Have I been hacked?
 

Hey all,

I just want to check this out, as I'm pretty certain about it.

Earlier on, I was merrily writing a fascinating essay for university, and, suddenly, about a million windows opened up! I tired to close some of them, but quickly decided my pc was under attack.

I had to restart it the slow way (i.e. using windows to properly restart) rather than the quick way (hitting the reset button) because I needed to save my work! Sure enough, it asked me if I wanted to save before it re-started.

Since that time, I have changed all of my passwords on this computer, as well as my internet passwords (from one of my other pcs). I have also updated lots of new patches for windows.

Is there anything else I should do? The mass of open windows were open for about thirty seconds, so how much damage could they have done? Its realy annoying, as I thought I had two firewalls (a router AND a software firewall).. so is there anything else I can do to stop this from happening in the future?

P

Re: Have I been hacked?
 

What was in the windows? - Do you use a PC Switch box, I have a similar type of thing happen if I hold shift/ctrl and then click with my mouse, in that every mouse movement seems to copy a window!

Do your logs for the firewalls etc. show any attacks?

Re: Have I been hacked?
 

Run the usual Anti Virus & Spyware checks, could of been a browser hijack program. Unlikely to have done much damage to your pc I think.

Re: Have I been hacked?
 

Heya :)

Well there were literally hundreds of windows that suddenly sprung up... I had no idea where they all came from or what they were doing! There was an MSN-messenger-style one open with an OK button but no text in, countless others that I didn't get to look into... and also a whole stack (like 10 or 20) of windows with a weird logo on the left-hand side- looked like a typical 'spy' character from a film with a hat and trenchcoat on! At first I thought it may have been Adobe screwing up (I was converting an excel document to a .pdf and had tried to cancel).. but kinda assumed quickly that something fishy was going on!

P

Re: Have I been hacked?
 

I have done a virus scan so far.. gonna re-install adaware in a sec - or is there another ad-killer prog you can suggest?

I've never heard of a broweser hijack program before! I always assumed the only way people could get in were with viruses or whatever, but, lol you learn something every day!

I've looked thru my firewall log, but am not really sure what I am looking at, lol!

P

Re: Have I been hacked?
 

Run something like adware6 to hunt for spyware on your pc.

Re: Have I been hacked?
 

Was your browser open?If so what site was it open to?

Re: Have I been hacked?
 

Spybot SD, that & Adaware should get just about everything.

Re: Have I been hacked?
 

If you use ad-aware, make sure you activate in depth scanning, dont use the smart scan option as ad-aware tends to miss things sometimes.

Re: Have I been hacked?
 

Do you have any desktop news tickers or active desktop type feature particularly WeatherBug?

Re: Have I been hacked?
 

Hey all!

It's happened again!

This is getting frustrating now! :monkey:

This time I was using powerpoint and not doing anything else. Again, a tonne of windows were opened - I IMMEDIATELY unplugged my internet connection. Currently running a virus scan on the pc. It's d/ced from the internet right now; I can't figure out how people keep getting into it. It's windows xp and I have put into effect all the latest updates and so on, so am REALLY starting to get confused by all this!

I'll post some piccies from the last time it happened in a few moments...

P

Re: Have I been hacked?
 

howdy,

i have attached the list of processes that were running below. there were quite a few more at the start, but i closed them!

any thoughts?

Re: Have I been hacked?
 

Were you browsing the same site as last time?
I have had this in the past, and it was caused by pop-ups that had been hacked themselves to lead to other pop-ups.
Use a pop-up stopper (google toolbar has a good one in it) to stop them happening in the first place.

alt/f4 is your friend when this happens.

Re: Have I been hacked?
 

Have you tried Hijackthis http://www.spychecker.com/program/hijackthis.html

It can help identify problems with your browser etc.

Re: Have I been hacked?
 

Hmmm....what are all those DDE windows for?

What's with the MCI Command handling window and font capture things?

The AdobeTrayIcon should not show up - it certainly doesn't on mine and I have the full Acrobat, version 5.

Wierd :confused:

Re: Have I been hacked?
 

Unfortunately, I wasn't browsing the same site as before... in fact, I only had excel open to print some lecutre notes, with no IE in sight!

