Help remove cracker

My friend has a 5 month old Windows XP Home system and knows basically nothing about computers. It is being actively used at all times (in-use light never stops). It was seriously loaded with crap, and it still is.

I've removed what I know to do with Norton Security/AV, Spy Sweeper, CC Cleaner, Adaware, The Cleaner, Registry Mechanic, and a few I knew to do on HijackThis. Put secure passwords on everything. There were none!! Cleaned up Services, made setting adjustments in the Network, the browser, changed browser to Firefox, did Windows Update, updated all security programs, removed some crap applications and informed her of the dangerous browsing/downloading habits they have. (Kazaa, P2P, shadey web sites, you name it).

It's very slow for an Athlon64 3200+, 2.0GHz, 500MB RAM. It's on DSL, only one computer. Can somebody look at the HijackThis report if I post it? What else can I do to remove the cracker? She never made a backup CD of the OS, so making one now to reinstall with would just put the same crap back on. Is it possible to get rid of this guy? Thanks!

Download MBSA 2.0

http://www.microsoft.com/technet/sec...2/default.mspx

run this it should help you out alot.

Get a firewall

-Could be spyware/virus
-Could be norton (its a pig i hate it)
-Use hijack to kill everything thats not needed on boot like quicktime, realplayer and others that are fine to have on the machine but really aren’t needed on bootup, also if you don’t feel able to use hijack look for autoruns, basically the same thing and its got a built in google lookup, and you can just disable the exe instead of deleting them if you don’t know what your doing.
-Pull un-needed/use programs from ad/rem progs.
-You could also wait until is slow and open up taskmgr and see what’s eating up all the cpu or ram. That might give you some incite as to what happening.

I agree with Ghost_25inf, but I would mention i would skip a software firewall like zonealarm or norton if youve got the cash get a decent router. I'm not one to have firewall apps on my machine to bog them down when you can get a router to shoulder that effort among other things.

Hope that helps some.

Quote:

---

Can somebody look at the HijackThis report if I post it?

---

Post it and we can look at it for you.

cheers

You might also want to defrag if he is installing/uninstalling a lot... I am assuming you went through msconfig. Update drivers (more of a stability issue, but usually helpful). My 3200 was kind of slow when it had 512MB, upgraded to 1024 and made a pretty noticable difference. That is all that comes to mind right now

Quote:

---

Can somebody look at the HijackThis report if I post it?

---

Yes.

Quote:

---

What else can I do to remove the cracker?

---

Wheres evidence a 'cracker' is on the system?

Quote:

---

Is it possible to get rid of this guy? Thanks!

---

??? Open command prompt and issue net user this will show you all user accounts.

Getting back...I've done some of the suggestions, have a few to go, only have so much time to spend on it.

Computernerd22 asked about cracker evidence... Well, the activity light in front is on all the time. In fact, it goes like crazy, flashing very bright quite a lot. This goes on 24/7 and when nobody is even near the computer. It's not on a network and none of the security programs are running checks or updating. It's a very active machine. What else would it be??

A few years ago this exact thing happened to me when I didn't know anything. I had the same flashing light for months. Whoever cracked my system was using it for a server and had loaded a bunch of apps they used to make bootleg software. They wrote notes to each other about their progress, using their names even, that I found in files! It was creepy watching text appear on my screen that I didn't type! My backup OS CDs were worthless because it was OEM and I made them when they were already inside. One app they loaded was described as "A Ruthless Killer of Windows." They had 4 users passworded on my Norton, none of them were me. Eventually my system was under their total control. I was madly copying files onto CD, trying to get proof onto CDs, when they shut down my CD and DVD ROMs. I use Linux now, it's hard, but I hate M$.

Norton sucks, it's so confusing and it doesn't work too good either. It came preloaded. I'm going to remove it, attach a router, defrag, update drivers and send in the Hijack report soon as I can. MBSA only showed one thing, a .NET update that was an old one. Really weird because I already ran all the Windows Updates. I'll get more RAM on there, too.

Do you think it's a good idea to install Zone Alarm in addition to the router?

dmorgan said "assuming you went through msconfig," Not sure what you mean by that.

I'm still really worried that all this won't get rid of the cracker. He's probably loaded non-malware programs on there that are running even if the Norton is set to block internet activity. Is there a way to find them? That's what my cracker did, anyway. Reinstalling is not an option because there are no CDs, making them now would bring the cracker's stuff right back. Any other ideas? ..... thanks so much!

Quote:

---

My friend has a 5 month old Windows XP Home system…

---

Quote:

---

Reinstalling is not an option because there are no CDs…

---

Anyway, formatting is a great way to cure the problem, however it appears that your friend doesn’t have the OEM CD’s.

Not really laughing at the situation, but cleaning all the crap out and getting the deviant out of your knickers, could most likely damage some important files, not counting any changes the deviants have made to the OS. Sometimes it’s not recoverable, thus another need for the OEM CDs. If a restore point was made upon original install or shortly thereafter, at least the core files can be restored. You can check this easily enough. It always assigns a date to the restore point.

