Offline

Greetings all.
The internet cable company has locked my modem. It seems that my computer (the one I'm constantly on my wife to turn off when she isn't sitting in front of) was hacked and was a spam spewing bot. I'm offline for the forseeable future so I'll try to catch up when I'm at work...

 

Which brings up a good question. How do you know your pc is a spambot without waiting for the ISP to shut you down? Any of our IT guys know?

 

Take precautions to protect your Private Information. If they had the ability to hack-in like that ... Identity Theft isn't too far behind.

Change your Passwords and notify your Credit Card Companies!

 

Well, there's always things being loaded at startup that shouldn't be. Another clue would be the activity light on the modem going crazy when you're not doing anything.

I realize knowing what should be loaded and what shouldn't takes a bit of know-how, plus a heaping tablespoon of geekiness, but hey...

First thing I'd do is remove the hard drive from the machine, hook it to a second, and start running virus scans. Then start combing through the windows and windows\system32 directories and start killing things that don't look like they belong there. Again, this takes a bit of judgement, but if you're that worried about killing needed files, clone the hard drive first.

Next, reinstall the hard drive in the original system, boot to safe mode and run a program called "Hijack this". This will show most of what's being loaded at startup, and will let you remove the entries that load the nasty bugaboos. Then I copy over and install not one, not two, but THREE antispyware programs. (Ad-Aware, Spybot Search & Destroy, and AVG AntiSpyware.) Update them and run them.

Rick: most likely whoever it was merely took advantage of an unpatched system vulnerability. Windows Update is there for a reason. For that matter, so is ZoneAlarm. Great program. I remember installing it on a system many years back, and being surprised when Notepad wanted to phone home somewhere. Turned out the machine was infected.

 

That's the worst bit of advice you could ever give a novice or even an experienced user.

The best and safest bet at this point is to format the entire hard drive and reinstall the OS and your applications. Be very careful of any programs you've downloaded or borrowed from a friend (legitimate or otherwise). Those are the number one way that systems are infected, not from Windows vulnerabilities.

 

In my experience with computers (and I have a lot) format and reinstall is the only sure fire way. I do it about twice a year.

Ever notice how a new installation is lightning fast? It's a great time to back up all that info onto CD/DVD that you've been meaning to do for years anyway. You'll thank yourself.

 

All that has changed with Vista It gets faster over the first month or so and stays fast. I've been using it since March and haven't had a slow down yet. Although XP is a lot faster initially, Vista does catch up rather quickly and can even outpace it after a bit.

 

I had it with all the Windows bugs and hi-jinks!

That why I like my new iMac.

 

You do know that Mac OS X has far far more seriously bugs and security flaws than Windows does right?

Microsoft's done real well with finding their own security problems and fixing them before someone else finds them much less explois them.

Apple took several months to even acknowledge the community revealed gaping security holes in Mac OS 10.4 Tiger, let alone start fixing them.

Of course when you're trying to support literally millions of software and hardware combinations rather than a handful, you'll always catch the most heat.

 

A novice, perhaps. An experienced user will have a better idea what should be in there and what shouldn't. If one doesn't, they should take it into someone who does.

That can take longer than cleaning up the system you have, and should be considered only as a last resort when all other avenues have failed.

Tell me, would you have dropped back and punted like you suggest if the culprit here was the Blast worm, which only requires the deletion of ONE FILE to get rid of it?

 

MSBlast is only one file that targeted broad IP ranges and automatically infected any open system it could find. This was because Windows XP did not have any firewall of any kind prior to SP1.

We're talking about a computer that has been turned into a spambot, which is usually cause by bad browsing and downloading habits, especially when an automatic incoming connection blocking firewall is in affect (SP1, SP2). And from my experience, it's very common that a system has been infected with massive amount of malware that just hasn't been found out about yet.

Malware has gotten much more complex since Code Red, Blaster, CIH, etc. They embed themselves in class id within the registries. They alter important system files (e.g. Winload.exe). Install themselves as drivers, BHOs. They'll alter the HOSTS file to redirect your web enabled applications to another site without you ever know it happened.

