Has my PC been compromised

Has my PC been compromised

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Has my PC been compromised suzanne.boyle 03-18-2007
Posted by on March 18, 2007, 2:58 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I have a firewall (router and Windows XP) and anti virus software
running however I think my PC may still have been compromised. It
restarted itself about an hour ago and when I investigated a shortcut
to SQL Server configuration managament (a program I've not used yet)
appeared in the start menu recently used list and the date/time for
the PC appears to have been set to 12/12/2008 (according to the event
log time for certain events).

Nothing else appears to be different. Could this be a simple software
malfunction or does it point to someone having accessed my PC. And is
there any way I can check, even to see if someone was using my
internet connection which I would assume they would have to to gain
access to the computer.

Thanks

SuzyB


Posted by fpbear on March 18, 2007, 4:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi SuzyB, I was thinking "why would SQL server and the date change" if the
PC was compromised. One reason might be that your PC was taken over to be
used as a spam email server. A trojan program could have got on your
computer from a cute program that you downloaded and ran on your system. I
would check your SQL Server database to see if there are any entries in the
log that show recent activity. Check for new tables or data, etc. As a
safe measure disable SQL on startup and run a couple different virus/spyware
scanners (such as Bitdefender, LavsaSoft Adaware, Symantec). This shareware
program, Security Task Manager, could be especially useful in your case:
http://www.neuber.com/taskmanager/



>I have a firewall (router and Windows XP) and anti virus software
> running however I think my PC may still have been compromised. It
> restarted itself about an hour ago and when I investigated a shortcut
> to SQL Server configuration managament (a program I've not used yet)
> appeared in the start menu recently used list and the date/time for
> the PC appears to have been set to 12/12/2008 (according to the event
> log time for certain events).
>
> Nothing else appears to be different. Could this be a simple software
> malfunction or does it point to someone having accessed my PC. And is
> there any way I can check, even to see if someone was using my
> internet connection which I would assume they would have to to gain
> access to the computer.
>
> Thanks
>
> SuzyB
>



Posted by on March 19, 2007, 4:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Hi SuzyB, I was thinking "why would SQL server and the date change" if the
> PC was compromised. One reason might be that your PC was taken over to be
> used as a spam email server. A trojan program could have got on your
> computer from a cute program that you downloaded and ran on your system. I
> would check your SQL Server database to see if there are any entries in the
> log that show recent activity. Check for new tables or data, etc. As a
> safe measure disable SQL on startup and run a couple different virus/spyware
> scanners (such as Bitdefender, LavsaSoft Adaware, Symantec). This shareware
> program, Security Task Manager, could be especially useful in your
case:http://www.neuber.com/taskmanager/
>
>
>
> >I have a firewall (router and Windows XP) and anti virus software
> > running however I think my PC may still have been compromised. It
> > restarted itself about an hour ago and when I investigated a shortcut
> > to SQL Server configuration managament (a program I've not used yet)
> > appeared in the start menu recently used list and the date/time for
> > the PC appears to have been set to 12/12/2008 (according to the event
> > log time for certain events).
>
> > Nothing else appears to be different. Could this be a simple software
> > malfunction or does it point to someone having accessed my PC. And is
> > there any way I can check, even to see if someone was using my
> > internet connection which I would assume they would have to to gain
> > access to the computer.
>
> > Thanks
>
> > SuzyB

Thanks for the reply.

I've run a couple of spyware apps (Windows Defender and Ad Aware) and
a full virus scan and nothing was found. I've also disabled SQL
server and scheduled a daily virus scan and spyware check.

I was just worried that someone had taken control of my PC and had a
look around and wondered if there was any way to check whether files
had been accessed or transferred.


Posted by =?Utf-8?B?TmFzY2FyLUZhbmF0aWM= on March 19, 2007, 6:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello Suzanne. Def does sound like spam or trojanite has been inserted on ur
pc via email or application.. I read you ran previous spyware and virus apps
.. 1 good one that does though in retrospect identify alot of false positives
but might be able to give ya insight on that sql issues..
www.trendmicro.com.. bottom left just run free spyware scan and if ya do find
one the system restore NEEDS to be disabled in order to be fixed.. Good luck
and hope this helps..

