UNSOLVED
Computer Compromised/Invaded
Firstly, I would like to thank those of you who offer assistance. It is greatly appreciated. The problem that I present with is the worst experience I have ever had with a computer. Shortly after I got my new computer from Dell, which was running great, a neighbor ( a young 22year old punk) came to my door telling me that he needed to use my computer. My gut said no and I told him no. He persisted and finally used my puter. While on my computer he signed into some chat area and I immediately made him sign out of that -- I use no form of chat -- ever. He then asked me for a bottle of water. As I returned he was in the process of writing something on his hand as he was looking up at the monitor. I said "why and what are you writing on your hand -- there is a stack of paper right next to you?"I asked him what he was doing and he suddenly said he had to go home -- across the hall. Well, since that day my computer life has been beyong terrible. I have Zone Pro, NAV2005, NOADWARE, Lavasoft's AdAware, Microsofts BETA of Spyware version and recently added Counter Spyware. For some reason since he invaded my computer I can no longer get a good install of Spybot -- not sure if there is a connection. I even put a router (for the NAT firewall).
I started to look around my computer after I ended up finding some "adult s_x chat dialer" -- trust me there is no site I would even visit that might drop that into my computer. I cannot even name all of the high/severe level alerts I get from my various spy/adaware programs.I run them manually.
On two different occasions he came to my door with his latest toy -- an iBook -- Coincidence that he was on the exact same web page as was I? He stopped at my door another time to show me his new Internet phone and again was on the same page that my computer was on.
No, my router is NOT wireless but all of his are.
He has never been allowed to use my computer again, but the problems continue. He has GMAIL -- I searched my registry for it and BINGO -- there it was. I ran a regular computer search and BINGO -- I not only was on GMAIL but was able to see all of his GMAIL names, forums he belongs to.
It seems that his computer and mine are connected somehow and hacking and the like is an area that I am not saavy about.
Since that day my computer had been sluggish, when I download my spyware programs from the internet there is a little piece of IE that pops up in the upper left corner of my screen, separate from the actual page. I seem to remember years ago reading that meant you had been invaded.
I do feel like I have been invaded, have had my privacy ripped out from under me and no longer enjoy using my computer which is vital for me.
Words cannot express how sick I am about this. I have done several PC restores, had the cable company change my IP addy and then I reconfiged the router.
I could go on here and tell several nightmare stories but I think I made my point.
Can anybody help me?
Thanking you -- I remain
Very truly yours,
aurorusbs
- Download the latest version of HJT(hijackthis) (version 1.99.1) from
http://majorgeeks.com/download3155.html
you must create a separate folder and place it there.... people commonly use C:\HJT. Note: Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.
The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer. If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )
After Unzipping, double click on HiJackThis.EXE
Click on Do a System Scan and Save a LogFile
This will automatically open NotePad
Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy
Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:
http://forums.us.dell.com/supportforums/board?board.id=si_hijack
Be sure to include a detailed description of any problems/errors/warnings you are encountering.
Hopefully, one of the HJT experts will get to it as quickly as possible.
WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.Supplemental note: The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people. Nevertheless, it seems that many individuals try to be "creative", and make some variations. It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.Specifically, the following are 3 very common BAD deviations which will cause delays:a) BAD: using an older/outdated version of HiJackThis...The experts only work with the current version. So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log.b) BAD: using a TEMP directory or your DESKTOP for HJT....Some experts may insist you move HJT before they'll begin working with you. Others will start the repair process, advising you to move HJT as one of the very first steps. Failure to do so can result in losing potentially critical information. So please, just use the suggested C:\HJT directory, rather than try to be creative.c) BAD: posting your log in the wrong forum...if you post your log back here, in the Virus/SpyWare forum, it will "sit idly", either until the forum moderator gets around to move it for you... or until you decide to repost your log... in the HiJackThis forum. - You're welcome.I've taken a quick glance at your log, and (while I'm NOT claiming to be an expert there) nothing immediately "stands out" as blatantly problematic.... but let's leave that for an expert to decide.I'll try to make sure that someone gets to your log as soon as possible. but please be advised that all the "workers" there are volunteers, who at the moment are being bombarded by logs in need of analysis. so try to be patient... i know it's not easy.the only other comment i will offer at this point, is that you should not download nor install any other programs on your own, unless/until the expert who assists you in HJT advises you to do so. it can be very frustrating for them, if they analyze/work on your log, only to find out that you've altered the configuration on your own (or with the help of someone who doesn't realize you're getting HJT assistance).good luck
- KY331Thanks for the additional information -- it is much appreciated. I will do as you say. Also, despite the frustration I have been living with for months -- being patient is a small price to pay for a total stranger being kind enough to take the time to review and respond to my HJT scan. Knowing that peace of mind will soon be mine (I hope) makes it a lot easier.Again -- thanks.aurorusbs
- i see that Ron (RKinner) has taken on your log, and that he too didn't find anything "blatant"...I'm very surprised by how "clean" your log appears --- I really was figuring there would be a "ton" of obvious garbage to remove....anyway, he did post some suggestions for you to try. all i want to say here is that, if you have any questions about his advice... if you're not sure exactly what he wants you to do... be sure to ask him to clarify things for you.good luck
Greetings and thank you for following up with me -- I appreciate it much.
I downloaded and ran the "Hoster" and it came up green so I clicked the "Restore to Original Hosts." I than got a message, as follows:
"Hoster cannot write to your Host files. Please check file permissions. Hoster will close now." Not sure what that means but I did write back to Ron.
Oddly enough, and quite by chance I had the occasion to speak to a computer/router specialist (never knew there was such a speciality)! In any case I told him the story about this punk kid writing info from my computer. His response was quick and made a lot of sense. He told me that no matter how many times I change my IP addy with my cable company -- the MAC addy stays the same. So what I need to do is to get a new network card, install, notify my cable company, reconfig router -- piece of cake compared to what I have been living with. In the meantime I set up a strong password on my router to keep him out.
I will take every precaution.Again -- thanks
aurorusbs
- Greetings,Perhaps the reason it is so clean is that I seem to spend over an hour a day running various scans and removing some really bad stuff. Also, the punk kid that apparently took my MAC addy, was confronted by me yesterday morning. I looked him straight in the eyes when I spoke -- he could not do same! If he took any action after that -- I do not know. I just want to live my life with no intrusions on it. Being invaded on my computer is such a violation of my privacy.Hacking is not an area that I am savvy about; however, from what I gather he was able to come on to my computer at will.I have ordered a new NIC from Dell (to protect my service contract with Dell). It will be here by Monday and I will be able to fix the problem. For now I password protected my router. Since doing that my computer has been running fine, fast, no hangs, no freezes, no more strange happenings, etc., etc. You cannot imagine what this has done to my emotional state.Again, thank you for your kind assistance to this matter.Regards,aurorusbs
bytzeme
11 Posts
216
0
Posted September 21st, 2005 22:00
Message Edited by bytzeme on 09-21-2005 06:06 PM