POSSIBLE HACK...PLEASE, PLEASE HELP!

[Milo]

Add to what you just said it works well offline, possible backdoor and
trojan worms are the one causing you headaches
hopefully you're not yet infected by any PE infection.

Alright here you can try this for evaluating how bad it is in your system:
Microsoft Windows Defender www.microsoft.com
Kaspersky Anti-virus ( trial version ) www.kaspersky.com

I would recommend this 3 instances possibly there still a remedy before you
do a destructive install.

Give it a try call Microsoft Security Free Support ( 866-727 2338 )
US/CANADA only


"Annie" <Annie@discussions.microsoft.com> wrote in message
news:F0B9713A-20D0-4E7A-B21B-AE40B679B10B@microsoft.com...
> One more thing...how do I get a patch or how do I get rid of the virus if
> it
> is indeed the PE virus? Is there anything else I can do so the headers
> aren't changed.
>
> I turned on the computer yesterday, disabled wireless, and it came on
> normally. I'm afraid that if I go back online the trouble will start
> again.
>
> Also, in my ZA log list, there were a couple of suspicious logs:
>
> Protocol: UDP (all others say TCP)
> Source IDs are different than mine
> Direction: Routed (all other ones say Outgoing)
> Source DNS: one is blank, other has a string of numbers and letters (all
> others say Toshiba user)
> Destination DNS: blank
>
> What do you make of that?
>
>
>
>
>
> "Milo" wrote:
>
>> Anne what you have in your system wasn't a hack but a possible virus /
>> the
>> way you describe it program executing on their own and was modified
>> recently
>> its very possible what you're experiencing is a PE_sality / PE_patch
>> Virus
>> concern.... Sad to say on most occasion it modifies file headers of those
>> exe and scr files that they become useless.
>>
>> Next time invest in a better Security Application / firewall alone is
>> useless to polymorphic and blended threats.
>>
>>
>>
>> "Annie" <Annie@discussions.microsoft.com> wrote in message
>> news05EAB4A-EE75-44C6-A77C-1985E4264BD1@microsoft.com...
>> > Thank you everyone for trying to help. This is just too overwhelming
>> > for
>> > me.
>> > I'm just going to take my computer in to the shop and have the
>> > reinstall
>> > the
>> > OS and I'll have to reinstall all my other programs.
>> >
>> > My router says it has a double firewall so I still don't know how all
>> > of
>> > this could've happened eventho that guy turned my Windows firewall off.
>> > Makes no sense to me.
>> >
>> > Thanks again. I hope all these posts help anyone else who has this
>> > problem
>> > and are a bit more experienced than myself.
>> >
>> > "Dan" wrote:
>> >
>> >> I am actually posting this reply via the 98 Second Edition side of my
>> >> computer which was not hacked in 2007 after the APS network was hacked
>> >> and
>> >> the XP Professional side was compromised, the 98 SE side rode through
>> >> the
>> >> onslaught like a champ without noticing any problems despite the fact
>> >> that it
>> >> was hooked up to the Internet. This is my main reason for my debate
>> >> with
>> >> Steve Riley but I will discuss that later in the appropriate topic
>> >> area
>> >> of
>> >> this newsgroup. Identity Theft is really terrible. I want to rant
>> >> and
>> >> rave
>> >> about my problems but will not redirect to help you.
>> >>
>> >> Okay, first come to grips with the worst case scenario although it
>> >> might
>> >> not
>> >> be the worst case, I feel it is better to get that over with first and
>> >> then
>> >> try not to worry. Secondly, make sure the compromised portion (XP
>> >> Home)
>> >> side
>> >> of the PC is not connected to the Internet. I figure we are talking
>> >> about a
>> >> single operating system and do not have to deal with Virtual Machines
>> >> and
>> >> or
>> >> Dual or Tri-Boots. Please correct me if I am wrong. Since the
>> >> problem
>> >> is
>> >> with Windows XP Home then I certainly would allow a copy of Windows
>> >> Live
>> >> One
>> >> Care to attempt to fix the problem. Unfortunately, for you this is a
>> >> terrible scenario but it will be useful for Microsoft and others to
>> >> see
>> >> how
>> >> effectively Windows Live One Care can fix your problem. This will
>> >> make a
>> >> great test case to see the effectiveness of Windows Live One Care.
>> >> Just
>> >> so
>> >> you all know, I enjoy using Microsoft technology but will not limit
>> >> myself to
>> >> a single software or hardware manufacturer. It must be all fully
>> >> customized
>> >> for me to meet my needs and please sorry Annie but do not see me as