The #8 Is Great and #3 WILL always BE

"suzanne.boyle@gmail.com" wrote:

> > Hi SuzyB, I was thinking "why would SQL server and the date change" if the
> > PC was compromised. One reason might be that your PC was taken over to be
> > used as a spam email server. A trojan program could have got on your
> > computer from a cute program that you downloaded and ran on your system. I
> > would check your SQL Server database to see if there are any entries in the
> > log that show recent activity. Check for new tables or data, etc. As a
> > safe measure disable SQL on startup and run a couple different virus/spyware
> > scanners (such as Bitdefender, LavsaSoft Adaware, Symantec). This shareware
> > program, Security Task Manager, could be especially useful in your
case:http://www.neuber.com/taskmanager/
> >
> >
> >
> > >I have a firewall (router and Windows XP) and anti virus software
> > > running however I think my PC may still have been compromised. It
> > > restarted itself about an hour ago and when I investigated a shortcut
> > > to SQL Server configuration managament (a program I've not used yet)
> > > appeared in the start menu recently used list and the date/time for
> > > the PC appears to have been set to 12/12/2008 (according to the event
> > > log time for certain events).
> >
> > > Nothing else appears to be different. Could this be a simple software
> > > malfunction or does it point to someone having accessed my PC. And is
> > > there any way I can check, even to see if someone was using my
> > > internet connection which I would assume they would have to to gain
> > > access to the computer.
> >
> > > Thanks
> >
> > > SuzyB
>
> Thanks for the reply.
>
> I've run a couple of spyware apps (Windows Defender and Ad Aware) and
> a full virus scan and nothing was found. I've also disabled SQL
> server and scheduled a daily virus scan and spyware check.
>
> I was just worried that someone had taken control of my PC and had a
> look around and wondered if there was any way to check whether files
> had been accessed or transferred.
>
>

Posted by =?Utf-8?B?d2lsbGlhbWVyaWM=?= on March 27, 2007, 7:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I know this may sound obvious but have you syncronised your clock, this can
be done by going into control paner and selecting and clicking on the time
icon when it opens try and syncronise with windows clock, just a thought if
the time is not syncronised it cannot run in the right timeframe
--
good xping and best regards
williameric


"Nascar-Fanatic" wrote:

> Hello Suzanne. Def does sound like spam or trojanite has been inserted on ur
> pc via email or application.. I read you ran previous spyware and virus apps
> .. 1 good one that does though in retrospect identify alot of false positives
> but might be able to give ya insight on that sql issues..
> www.trendmicro.com.. bottom left just run free spyware scan and if ya do find
> one the system restore NEEDS to be disabled in order to be fixed.. Good luck
> and hope this helps..
>
> The #8 Is Great and #3 WILL always BE
>
> "suzanne.boyle@gmail.com" wrote:
>
> > > Hi SuzyB, I was thinking "why would SQL server and the date change" if the
> > > PC was compromised. One reason might be that your PC was taken over to be
> > > used as a spam email server. A trojan program could have got on your
> > > computer from a cute program that you downloaded and ran on your system. I
> > > would check your SQL Server database to see if there are any entries in the
> > > log that show recent activity. Check for new tables or data, etc. As a
> > > safe measure disable SQL on startup and run a couple different
virus/spyware
> > > scanners (such as Bitdefender, LavsaSoft Adaware, Symantec). This
shareware
> > > program, Security Task Manager, could be especially useful in your
case:http://www.neuber.com/taskmanager/
> > >
> > >
> > >
> > > >I have a firewall (router and Windows XP) and anti virus software
> > > > running however I think my PC may still have been compromised. It
> > > > restarted itself about an hour ago and when I investigated a shortcut
> > > > to SQL Server configuration managament (a program I've not used yet)
> > > > appeared in the start menu recently used list and the date/time for
> > > > the PC appears to have been set to 12/12/2008 (according to the event
> > > > log time for certain events).
> > >
> > > > Nothing else appears to be different. Could this be a simple software
> > > > malfunction or does it point to someone having accessed my PC. And is
> > > > there any way I can check, even to see if someone was using my
> > > > internet connection which I would assume they would have to to gain
> > > > access to the computer.
> > >
> > > > Thanks
> > >
> > > > SuzyB
> >
> > Thanks for the reply.
> >
> > I've run a couple of spyware apps (Windows Defender and Ad Aware) and
> > a full virus scan and nothing was found. I've also disabled SQL
> > server and scheduled a daily virus scan and spyware check.
> >
> > I was just worried that someone had taken control of my PC and had a
> > look around and wondered if there was any way to check whether files
> > had been accessed or transferred.
> >
> >

Similar ThreadsPosted
Compromised? July 16, 2005, 1:25 am
How do I know if I am being compromised March 15, 2006, 9:26 pm
RE: HELP ! My PC has been compromised !! March 11, 2008, 6:51 am
Re: HELP ! My PC has been compromised !! March 11, 2008, 7:38 am
System compromised? November 17, 2005, 9:11 am
Re: Computer Info Compromised? February 2, 2008, 2:09 am
My machine was compromised via mshta.exe. Is this a new exploit? July 28, 2006, 9:28 pm
Has anyone ever heard of a local LSA secrets file on a Windows workstation being compromised? August 31, 2008, 6:15 pm

The site map in XML format XML site map

Contact Us | Privacy Policy