We have several great tutorials and threads on cleaning all that kinds of junk out, so I won’t post what is readily available on AO. Just a note in case you forget while using the info in the tutorials, almost everything will need to be done in safe mode.

Installing Zone Alarm now (after the gate as been left open and the cows are out in the wild weed) can be helpful in stopping outbound traffic/connections and close the ole gate. But seriously, if the cracker is worth his salt he can “Camouflage Applications” to make it look like something that is normally accepted by the rule sets of the firewalls. Normal Web traffic is an outstanding example of this. Another easy method is to mask deviant code to fool the firewall or even disable it. So at this point, you’re in damage control vice prevention. Unplug it from the wall until you get it sanitized. Then before putting it on the Internet, employ the preventative measures.

cheers

I really do not understand why people leave computers on "24/7" without a valid reason.

Apart from the fire risk, and the cost of electricity, there is the thing sitting as a target. And why leave it connected to the internet?

If you don't want someone trying to use your machine as a server, don't make it available all the time ;)

computer can be slow that deppends on that got some problem in RAM.

try to log on in failsafe mode and look if computer is still slow. if so you will need to test RAM.

for that you can try http://www.memtest86.com/

Drive light blinking can have other reasons. One of them being the indexing service. The other being the virusscanner.. Or even pagefile swapping..

Unplug it from the internet and see if it's still blinking.. Or look at your network traffic.. Configuration -> Network Connections. Double click the active network connection. Look at bytes transfered/received..

splatch: Try Blacklight by f-secure... and also rootkit revealer at www.sysinternals.com. Do a port scan on your friends computer... look for any odd ports... if you see one, google it to find out what different possibilities there are for that port being open.

westin

Hi splatch,

If the hard drive light is on continually, then there is probably a lot of disk I/O going on. I would download "Filemon" from SysInternals (http://www.sysinternals.com/Utilities/Filemon.html) and have a look. Filemon should tell you exactly what's being read and written to on the disk, in real time. A very useful tool.

And if you really suspect someone (a cracker) is on the system, do a "netstat -n" at the command prompt and look for any suspicious established connections.

- Uncle D

Quote:

---

Originally posted here by splatch They had 4 users passworded on my Norton, none of them were me. Eventually my system was under their total control. I was madly copying files onto CD, trying to get proof onto CDs, when they shut down my CD and DVD ROMs. I use Linux now, it's hard, but I hate M$.
[/B]

---

I smell a rat. Why would you leave your machine on the internet if you knew it was under their control?

I'm with Nihil on this one,

The biggest problem i find with non compter savy people is that they just leave them on all the time. If its not in use pull the plug! :eek:

My cable modem comes with a standby button so when i'm not using the connection, i just turn it off. The very first thing that i would do for your friend is to check for a standby button on the connection, and if it doesn't have one then make sure that they know how to pull the connection out when they're not using the net. This can either be at the wall or behind the back, and if neither of those are accesible, buy a second cable, one from the wall, one from the PC, make sure both are long enough to reach to the open and then you can disconnect there. Cheap as chips! :D

You'll find that if these people don't have ready access to the PC, depending on what they are using it for, they might just move on to some other poor schmuck. Once that is done you then need to start cleaning. Make sure that you are not connected while cleaning, duh, and then post a HJT log so people here can look at it.

I had a 900Mhz with only 256mb of ram that ran like a dog with XP Pro, (nothing else loaded, just xp) i then stuck another 256 in and it runs like a dream now. So with norton etc loaded your 500Mb could easily be taken up, do you hear the hard drive churning a lot, if so you definately need more RAM, basically if you here it churning regularly it means your ram is full, if its silent then the RAM is probably enough. Also go and find a RAM monitor that way you can tell.

Anyway good luck with it. :)

That is a lot of machine, though I am not sure you know exactly what it is

Quote:

---

... 500MB RAM ...

---

Is that accurate? All guesstimates need to be stated as such for accurate analysis, failure to do so indicates lack of understanding. But to what extent also needs to be understood.

Quote:

---

Well, the activity light in front is on all the time.

---

What is meant by this ???

Is it the hard drive light? Or is it an ethernet connection?

If it is the hard drive light, it could be a hard drive problem, a software problem, or include the below.

If it is an ethernet connection light, it could be a software problem, indication that the box has been rooted, is being used as a remote bot, a proxy, a spammer, etc., or normal activity ..... my cable connection receives constant incoming connection requests, scans, broadcasts, etc.

If it has been rooted ....... reformat, reinstall, period.

If not, post the logs ( which you haven't to this point ) and maybe someone could actually help.

Quote:

---

Well, the activity light in front is on all the time.

---

There are a few things that could mean IKnowNot covered a couple of them but have you thought of just you basic stuff i.e. virus scan. I know you said she hasn't done anything but most everything machine has a basic virus scan (Norton, Mcafee) that comes with the computer are you sure that is not running in the background.

I would not jump to a conclusion and say that there is someone on there tinkering. But I would pull the plug on the system get off all important files and try to save what is remaining with the OS if XP is needed. Finally the best way to run a "gremlin" scan is in safe-mode.

start > run > msconfig

MS help here