>> >> insensitive since your case may indeed help all users out.
>> >>
>> >> 1. Try to Install and Run Windows Live One Care --- use cd and make
>> >> sure
>> >> your ethernet, usb or phone cord is not connected --- this is a
>> >> critical
>> >> step
>> >> as far as not being connected to the Internet with that machine or at
>> >> least
>> >> within the compromised operating system (I presume broadband ---
>> >> cable/dsl or
>> >> narrowband if dial-up) ---- access me and others with another
>> >> non-compromised
>> >> machine at this Microsoft Newsgroup ---- Please let us know the
>> >> results
>> >> and I
>> >> will attempt to provide further assistant --- Milo, Steve Riley and
>> >> others
>> >> are welcome to add their feedback to this case as well to help Annie.
>> >>
>> >> "Annie" wrote:
>> >>
>> >> > Thank you, Dan and Milo.
>> >> >
>> >> > So what is the next step? I'm not going to turn on that computer
>> >> > just
>> >> > yet.
>> >> > Where do I find the PE_Sality / PE_Patch at a safe site and should I
>> >> > download
>> >> > that first before anything else? Should I then run the programs Dan
>> >> > suggested...in that order?
>> >> >
>> >> > I'm running Windows XP Home edition on that computer.
>> >> >
>> >> > I checked my IP addresses per Shenan's advice, they're different. I
>> >> > tried
>> >> > to login as 'admin' and put the default password in. I then got a
>> >> > 'warning'
>> >> > screen' so just clicked cancel because I didn't know where that was
>> >> > going to
>> >> > take me. Could I have clicked OK and then just closed the next page
>> >> > had it
>> >> > submitted? I realize if I did go to the next page my password was
>> >> > 'not'
>> >> > changed from the default which is bad. I just didn't know where to
>> >> > take it
>> >> > from there.
>> >> >
>> >> > Thank you so much for your help.
>> >> >
>> >> > One more thing...if this was what Milo said it was..does someone out
>> >> > there
>> >> > have all my personal data (documents, photos, passwords, etc.).
>> >> >
>> >> >
>> >> >
>> >> >
>> >> > "Dan" wrote:
>> >> >
>> >> > > Sorry, Shenan. I disagree. AVG Free 7.5 antivirus is a good
>> >> > > program.
>> >> > > Unfortunately with Free AVG 8, the company apparently broke many
>> >> > > of
>> >> > > their own
>> >> > > rules and I cannot suggest AVG anymore unless a user is running
>> >> > > the
>> >> > > legacy
>> >> > > version with AVG 7.5 in which support supposedly is ending in
>> >> > > August.
>> >> > >
>> >> > > The reason is that AVG 8 has too many false positives on both my
>> >> > > system and
>> >> > > my dad's machine when we tried it on XP Professional for me and XP
>> >> > > Home for
>> >> > > him. I do not like to disagree with an MVP and please do not jump
>> >> > > down my
>> >> > > throat and forgive me for stating my opinion. I am not overly
>> >> > > happy
>> >> > > with
>> >> > > Avast either if the user is using a 9x machine (such as Windows 98
>> >> > > Second
>> >> > > Edition) but if the machine is using a more modern operating
>> >> > > system
>> >> > > such as
>> >> > > Windows XP then I would suggest Microsoft's antivirus of Windows
>> >> > > Live
>> >> > > One
>> >> > > Care because I have not had issues with it so far except the
>> >> > > stupid
>> >> > > red
>> >> > > notification it gives me because I do not enable automatic updates
>> >> > > since I
>> >> > > enjoy reading about every security update.
>> >> > >
>> >> > > "Shenan Stanley" wrote:
>> >> > >
>> >> > > > Annie wrote:
>> >> > > > > Windows firewall and Zone Alarm firewall. Which one do you
>> >> > > > > recommend I keep on?
>> >> > > >
>> >> > > > Given that you are asking - the Windows Firewall will be more
>> >> > > > than
>> >> > > > sufficient and easier to use and keep updated.
>> >> > > >
>> >> > > > My Suggestion: Uninstall Zone Alarm completely and just utilize
>> >> > > > the
>> >> > > > built in
>> >> > > > Windows XP Firewall and an updated antivirus application.
>> >> > > > Occassionally run
>> >> > > > an AntiSpyware application to see if you have been infested with
>> >> > > > anything
>> >> > > > and/or purchase one. SuperAntiSpyware is a good free/for pay
>> >> > > > one.
>> >> > > > AVG
>> >> > > > AntiVirus is a good Free AV application (8.0).
>> >> > > >
>> >> > > > --
>> >> > > > Shenan Stanley
>> >> > > > MS-MVP
>> >> > > > --
>> >> > > > How To Ask Questions The Smart Way
>> >> > > > http://www.catb.org/~esr/faqs/smart-questions.html
>> >> > > >
>> >> > > >
>> >> > > >
>>