Now tell me, when you're looking through the 15,198 files of my System32 folder and its subfolders, how can you absolutely sure that something supposed to be there?

As far as taking longer to wipe and start over? It's a 1-2 hr process from a fresh install (a full format of an NTFS volume is not ever necessary unless you suspect the drive's reliability) to installing you application and restoring your documents if you have everything ready to go before you start. If you have a fresh completed install imaged to CD/DVD, then it's a 5-10 minute process.

 

Ah yes, the hosts file. Good point. As for BHOs, again, that's where HijackThis comes in handy. You sound like you've used it a time or three. I've run across a few instances where the nasty little bugger I was chasing edited the registry to have windows load it whenever explorer.exe started. Made getting rid of it... well... interesting.

Sometimes, you're not. Google is your friend. Do it enough times, though, and you tend to get a feel for that sort of thing.

Obviously, you want to be doing this when the target drive is still attached to the scanning system. Yes, I keep a spare system set aside for the sole purpose of either backing up/copying drives or virus scanning. It works for me. A lot of times, I'll clone the hard drive to have a working backup in case something happens.

You mentioned malware installing itself as drivers; some things I tend to look for are:

Lots of files of the same size; if generated by malware/spyware, they can either have gibberish for names, and/or start with the same few letters.

Hidden/system files, again with odd names. Sometimes, I'll write the filenames down, and when I hook the drive back up to the target system, start poking through the registry to see if the filename pops up anywhere.

Heh. Vista doesn't even bother doing a full format anymore. I've even given up doing it with XP. Cuts down on the install time with 300+ gig drives.

Documents/program data: that's one of my concerns, figuring out what to save and where it's located. I've lost track of the number of times I've had a customer want me to avoid reformatting the drive because they didn't have the install disks for a given program for one reason or another.

Why, just last week was an interesting scenario: a lady, who had an XP box that was running just fine, had her son install Vista Home Upgrade on it. Suddenly, it wouldn't boot to the desktop anymore, and it couldn't talk to the net. Problem one: her network card was too old for Vista. Borrowed a later card, Vista picked it up, tried to reactivate (it said the OS was Not Genuine) and ran into Problem two: the product key had already been used. Well, we can just reinstall XP, and.... what's that? She can't find her install CD? Great. What do we do about her TurboTax, then?

Do you use Ghost for imaging, or something else?

 

I plug my backup drive in, boot to a linux livecd (Ubuntu currently) and then "dd if=/dev/sda1 of=/dev/sdb1 bs=512"

I've actually gotten to where I refuse to perform salvage operations. I warn them that if they don't have backups, they need to get them done before they bring their system to me otherwise they won't have one. I don't have time to hunt down every single vacation photo, limewire download, porn video, or important paper for school that's lurking in only God knows what sub-folder. In fact, I just fininshed a machine that had ~180GB of 2kB zip files with random porn related names in 473 different folders on the system drive. The complaint, "Man this thing just doesn't work right anymore." That's all I had to go on.

 

Welcome to Computer Chat.
Seems more interesting than Carbs and Pods!

I hope this all gets settled soon.
Since it's a "Robert" related matter ... I'm not turning-on the Siren and Roof Lights to say that this way Off-Topic ... because, who knows, some XJ-Bikes.com Member just might benefit from reading your banter about computers and what makes them go.

Have fun stormin' the castle!

 

Oops, sorry. I'm used to hanging out at computer enthusiast forums. I'll try to keep my mind on relevant subject matter while here.

 

I'm sorry to hear your woes there Robert,
Man with all the advice here y ou'll probably be back up and running in no time.

I too seem to find the need to reformat my hard drive about 1X a year. It is one of those times where I have to have about 2-3-days to devote to the fix, what I hate most is that my computer seems to be foriegn for a couple of months untill I get it personalized again.

What I do hate the most about the whole harddrive rewrite thing is the loss of my Outlook address book and contacts and all the many saves .
I have however figured that problem out...anyone needing to know how just PM me so we can get this forum back on track.

