intruder alert? or am i just paranoid?

Hello All:

I have a PC running WinXPP directly on the internet. It is running the WinXPSP2 firewall and has all current updates. It is runing FSecure AntiVirus 2006.

Occationally I find that the time has been set to one hour ahead. Or the date has been set to one day ahead. Also lately I have noticed that the IE cache size is being changed from 1Mb to 675Mb. These things do not happen daily, maybe every one to two weeks (and they dont all happen at once, just one at a time).

Is there a virus or other malware that will do this? Or is there an intruder?

If it is an intruder how do I go about capturing their IP address when the pc is unattended?


Thanks,



PS: There is no imortant data on the pc it is just used for internet browsing.

You shake your PC down for viruses and spyware? Try the online scans like Panda or Trendmicro for a second opinion.

Not sure about the IE cache, but typically cache sizes will vary.

The time issue: it's not typical of viruses and spyware to do that. Probably the CMOS battery. How old is that thing?

dreadnought0067,

if you have a program running to bypass the windows validation check (or WGA as some people would call it), it plays around with the date in the bios which disturbs the date and the time in the system.

as for the IE cache, you can reduce it from control panel>internet options.

plus...what programs are you using to check to check for malware/adware?

I have FSecure running for antivirus, it is supposed to be running daily. FSecure has antispyware, but it isn't the bet.

The pc is a PIII 550, so it is getting old.

As for the version of windows, it is a microsoft msdn version of winxpp.

I specifically set the IE cache to one MB and it will increase itself to 675Mb. (this just seems really odd to me.)

I am about ready to scratch the HDD and restore from my image backup.

Greeting's


Just to be sure have you enabled AUTOMATIC SYNCHRONIZATION OF TIME ? If, yes that might be the cause of your clock being set to a new time automatically.

If you can post a hijackthis log here be sure to remove your username from the log

Or even try replacing the battery on the MB, and see if that fixes the time/date problem, like you said the Pc is old, so maybe the battery is on it's last legs and needs a replacement..

As .:front2back:. suggests, the CMOS is generally powered by a small watch battery, usually a CR2032. Pretty easy to do.

Quote:

---

...if you have a program running to bypass the windows validation check (or WGA as some people would call it), it plays around with the date in the bios which disturbs the date and the time in the system.

---

You learn something everyday. I didn't know that. There is a file that will disable WGA if you're willing to dig around. I haven't needed it so I can't remember the name of it.

Wow, a 1 mb IE cache? That's pretty small. Try setting it larger, say 500 mb's to see if it keeps flipping to a larger size.

Greeting's

One more thing just because your clock got reset or the IE cache size increased on its own doesn't mean you pull out your backup and format and restore. Paranoia is good to a certain level because it keeps you on your feet and you might just spot an intrusion but too much paranoia is like what you have said :

Quote:

---

paranoia deep destroyer

---

Anyway don't worry too much get to know the cause of the problem then get a solution out.

cheers and be safe. :)

this system gets re-imaged quite often anyway - every time demo software expires.

replace the MB battery... I havent had to do that in years. the last time i had to do that we were using those big lumpy black things (386/486 era).

you reimage your machine to refresh your demo software?

system has a new battery. i will see if that helps.


i occationally reimage it to get back to a new install of windows. it is an old system just used for testing and surfing and playing.


i have thought about trying to use restore points to extend some demo software, but i havent tried it yet.