 

[Root Kit]

On Mon, 21 Jul 2008 06:59:02 -0700, Dan
<Dan@discussions.microsoft.com> wrote:

>BTW, Tom have you seen the original Matrix movie and what about the 1980's
>Sneakers movie with Robert Redford and how about It's a Wonderful Life with
>Jimmy Stewart and Enemy of the State and The Game. These movies are just a
>few that really make me think and reflect about life. I am one of those
>movie goers who after seeing a really good movie will watch all the credits.
>I will try and ask the movie personnel if there is an added extra at the end
>because spending around $10 nowadays to see a new release is a real treat for
>me. Unfortunately, I have been very disappointed with Hollywood recently
>because I think the overall thought and intelligence in movies and the
>quality is going way downhill.

Please keep your off topic private chit chat out of a security related
forum.

 

[Root Kit]

On Sun, 20 Jul 2008 16:30:00 -0700, Annie
<Annie@discussions.microsoft.com> wrote:

>Three days ago, I had RoadRunner (cable internet connection) hooked up. The
>tech turned off both my firewalls and DIDN'T tell me! (Shame on me for not
>checking) Just a few minutes ago, while I was surfing, all my programs
>opened up, one by one.

There could be more reasons for such behavior.

>Was my computer hacked and did someone get all my personal information?!

Impossible to tell from a distance.

>I'm running my virus program right now. What else should I do? Please help.
> I'm a nervous wreck right now!

Okay, let's sum up....

After reading through the entire thread I find no hard evidence that
you have been hacked, but it's impossible to tell from a distance. The
results from Spybot indicate that there are areas in which your
security could improve, though.

If you still feel uncomfortable, I suggest 2 options:

1) Take your computer to someone trustworthy who knows what he's doing
- and I'm not talking about the "tech guy" next door.

2) Revert your machine to a known clean state. This ultimately means
reinstalling from a restore media or eventually flatten and rebuild.
Unless you can get in contact with a very skilled person who is able
to declare your machine "clean", this unfortunately is the only way to
make sure you got rid of the nasty if your machine was in fact
compromised. All this "try this" and "try that" is senseless and may
only remove the symptom.

In either case first make sure to have backups of your important data
and have notes of your usernames and passwords for mails etc. in a
safe place. Also make sure to have all your license codes etc. ready
in case you need to re-install something.

Also, if you do suspect your router may have been hacked, hard reset
it and do the basic router securing (maybe get someone to help you do
it):

* change the default admin password
* make sure any administration access from the WAN side is turned off
* make sure UPnP is turned off
* encrypt your wireless connection with at least WPA and a long random
pass phrase


Then for the future you also need to educate yourself about safe hex.
The most important security measures being:

* Keep your system patched (this is true for both the OS as well as
applications you've installed).