 

Robert's problem may be the work of someone we know who has targeted the XJ owners list and XJbikes. So that's why I wanted the question answered. To forewarn and forearm XJbikes members.
I already had AdAware on my pc and last night installed AGV. The AGV got all but five tracking cookies. Spybot Search and Destroy is no longer a freeware but a free download that will scan. Seems to be the best of the three since the five left are what it found after running the others.

 

As much as this may be an off-topic thread... Just wanted to say I'm glad I didn't have to go looking through computer jargon specific forums to be reminded to backup my system .

 

I really wish someone had some jpg.shots of what a good windows task manager shoud see running in the processes. Often when I have had my computer at home bog down, I will open W.T.M. to see what the heck is going on. More often than not I see some programs that looks legit, but are doing more actions than I think they should. When I am really removed from caring I will shut down processes that I don't recognize and find out the hard way what they do. That would also be the same reason I don't mess around in the program folder to deep. Anyone hear of a spot to see what a "healthy" computer with a typical windows set up would be running?

 

Every computer is going to be different. There are so many variations on drivers and applications out there that it's hard to know what's good and what's not unless you just happen to know something didn't use to be there and you've made no changes. The best way to go about it is to look up the process name on Google. There's quite a few process checking sites out there that'll tell you what the process is and whether it's dangerous or not.

 

Right now my work computer has 32 different processes going on, but I would have to believe that about 20-25 of them would be completely the most common of stuff that everyone would have going just from starting up and firing up explorer or whatever we choose to use.

 

My Toshiba laptop had 68 processes running when boot up when I first got it. After formatting and reinstalling just the OS it was dropped down to somewhere in the 40's. That's just Vista though. XP's base install is usually 15-25 depending on the version.

 

NERRRRRRRRRRRRDS!!!!!!!!!!!!!

 

What's all this bollocks about off topic.


It's all highly on topic. A man who posts on a forum about XJbikes is on topic.

The tools we use to post are just as relevant to XJbikes.


Preventative maintenance of the tools we use is just as important as the preventative to our bikes.

Without the tools we have nothing.


Carry on Nerdites.

 

I agree. no reason to go and pick this and pick that, just redo the whole darn thing. If you're going to have the entire bike apart, might as well paint the frame....(just for comparison)

 

I can't say thanks enough for the advice fellas, I'm still out. I installed and ran AVG on the system two weeks ago and it found some nasties and killed them, I forget the names. Good advice changing passwords and such, you never know.
I appreciate the advice from any quarter, geek and non-geek alike. I'm printing this out to take home and hopefully slay the dragon. Good fortune is that my files were backed up about three months ago and nothing of great interest is on my hard drive that I can't replace. More to come...

 

Rick -

a computer is very similar to a bike... You can spend countless hours tweaking, cleaning, cussing, chasing gremlins, and eventually enjoying the fruits of your labor. Of course, if you do it for living 10 years or longer, you don't get much enjoyment out of it.

the only difference is that you cannot have quite so much fun with a 20-year old computer, unlike an XJ.

:mrgreen:

 

Why the hell not? There's quite a few games (Sierra's Kingsquest series comes to mind) that won't run reliably on a 10yr old or newer system because they were programmed to the speed of the processors avaialbe at the time. Nostalgia can be a very motivating force to find one of these old dinosaurs.

 

Mo-Slo.

 

It's not the same though.

 

Call me a retard if you like, but I just can't get my head around the new games like WOW, Halo, etc. Way too much going on to keep up with. I just sit here with my old solitare games and happily occupy myself. I also have an old casino program that I like. Boy if the slots at Tulalip paid out like they do in Casino Deluxe II, I'd be a rich boy! :lol: Besides, I save a ton on hardware. I've never bought a new computer. My old 1-gig P3 serves my limited needs nicely, for now anyway. I still have to keep my defenses up, of course, but AVG has been my friend. And I have an adoring grandson who is quite the little geek, and is happy to come over and scrub the machine for me every so often.
Good thread, though. You guys got each others backs, I see!