Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251
POSSIBLE HACK...PLEASE, PLEASE HELP!
POSSIBLE HACK...PLEASE, PLEASE HELP!

POSSIBLE HACK...PLEASE, PLEASE HELP!

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
POSSIBLE HACK...PLEASE, PLEASE HELP! Annie 07-20-2008
Posted by =?Utf-8?B?QW5uaWU=?= on July 20, 2008, 8:51 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I'm using high-speed internet with a router. The tech brought their own so
it's brand new...Netgear. How could the password change after he configured
it? I'm lost.

"Shenan Stanley" wrote:

> <snipped>
>
> Annie wrote:
> > Windows firewall and Zone Alarm firewall. Which one do you
> > recommend I keep on?
>
> Shenan Stanley wrote:
> > Given that you are asking - the Windows Firewall will be more than
> > sufficient and easier to use and keep updated.
> >
> > My Suggestion: Uninstall Zone Alarm completely and just utilize the
> > built in Windows XP Firewall and an updated antivirus application.
> > Occassionally run an AntiSpyware application to see if you have
> > been infested with anything and/or purchase one. SuperAntiSpyware
> > is a good free/for pay one. AVG AntiVirus is a good Free AV
> > application (8.0).
>
> Oh - are you on high-speed Internet (Cable Modem, DSL, etc) and if so - do
> you have a router between you and the internet? (Do you connect directly to
> the Internet and get an actual external IP address or an internal IP
> address?)
>
> If you are unsure - do the following..
>
> 1) Find out your IP address internally:
> - Clcik on the Start button
> - Select RUN
> - Type in: cmd /k ipconfig
> - Note the IP address...
>
> 2) Find out your external IP address:
> - Open Internet Explorer
> - Visit the following web page:
> http://whatismyip.com
> - Note the IP address...
>
> Are they different? Is your internal IP address 10.x.x.x or 192.168.x.x?
> If so - you are behind a router. Hopefully this router has been properly
> configured and the administrator password on it changed.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Posted by Shenan Stanley on July 20, 2008, 9:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
<snipped>

Shenan Stanley wrote:
> Oh - are you on high-speed Internet (Cable Modem, DSL, etc) and if
> so - do you have a router between you and the internet? (Do you
> connect directly to the Internet and get an actual external IP
> address or an internal IP address?)
>
> If you are unsure - do the following..
>
> 1) Find out your IP address internally:
> - Clcik on the Start button
> - Select RUN
> - Type in: cmd /k ipconfig
> - Note the IP address...
>
> 2) Find out your external IP address:
> - Open Internet Explorer
> - Visit the following web page:
> http://whatismyip.com
> - Note the IP address...
>
> Are they different? Is your internal IP address 10.x.x.x or
> 192.168.x.x? If so - you are behind a router. Hopefully this
> router has been properly configured and the administrator password
> on it changed.

Annie wrote:
> I'm using high-speed internet with a router. The tech brought
> their own so it's brand new...Netgear. How could the password
> change after he configured it? I'm lost.

Annie wrote:
> I'm using high-speed internet with a router. The tech brought
> their own so it's brand new...Netgear. How could the password
> change after he configured it? I'm lost.

No - I said I *hoped* it had been changed fromt he DEFAULT... It comes from
the factory with a default password set that anyone with the same router (or
Internet access, or just guessing probably) could know.

If you have a router - you were probably not hacked unless the 'tech' did it
or that default password was not changed. By having a router - it makes you
virtually invisible to the outside world (public internet) and without
forwarding ports and services on the router itself - people are not going to
be likely to get onto your computer. Those routers do not *require* that
you change the password from default to work - nor do they usually require
any actual configuration - just plug them in and go.

Now - if the default (from the factory) password was not changed on your
Netgear router - it is possible you got infested/infected with something
that could give someone access to your computer despite the router being
there and/or change the router settings to allow more remote control.

If that router has been in place the whole time you were connected to the
Internet and it did have its default password changed to something only you
know (or your IT tech..) - then it is unlikely that you have been *hacked* -
however - you may have been infested with a Trojan, a worm or spyware or
adware. If so - that software could have easily sent out your information
and/or whatever it wanted to whatever address(es) it was programmed to do.
A software firewall *might* have helped in such a situation if it monitored
outgoing traffic - but then again - it might not - as it may have been
modified by the installation itself to allow for it to go unnoticed.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Posted by =?Utf-8?B?QW5uaWU=?= on July 20, 2008, 9:41 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
The tech had me come up with a long password for the network key. Is that
the password you're talking about? He does know it and I'm not sure how to
change it on my own. (I'll figure that out later) If that's not what you're
talking about, I have no idea if he changed anything else from default.
Guess I'll have to call the BrightHouse tech tomorrow.

