I use and no one else has ever been blocked from using the internet connection here on the server. What could be the problem?

Can you contact anyone there and ask exactly what it is that they don't want on your computer/network. With this info we should be able to help you uninstall it?

Cheers:

I contacted Uconn and they told me that the only way, for security reasons, that I would have a server on here would be if I connected to a P2P network that was outside of the schools server, which I do have but never use or leave connected, or that someone had set up an server on my computer by hacking into it. I dont understand how someone could have hacked past my updated antivirus software and somehow set this up on my computer but i really want it off, whatever it is, so that when i go home and use cable modem at home someone still doesnt use my IP address at all. I am so lost, please help a lil more!

Now lets see here, you say you do use P2P outside the schools network? Now they say they don't want you using P2P, so I think it stands, the application they want to delete is your P2P application. (even if you don't use it on their network).

Now am I reading this right?

Cheers:

I used the P2P nearly a year ago, I dont believe this would constitute the immediate block i've received.

Anti virus doesn't stop anything but viruses...... Trojans, malware, spyware and other hacks are generally not detected by Anti Virus programs..... So, having AV doens't mean you can;t be hacked..... It's actually irrelevant until someone uploads a virus to your machine....

Quote:

---

I used the P2P nearly a year ago, I dont believe this would constitute the immediate block i've received.

---

Doesn't mean that you should be able to use it. It just means they have potentially detected it. (if we go along the lines of it being a P2P issue). Sometimes random checks are done and perhaps they found you. Removing it for now at least might get you back your high speed access. You also need to figure out if there are excess processes running (potential trojans?). You might want to look into TheCleaner from Moosoft.com as many AVs miss some trojans.

In addition, I have to agree with Tiger Shark. Anti-virus is just a layer of security that looks for malicious programs. This won't identify attacks (usually an IDS) or prevent attacks (usually a firewall). You need to spend some time locking down your machine before you go and put a firewall on (putting a firewall on a machine is like putting a bandaid in front of a dam with multiple leaks --- it only deals with one issue). You might want to look at the NSA's Windows XP Security Configuration Guide (don't let the fact that it's the NSA fool you... it is a good guide) as a "recipe guide" on securing your box before you add the additional layer of a firewall and, possibly, an IDS.

Thanks so much for your help. The Cleaner from Moosoft.com helped remove 3 viruses and the description of one of the viruses was exactly what was happening on my computer. I greatly appreciate everything.

1...go to this site http://www.iss.net/security_center/a...xploits/Ports/
and check your open ports.

2...also, this site http://www.simovits.com/nyheter9902.html
will give you most commonly used ports for trojans and worms.

3...next, in a cmd prompt, run nbtstat -s... this will give you your netbios connection table and you can check to see if there are any remote hosts connected.

if you notice that you have an open port that is a commonly used port for trojans, post a reply here and someone will help you remove the trojan.

late

This may be out in left field. But, Correct me if I am wrong here guys and gals. But he said he is using XP. Why can't he use his help and support stuff and run a system restore. After which he uninstall this p2p app. Update his AV, and any patches that maybe lost due to the restore. Technically wouldn't this remove anything he hasn't added?

I realize this would not fix his security issue if in fact it was compromised. But it would be a good place to start. So he can get back online and download some tools localy for further tests.

Be sure you have some boot disks made for the pc prior to a restore. Make sure they have the drivers for your cd rom also.


Be safe and stay free