I'll run that browser hijack program as soon as the antivirus has finished :)

I was wondering if it was a newish backdoor thing that hasn't been identified yet.. what are the DDE and MCI windows, anyways?

Theere was also an MSN-messenger style query window open with no text in it. I read somewhere some viruses use these to get in, because the ok button at the bottom of the query window can be clicked to allow access to others.

HOWEVER, weirdly enough - I don't trust messenger at all, so have my firewall block it whenever i am not using it. at the time the weird events i have described occurred, messenger was closed and supposedly blocked by my firewall. yet ten msn-related windows suddnely popped up! :Yikes:

Re: Have I been hacked?
 

Hi Plonking

have you tried running 'Hijack This' available from

http://www.spywareinfo.com/~merijn/downloads.html

- be very careful, though, & make absolutely sure a process is dodgy before zapping it.

<edit> looks upwards & it's Iadom who beat me to it this time :nworthy: ;)

Re: Have I been hacked?
 

Hey Gaz... cheers for the info - and yeah i think you were beaten to it!

The virus scan is on the letter D at the moment, so it may be a while before i can run the hijack thing- if i see any dodgy processes, i'll come here and ask about them first before messing up my pc too much, lol!

can these hijack programs really work when i have no internet browser open? i've noticed that outlook express has stopped asking me for a password when i open it.. might that be connected to all this in some way?

Re: Have I been hacked?
 

Sorry Gaz:angel:
you can use Hijackthis to produce a log that you can past here, someone will be able to identify any bogies it lists on your system.

Re: Have I been hacked?
 

Cool! Well the scan is on program files now, so it won't be too long! I've downloaded hijackthis on this pc (I'm getting so paranoid now about windows i'm using redhat instead!) and will transfer it across as soon as the scan is done :D

thanks for the help you guys! i'll post the results of the scan here when done ... *crosses fingers* ! :)

Re: Have I been hacked?
 

Please post a screenshot of one of the windows that pops up. You can do this by selecting one and pressing ALT and Print Scrn at the same time.

Re: Have I been hacked?
 

hiya!

i have attached some more piccies to this message, as well as the log file from hijackthis...

the pictures.. one of them is of the messenger style window that came up, and the second is what my desktop looked like. it has lots of window headers -

unfortunately i can't give a more accurate pciture of the *moment* it happened - after unplugging the modem, i tried closing some of the windows that had opened before taking a picture. a whole host of windows from different programs opened, and its all very, very confusing!

If it happens again (hopefully it won't), i'll get more accurate piccies!

P

Re: Have I been hacked?
 

i get a window like the second pic you uploaded just then when sygate blocks a process from running... (the one with the "do not show this again" checkbox).

are you running sygate?

Re: Have I been hacked?
 

ah yeah i am indeed running good old sygate :) i'm still really confused as to where all this stuff came from and how it happened, though! any thoughts or theories?

Re: Have I been hacked?
 

just noticed this.... do you have gozilla running? the free version of that has plenty of spyware etc floating around in it i think...

[edit] also

this is spyware apparently...

Re: Have I been hacked?
 

howdy.. yeah i do have gozilla.. although i never use it - last time i tried to, it said i should uninstall it as it was corrupt - :Yikes:

ok ill get rid of it right this second.. cheers for the suggestion! :)

Re: Have I been hacked?
 

well gozilla is gone, and it was probably doing something to my pc - all the user icons for xp have changed to being the chesspieces, and also, after typing in my user name and password, everything loaded a helluva lot faster than normal...


ill get rid of that other piece of spyware too! thanks for your help ! :D

Re: Have I been hacked?
 

:dunce: I should have noticed gozilla, it's notorious for nasties.

- Plonking I left you a message on my bulletin board ;)

Re: Have I been hacked?
 

lol nah i'm the :dunce: for having gozilla in the first place!

i've got firefox but keep using ie... silly me! firefox has that nice d/l control thing.

anyways i hope these troubles don't spring up again! i had no idea my browser could be hijacked when it wasn't even open!

lol, i have seen your message and replied already :P

Re: Have I been hacked?
 

saw that - thanks ;)

none of the replies had any nasties - I think you may be clear? - and thanks for your feedback ;)

Re: Have I been hacked?
 

Heya! Yeah hopefully i am clean now!

lol, don't worry about the rep, i don't think you really need any more than you have, but still, its the thought that counts :P