I ran my antivirus: no virus
I ran AdAware: about 200 cookies
I ran Spybot: fixed 68

Computer was taking forever to reboot so I manually turned it off (by the
button). I knew right there something was wrong. All files were modified
with today's date, too. ???

Thanks so much for the info.

"Shenan Stanley" wrote:

> <snipped>
>
> Shenan Stanley wrote:
> > Oh - are you on high-speed Internet (Cable Modem, DSL, etc) and if
> > so - do you have a router between you and the internet? (Do you
> > connect directly to the Internet and get an actual external IP
> > address or an internal IP address?)
> >
> > If you are unsure - do the following..
> >
> > 1) Find out your IP address internally:
> > - Clcik on the Start button
> > - Select RUN
> > - Type in: cmd /k ipconfig
> > - Note the IP address...
> >
> > 2) Find out your external IP address:
> > - Open Internet Explorer
> > - Visit the following web page:
> > http://whatismyip.com
> > - Note the IP address...
> >
> > Are they different? Is your internal IP address 10.x.x.x or
> > 192.168.x.x? If so - you are behind a router. Hopefully this
> > router has been properly configured and the administrator password
> > on it changed.
>
> Annie wrote:
> > I'm using high-speed internet with a router. The tech brought
> > their own so it's brand new...Netgear. How could the password
> > change after he configured it? I'm lost.
>
> Annie wrote:
> > I'm using high-speed internet with a router. The tech brought
> > their own so it's brand new...Netgear. How could the password
> > change after he configured it? I'm lost.
>
> No - I said I *hoped* it had been changed fromt he DEFAULT... It comes from
> the factory with a default password set that anyone with the same router (or
> Internet access, or just guessing probably) could know.
>
> If you have a router - you were probably not hacked unless the 'tech' did it
> or that default password was not changed. By having a router - it makes you
> virtually invisible to the outside world (public internet) and without
> forwarding ports and services on the router itself - people are not going to
> be likely to get onto your computer. Those routers do not *require* that
> you change the password from default to work - nor do they usually require
> any actual configuration - just plug them in and go.
>
> Now - if the default (from the factory) password was not changed on your
> Netgear router - it is possible you got infested/infected with something
> that could give someone access to your computer despite the router being
> there and/or change the router settings to allow more remote control.
>
> If that router has been in place the whole time you were connected to the
> Internet and it did have its default password changed to something only you
> know (or your IT tech..) - then it is unlikely that you have been *hacked* -
> however - you may have been infested with a Trojan, a worm or spyware or
> adware. If so - that software could have easily sent out your information
> and/or whatever it wanted to whatever address(es) it was programmed to do.
> A software firewall *might* have helped in such a situation if it monitored
> outgoing traffic - but then again - it might not - as it may have been
> modified by the installation itself to allow for it to go unnoticed.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Posted by Shenan Stanley on July 20, 2008, 9:56 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Annie wrote:
> The tech had me come up with a long password for the network key.
> Is that the password you're talking about? He does know it and I'm
> not sure how to change it on my own. (I'll figure that out later)
> If that's not what you're talking about, I have no idea if he
> changed anything else from default. Guess I'll have to call the
> BrightHouse tech tomorrow.
>
> I ran my antivirus: no virus
> I ran AdAware: about 200 cookies
> I ran Spybot: fixed 68
>
> Computer was taking forever to reboot so I manually turned it off
> (by the button). I knew right there something was wrong. All
> files were modified with today's date, too. ???
>
> Thanks so much for the info.

No - the wireless password that he probably set for WEP, WPA or WPA2 is not
the same as the password for the router itself. (Well - I suppose they
could be set that way - but the WEP/WPA/WPA2 password for wireless
connectivity is not what we are concerned with here.)

When you did the IPCONFIG feom the earlier posting - what was the internat
IP you received? If I had to venture a guess - it would be 192.168.1.# (#
could be anything between 2 and 254...) If so (or something like that) -
then what you can do is test if the Netgear router configuration password
has been set.

