i may have an intruder 2

[redroach]

the little monitors in the corner of my screen have been flashing for no apparent reason, even if i shut the browser window so that im still connected, but with nothing open they still seem to be flashing, its stoped now but was happening for at least an hour that i know of. the pages i was trying to open were taken forever to load and sometimes i was getting the "this page cannot be displayed message" even though the computer was still connected and the monitors were flashing. the top monitor which i assume represents the the network(or internet) was on constantly.
if it was the case that someone was having a snoop round how can i tell if anything has been messed with. i opened the dos program "netstat -a 2" by typing this in to RUN (as advised in another thread and it address was coming up as a "foriegn address"

any help much appriciated

thanx
jared

 

[redroach]

would i firewall protect me and where can i get 1 for free?
also in "netstat 2" the "state" column says "listening" on almost every line??

shit happening again
im goin offline

pleaase halp

jared

 

[GoldenEternity]

Personal firewall software would help you to confirm or deny any unauthorized traffic. You might have some luck with ZoneAlarm, which is free.

You should also scan you system with up to date antivirus software, to detect the presence of any backdoors.

 

[redroach]

thanx for the help,
but do the 'symptoms' ive talked about sound like i had an intruder?

cheers

jared

 

[rycamor]

Yes, it sounds like you might have an IRC "Bot". These are viruses which wait until your computer is on the web, and then they connect to an IRC chat room and wait for an anonymous hacker to give them commands. Often these programs are used not to crack your computer, but to use your computer to crack other computers, so the source is never traced back to the hacker.

http://www.grc.com

has a very interesting description of one type of bot, and what the webmaster had to do to deal with hacker's attempts to use these bots to disable his webserver.

Have you installed any new software recently, like a shareware utility? Ofted viruses come masked inside a legitimate piece of software. Another possibility is a legitimite piece of software that has a "spyware" utility built into it. Some software companies have actually placed code in there programs to send information about you back to the company server, or to connect to the server and download banner ads to your system.

Look for a file named "rundIl.exe" (with an I, then an L, not rundll.exe, which is a normal Windows executable).

Yes, you should get an updated virus scanner, then you should install ZoneAlarm (

http://www.zonelabs.com),

which will alert you if any piece of software on your system is trying to connect to the Web.

 

[redroach]

thax for the help, the article on

http://www.grc.com

was an eye opener (as well as being possitivly scary)i have followed the advice on there and at the mo it looks like my system is fine. before i install zone alarm, are there any updated virus scanners you would recommend?

again i would genuinly like to say thanx,

jared

 

[rycamor]

I personally prefer McAfee to Norton Antivirus, since I've been hit a couple of times by viruses that Norton didn't pick up. I know there are many others, but at least McAfee is the old standby.

 

[PCTHUG]

what O.S. are you running?

 

[redroach]

win 98 se

 

[PCTHUG]

If you go to

http://www.downloads.com

choose downloads and type in the search box firewalls and hit enter. from there scroll to the bottom of the page and modify it so it only shows free ware. Then about half way down you will fin sygate personal firewall. I been using a this program for awile it's nothing fancy but it will let you know if you have an intruder and stop him and best of all it's free.

 

[redroach]

also when i try to access my dialing locations, dial up phone books or internet connection folders i get a message come up telling me i have an unexpected error, could this also be linked to the origional problem?

 

[LowKey]

reinstall, and don't use WIN98...NT or 2000 would be better.. (using NTFS)

 

[Guest_imported]

I've lost my password for ZoneAlarm....is there anyway I can start a new account without knowing my old password? I've uninstalled ZoneAlarm, but it still knows my previous installation.

Any help appreciated

Thank you