Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 05-17-2007, 08:29 PM
Junior Member
 
Join Date: May 2007
Posts: 1
victorh is on a distinguished road
still hijacked; how can I tell if my machine is a zombie?
My machine was hijcked by a professional cracker and I want to know how I can tell if I am part of his botnet. Also is it possible to tell if my machine has been used in any DDOS attacks?

Reply With Quote
Sponsored Links

  #2 (permalink)  
Old 05-19-2007, 09:41 PM
Junior Member
 
Join Date: May 2007
Posts: 1
DOUGLASM is on a distinguished road
still hijacked; how can I tell if my machine is a zombie?
Do thisUsed with permission from NumberSix6Printing this would be helpfulStep 1) DON'T PANIC! Take a deep breath and go grab a cup of your favorite beverage. This may take awhile.Step 2) Clean up your pc. Remove programs you don't use via the Add/Remove Programs in the Control Panel. In Vista, you remove programs by clicking Programs and Features in the Control Panel. If you are unsure of a particular program, you can check it against a list of offenders here: http://forums.majorgeeks.com/showthread....Clean your hard drive of unnecessary files using CCleaner here: http://www.ccleaner.com/download/... Save to your desktop, install it, then run the cleaner. Simple, yet it will free up tons of space on your hard drive. While you have the program open, run the Registry Checker as well. This will fix invalid registry entries safely. Note that you should run CCleaner for ALL accounts on your pc.Step 3) Create a new System Restore point. Click Start>All Programs> Accessories>System Tools>System Restore. Create a restore point. Now delete all but this most recent restore point. Click Start>All Programs>Accessories> System Tools>Disk Cleanup. Click More Options tab, and then under System Restore, click Clean up. Click Yes to remove all but the most recent restore point. Click OK, click Yes, and then click OK.Step 4) Now let's start to get rid of those nasties. Download the following programs to your Desktop. You should then install each one, but don't run them yet. Patience...patience. Lavasoft's Ad-Aware from here: http://www.lavasoftusa.com/products/ad_a...AVG Anti-Spyware from here:http://www.ewido.net/en/download/...Spybot Search and Destroy from here:http://www.safer-networking.org/en/downl...SUPERAntiSpyware from here:http://www.superantispyware.com/...I know this seems like overkill, but until someone can come up with one program that can detect everything in the wild, we need to use programs from several reputable sources.Step 5) Use them safely. Once these programs are installed on your pc, their effectiveness may be negated by running scans normally. You need to reboot your pc into Safe Mode. Shut down your pc, wait a few seconds, then turn it back on. As your computer restarts but before Windows launches, press F8. Use the arrow keys to highlight the Safe Mode with Networking option, which loads all of the above files and drivers and the essential services and drivers to start networking, and press Enter. If Windows launches before you can choose a safe mode, restart your computer and try again. Now it's time to start each program you installed and run scans. First, open Ad-Aware, update to the latest signatures, and run a full system scan. Delete any malware found, close the program and move on to AVG Anti-Spyware. Again, update, run complete scan, and delete the baddies. Do the same for Spybot and SuperAntiSpyware. When you are finished, restart the computer normally.Step 6) Clean up and protect. I would recommend leaving AVG and Ad-Aware on your system, and delete the other two. These anti-spyware programs do not conflict and offer good future protection. If you happen to like the interface of the others, then by all means keep the ones you want, just so long as you have at least one solid stand-alone on your system. Uninstall the others via Add/Remove in the Control Panel. Step 7) Not done yet. We've taken care of the spyware, but there still may be viruses and trojans lurking on your pc. If there is an anti-virus program running on your pc, shut it down. Yes, you read right, end the program. We need to run a few online scans that may conflict with the anti-virus installed. Go to Trend Micro: http://housecall.trendmicro.com/... to download and run their free online scanner. Take whatever action the scanner tells you for any virus found. Finally, do the same with the Panda Online ActiveScan : http://www.pandasoftware.com/products/ac...Restart your computer.Step 8) Peace at last. Make sure your anti-virus program of choice is running again and is up-to-date. If you do not have one, I suggest AVG Free Antivirus here: http://free.grisoft.com/doc/2/ or Avast 4 Home: http://www.avast.com/eng/download-avast-... Be sure you have at least one of the anti-spyware programs running, and also make sure you have a good firewall. PC Tools Firewall Plus is free and works on XP and Vista: http://www.pctools.com/firewall/... , as does WinPatrol 2007: http://www.winpatrol.com/download.html...This procedure will remove MOST malware. However, it may not catch some really nasty buggers. If you've followed all the steps and still believe you have something not right on your pc, you need some extra help. Go here: http://www.tomcoyote.org/hijackthis... to download a program called HijackThis. It examines certain key areas of the Registry and Hard Drive and lists their contents. Install, run and save a logfile which you may post on one of the forums listed on that same page as above. Some kind soul will then come along and examine your logfile and give you recommendations in order to wipe any remaining buggers away. Please email me with comments, suggestions, and errors. If you like it, feel free to pass it on to other infected folks. You may also find this Tweaking Guide usefulhttp://www.tweakguides.com/TGTC.htmlIf you’re a Gamer he also has excellent guides to many gamesSource(s):Many years of cleaning infected pc's

Reply With Quote
  #3 (permalink)  
Old 05-21-2007, 10:53 PM
Junior Member
 
Join Date: May 2007
Posts: 1
mittalman53 is on a distinguished road
still hijacked; how can I tell if my machine is a zombie?
Add "HiJack This" to the list, a word of warning, DON'T DELETE anything with it if your not ABSOLUTELY sure about it!

Reply With Quote
  #4 (permalink)  
Old 05-24-2007, 12:05 AM
Junior Member
 
Join Date: May 2007
Posts: 1
cahno_da_wolf is on a distinguished road
still hijacked; how can I tell if my machine is a zombie?
The easies way to know if you are under his/her control is looking at your actives connection.Close all your internet browsers and any kind of software which uses the net, then:Start - Run - cmdType netstat -aAlso try to look your net traffic with Network Monitor (get it at MS website) or a snifferTry to look any strange connection, also check which process are running using ProcessExplorer from SysInternals.To know if you were used to perform a DDoS, you need to have a connection Logger or anything, or wait for a FBI visit...

Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 06:25 PM.


Design by Vjacheslav Trushkin, color scheme by ColorizeIt!.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.2.0 RC5
vBCredits v1.4 Copyright ©2007, PixelFX Studios


Mobile Phone Forum