Re: Urgent!!! My computer seems to be hacked, pls HELP!!!

René Berber <rberber@xxxxxxxxxxxxxxx> wrote:

Then run a rootkit detection and/or anti-virus detection to try to
find out where that process came from (there are several to choose
from).

Good luck with that. There's plenty of malware out there that evades
AV detection and rootkit detection. All your detectors can tell you
is whether you have malware that they know about. There's plenty they
don't know about (or which has been repacked in order to evade
detection).

Do you have any experience at all?

"Evade detection", you must be kidding. FYI most rootkits are very
simple, they install a modified telnet or ssh and some scripts, that's
it; and any good anti-virus detects those and you have the option of
using things like tripwire so you don't even need anti-virus.

Ouch. So now you're assuming no one has ever used a basically
unmodified rootkit and additionally placed a 'stealth' component on the
target. It'll make you feel nice and happy when you find and "remove"
the rootkit, but you won't be any less vulnerable.

If you really want to do things carefully, you can boot from a CD and
check your drive from there. There are several options for the CD, I
have "System Rescue CD".

Unless the CD nukes any unknown (read non-OS) executable on the drive or
you have some known state to compare against (a la tripwire), I don't
see how you can effectively check a drive. It's certainly possible, but
requires you've done work before the attack. Afterward is too late.

--
Darren Dunham ddunham@xxxxxxxx
Senior Technical Consultant TAOS http://www.taos.com/
Got some Dr Pepper? San Francisco, CA bay area
< This line left intentionally blank to confuse you. >
.

Relevant Pages