Hacked?

[maui_hawaii]

How can I tell for sure if I am hacked? My computer I mean.

I run several anti-spyware programs on a regular basis...such as Adware SE, Spybot, the new Microsoft spyware program, and I have Spyware Blaster on my machine.

I also run Outpost firewall on block most mode.

I clean my computer's junk files regularly, and check for spyware often and up until now no real problems.

However, I am noticing that the icons on my desktop are moving around at random. I move them back, then they get shuffled again. If its not a hacker, then why?

I completely disconnected from the internet today, and shut the computer down entirely...but when I booted again after coming home from work my icons were again in the wrong order...

I am running XP Home...

Oh yeah, and I run that Leak Tester software and it came up as a tight ship...

Also while we are at it on my firewall, sometimes it lists IP addresses under the attack detection screen.

What exactly does that mean? And what does "Port Scanned" mean?

(On the last one lets start with "What is a port?")

[BADROTOFINGER]

Your desktop is probably set to 'Auto-Arrange' your icons. Right click on the desktop and change it...JFK

[maui_hawaii]

Nope. Not it.

[shezza]

Are you logged in?

(I'm sorry, but somebody had to do it.)

[ironman]

Rightclick desktop, select properties, then desktop then customize desktop. Desktop cleanup is at the bottom.

[Redcloak]

Perhaps a menehune has been playing with your computer.

[maui_hawaii]

[maui_hawaii]

No menehune in the house. Not unless they are sneaking in from the neighbors, and locking up when they leave :0)

[phoenix0468]

I also run Outpost firewall on block most mode.

---

This is probably your best bet. If you are hacked you may have logs of what IP addresses your computer is communicating with. You can copy these and go to www.samspade.org to see where they originate. If they originate from ApNic (Asia Pacific Network) you are possibly hacked. Also, you can do a netstat from the command line and see what connections are made to your computer through most protocols. Here again you can copy IP addresses and which protocols are being used in communicatios with your computer. Again go to sam spade and google to see if these IP's originate from a rought network such as ApNic or the protocols are uncommon. I.E. if someone is using a P2P type of protocol to connect to you. This may indicate that your computer has been hijacked and is being used unscrupulously.

[maui_hawaii]

What is that supposed to do?

[maui_hawaii]

What leaves me puzzled is that I completely disconnected from the net, and unplugged the machine today...all day.

Then when I booted again, it came up all shuffled up.

He would have to be a good hacker to get the info with no electricity or internet...

[maui_hawaii]

That being said though, I do get port scans and all that sometimes.

[maui_hawaii]

Also, you can do a netstat from the command line and see what connections are made to your computer through most protocols.

Netstat????

[BigSkyFreeper]

I do get port scans and all that sometimes.

If you're getting port scans on ports 1025, 2745, 3140, 80 and 443, those are port scans from infected computers on the internet looking for open ports on your machine by which to further propgate the virus.

[maui_hawaii]

ping

[maui_hawaii]

How can I tell what ports they scan?

But before we go there, whats a port? What do they do?

[BigSkyFreeper]

Click the Start button, click "run" and in the dialog box type:

cmd

that will open up a DOS window. Once that is open, type:

netstat

That will show currently active ports on your machine. To close the window, type at the C: prompt:

exit

[BigSkyFreeper]

Ports allow your computer to communicate with other computers on the internet, there are 65,335 ports on your machine, not all of them are used at the same time. If your firewall has logs, you can look in the logs for all the activity going on in the background. I've never used Outpost, so I can't help you there.

[Prime Choice]

Please do this:

Start -> Run
In the dialog box, enter "command" (without quotes).
Once you get the DOS prompt, enter this command: netstat -an

Cut and paste the results you get either to this thread (or in freepmail to me) and we'll go from there.

As for whether you're infected with a virus, trojan, worm, or are the victim of an ankle-biter remains to be seen and depends on a wealth of variables. What I'm trying to determine up front is whether anyone's connected to your system.

[maui_hawaii]

It says ....

Active Connections

Proto Local Address Foreign Address State