Am I being watched?

[Lowfront]

I made a big mastake last night leaving ports 6880 to 6999 open last night along with my bittorrent client......


Last night I was trying to get my bittorrents going when I opened those ports.....

At some point my connection got horrible and I turned off my zonealarm seeing if that had to do with the slow connection.....

ended up leaving firewall off, ports open, and bittorrents going......

woke up turn on zonelabs when noticed it was off and it blocked 4,000 connection in a good 30min....






am i screwed?.....What should I do?....am I being watched?

 

[Lowfront]

Is this the reason for my slow connection?.....

 

[chiph]

I'm guessing you don't have a hardware firewall or NAT device?

If so, I would do the safe thing and assume your OS has been compromised. Make backups of your data files (not executables!), boot from trusted media (OS CDR or known-good boot floppy, and fdisk the drive/partition.

A bit extreme, but it's the only way to know for sure that there isn't anything lurking about. Call it the "nuke it from orbit" solution...

Chip H.


____________________________________________________________________
Donate to Katrina relief:

http://s1.amazon.com/paypage/PELYGQVJ8Q7IB/103-6821258-5919825

If you want to get the best response to a question, please read FAQ222-2244 first

 

[Lowfront]

Alright well then....

Would a simple system restore do the trick?

if not

Whats the best way to back up data?....Could I ghost is all and then use the ghost explorer and take everything out of the image?.........


And my internet has been completly down all day now...Could this be the problem?..Could they have done somthing to my router?

 

[chiph]

If you have a CD or DVD burner, use that. I would *not* use Ghost, as it would copy over any suspect files too.

Your internet connection being down might be a coincidence, or your ISP might have detected your open ports and closed the connection as a security measure. You probably need to call them.

Chip H.


____________________________________________________________________
Donate to Katrina relief:

http://s1.amazon.com/paypage/PELYGQVJ8Q7IB/103-6821258-5919825

If you want to get the best response to a question, please read FAQ222-2244 first

 

[michigan]

I agree with Chip - you don't wanna make a ghost image of anything you're not 100% sure is safe and clean.
However, you may not need to do an fdisk/reinstall at this point.

I suggest first running a full set of tools against your PC (antivirus, antispyware, hijackthis, etc...) and see if anything was infected/compromised. In addition, I also usually run two versions of an antispyware software -- just in case one misses something. If something is discovered that alone could explain your speed issues. Also, keep in mind prior to running any of the cleaning agents, turn your auto System Restore off. That can be very frustrating if you clean your system once and your next reboot will be infected again.

Good Luck.