POSSIBLE HACK...PLEASE, PLEASE HELP!

Annie

unread,

Jul 20, 2008, 7:26:02 PM7/20/08

to

Three days ago, I had RoadRunner (cable internet connection) hooked up. The
tech turned off both my firewalls and DIDN'T tell me!! (Shame on me for not
checking.) Today I was surfing and all of a sudden all my programs opened up,
one by one.

What does this mean? Wash I hacked? Did someone just get all my personal
information? What should I do at this point? (I'm running virus software
check right now.) Please help!

Thanks,

Annie

Leonard Grey

unread,

Jul 20, 2008, 7:38:48 PM7/20/08

to

Write back after your virus scan is done.

---
Leonard Grey
Errare humanum est

Shenan Stanley

unread,

Jul 20, 2008, 7:49:30 PM7/20/08

to

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Go through everything... Carefully and with it disconnected from the
internet as much as plausible (use a thumb drive or something to get the
programs to it.)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Annie

unread,

Jul 20, 2008, 7:53:37 PM7/20/08

to

Shenan,

What am I looking for?

Annie

unread,

Jul 20, 2008, 7:53:38 PM7/20/08

to

Leonard,

The scan didn't show any viruses. I'm now doing the AdAware and Spybot scans.
How could I find out if someone hacked into my computer? Is this possible?

PA Bear [MS MVP]

unread,

Jul 20, 2008, 8:07:48 PM7/20/08

to

We can empathize with your panic but if you must make identical posts to
multiple newsgroups, please cross-post one (1) message to all of them.
Thank you.

Multiposting vs Crossposting:
http://www.blakjak.demon.co.uk/mul_crss.htm

======================

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Annie

unread,

Jul 20, 2008, 8:20:01 PM7/20/08

to

Sorry for the second post...it was unintentional. I guess I clicked on the
wrong group.

Annie

unread,

Jul 20, 2008, 8:44:03 PM7/20/08

to

I just did a search to see when my files were modified. (again, not sure
what i should be looking for but this is suspicious.) Everything was
modified today, 7/20/08 with all different times. Most of them are 6:53 pm.
????

What does this mean? I certainly didn't modify everything. Now I'm really
worried.

Annie

unread,

Jul 20, 2008, 8:59:00 PM7/20/08

to

I just tried to restart my other computer and it was taking forever to boot.
It's never taken that long. I just shut it down manually. Guess I'll have
to take in in tomorrow.

My main concern isn't the computer but the fact my personal information was
taken.

Leonard Grey

unread,

Jul 20, 2008, 9:02:19 PM7/20/08

to

You need to show your computer to a professional.

---
Leonard Grey
Errare humanum est

Annie

unread,

Jul 20, 2008, 9:42:08 PM7/20/08

to

Unfortunately you're right. Thanks for replying. :)

Kayman

unread,

Jul 21, 2008, 3:49:03 AM7/21/08

to

On Sun, 20 Jul 2008 17:44:03 -0700, Annie wrote:

> I just did a search to see when my files were modified. (again, not sure
> what i should be looking for but this is suspicious.) Everything was
> modified today, 7/20/08 with all different times. Most of them are 6:53 pm.
> ????
>
> What does this mean? I certainly didn't modify everything. Now I'm really
> worried.
>

Kaspersky's AVPTool is excellent for detecting keyloggers!
http://downloads5.kaspersky-labs.com/devbuilds/AVPTool/
There's no updating involved since the scanning engine is updated
several times a day and you simply download the updated scanner whenever
you want to do a scan.

Also:
Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Please, do *not* post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is required in any of the below before posting a log

http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29
http://www.thespykiller.co.uk/index.php?board=3.0
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://forums.tomcoyote.org/index.php?showforum=27
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.spywarewarrior.com/viewforum.php?f=5

Good luck :)

PA Bear [MS MVP]

unread,

Jul 21, 2008, 11:07:18 AM7/21/08

to

I'd adivse you to stick to your thread in micosoft.public.security
newsgroup, Annie, and ignore this one from now on. You're confused enough
without having to moniter various suggestions/recommendations in 2
newsgroups! <w>