Open your Internet Explorer on a machine connected to that router for
Internet service. For the address type the first three digits of the IP you
have and the last number will be a one (example - if your IP is 10.0.0.45,
type http://10.0.0.1/ and press enter. If your IP was 192.168.1.56, then
you would type http://192.168.1.1/ and press enter - etc.) It should come
up and ask you for a username and password. The username is "admin" (sans
the quotes) and the password - if still set to default - is "password" (sans
the quotes.) If the tech changed it - you will know because the default
admin/password will fail.

As for "files were modified with today's date" - dependent on where the
files were changed (which files exactly and which date (modified, created or
accessed) - that could mean nothing. Honestly - did you look at *all* the
files on your machine or in a particular directory - and what particular
directory?

If the machine is not connected to the Internet - it cannot send anything
else out.

Download and put SuperAntiSpyware on it - scan with it.
Get MultiAV and put it on it and run it per instructions.

(Google for those two products.)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Posted by =?Utf-8?B?QW5uaWU=?= on July 20, 2008, 10:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi Shenan,

I checked my internal and external IPs. They're different. I typed the
username and password as you said but got spooked when it said: Warning:
This server is requesting that your username and password be sent in an
insecure manner (basic authentication without a secure connection)....so I
just clicked cancel rather than OK. I got an 'unauthorized' page. Had I
clicked OK and it 'did' take me to the next page...I want to know where I'm
going before I get there. What would've come next?

When I did the search, I put a * in the search box and asked for any files
modified with today's date. Everything from Program Files to documents to
pictures were on that list. I can't say 'everything' was there, tho.

What's MultiAV? I already ran an anitvirus.



Sheesh...thanks for putting up with me. You're a great help in figuring
this out.

"Shenan Stanley" wrote:

> Annie wrote:
> > The tech had me come up with a long password for the network key.
> > Is that the password you're talking about? He does know it and I'm
> > not sure how to change it on my own. (I'll figure that out later)
> > If that's not what you're talking about, I have no idea if he
> > changed anything else from default. Guess I'll have to call the
> > BrightHouse tech tomorrow.
> >
> > I ran my antivirus: no virus
> > I ran AdAware: about 200 cookies
> > I ran Spybot: fixed 68
> >
> > Computer was taking forever to reboot so I manually turned it off
> > (by the button). I knew right there something was wrong. All
> > files were modified with today's date, too. ???
> >
> > Thanks so much for the info.
>
> No - the wireless password that he probably set for WEP, WPA or WPA2 is not
> the same as the password for the router itself. (Well - I suppose they
> could be set that way - but the WEP/WPA/WPA2 password for wireless
> connectivity is not what we are concerned with here.)
>
> When you did the IPCONFIG feom the earlier posting - what was the internat
> IP you received? If I had to venture a guess - it would be 192.168.1.# (#
> could be anything between 2 and 254...) If so (or something like that) -
> then what you can do is test if the Netgear router configuration password
> has been set.
>
> Open your Internet Explorer on a machine connected to that router for
> Internet service. For the address type the first three digits of the IP you
> have and the last number will be a one (example - if your IP is 10.0.0.45,
> type http://10.0.0.1/ and press enter. If your IP was 192.168.1.56, then
> you would type http://192.168.1.1/ and press enter - etc.) It should come
> up and ask you for a username and password. The username is "admin" (sans
> the quotes) and the password - if still set to default - is "password" (sans
> the quotes.) If the tech changed it - you will know because the default
> admin/password will fail.
>
> As for "files were modified with today's date" - dependent on where the
> files were changed (which files exactly and which date (modified, created or
> accessed) - that could mean nothing. Honestly - did you look at *all* the
> files on your machine or in a particular directory - and what particular
> directory?
>
> If the machine is not connected to the Internet - it cannot send anything
> else out.
>
> Download and put SuperAntiSpyware on it - scan with it.
> Get MultiAV and put it on it and run it per instructions.
>
> (Google for those two products.)
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Similar ThreadsPosted
Attempted Hack? January 17, 2007, 11:43 am
I need a system the U.S. government cannot 'hack' November 19, 2005, 12:27 pm
Event ID 529 Hack Attempts September 26, 2006, 12:37 pm
I'm being threatned by someone who is threatning to hack my accoun April 9, 2006, 3:40 pm
Windows Security Center Hack April 29, 2006, 1:55 pm
RE: Windows Security Center Hack April 29, 2006, 8:28 pm
If you hack a server joined to domain, how much info can you get ? August 16, 2005, 11:41 am
Registry hack to disable password change December 28, 2007, 11:44 am

The site map in XML format XML site map

Contact Us | Privacy Policy