* Use a restricted user account for daily use and use only the admin
account for what it was intended (software installation, configuration
changes and the like)

* Don't run or install software unless you fully trust it. Do not
install software from dubious sources.

* Use robust software and stay away from IE and OE unless you're
running Vista and can run IE in protected mode.

* Don't blindly open / run e-mail attachments.

* Don't click links in e-mails without thoroughly checking them.

* Turn the windows firewall on and stay away from 3rd party firewall
illusionware.

* Configure your router as described already

* Be skeptical and implement common sense.

Such precautions will keep you safe from the vast majority of
problems. There is no such thing as 100% security. You can add a good
anti-malware product as an extra level of protection, but anti-malware
is not something you should ever rely on. No anti-malware can protect
you from yourself.

 

[Root Kit]

On Mon, 21 Jul 2008 11:43:05 -0700, Dan
<Dan@discussions.microsoft.com> wrote:

>You are most welcome. I am thankfully posting in Windows 98 Second Edition
>because I went ahead and removed the extra memory from the computer and went
>from 2 gigabytes back to 512 megabytes.

Oh, you're using W98SE. Never mentioned that before.... How is this
related to Annie's problem?

>I am doing this because I sincerely believe in the safeness of the 9x source code

Some people believe in horoscopes.

>with the proper security protocol.

What security protocol would that be, if one may ask?

> Chris Quirke, MVP was the one who really set me on the proper track of the
>internal safety and external security approach.

You have generally too high thoughts about MVP's. Why is it, titles
seem to mean a lot to you?

 

[Root Kit]

On Tue, 22 Jul 2008 07:07:00 -0700, Dan
<Dan@discussions.microsoft.com> wrote:

>Annie, it is very difficult to discover who hacked you.

Indeed.

>This would include tracing logs and other stuff that Steve Riley, MSFT
>has mentioned in the Biometrics post.

If possible at all.

>For example, a few years back I had Zone Alarm Professional
>and hooked it up to see where port scans were coming from with Windows 98
>Second Edition and did not use a hardware firewall purposely so I could allow
>ZA to track and figure out where hack attempts were coming from and the
>majority appeared to be from China but remember this is back in about 2003 or
>so and so the data is not as relevant today and China was followed by the
>U.S.A. and then followed by Russia.
>
>How does it make you feel that the hacking may have even come from within
>the States?

How does it make you feel that most bad web sites originate from the
States?

 

[Annie]

Thanks, Root Kit.

A response from the other site regarding my HJ logs said he thinks I'm
actually pretty clean at the time. No malware.

So now I'm thinking my issue is with ZA. Maybe I'll hold off on
reformatting/reinstalling. ?? Will try to figure out what would be
comparable to ZA in regards to security and try a new program.

I took off all personal data from my computer and backed everything up. I
do have the recovery disk if needed.

Thanks again.



"Root Kit" wrote:

> On Sun, 20 Jul 2008 16:30:00 -0700, Annie
> <Annie@discussions.microsoft.com> wrote:
>
> >Three days ago, I had RoadRunner (cable internet connection) hooked up. The
> >tech turned off both my firewalls and DIDN'T tell me! (Shame on me for not
> >checking) Just a few minutes ago, while I was surfing, all my programs
> >opened up, one by one.
>
> There could be more reasons for such behavior.
>
> >Was my computer hacked and did someone get all my personal information?!
>
> Impossible to tell from a distance.
>
> >I'm running my virus program right now. What else should I do? Please help.
> > I'm a nervous wreck right now!
>
> Okay, let's sum up....
>
> After reading through the entire thread I find no hard evidence that
> you have been hacked, but it's impossible to tell from a distance. The
> results from Spybot indicate that there are areas in which your
> security could improve, though.
>
> If you still feel uncomfortable, I suggest 2 options:
>
> 1) Take your computer to someone trustworthy who knows what he's doing
> - and I'm not talking about the "tech guy" next door.
>
> 2) Revert your machine to a known clean state. This ultimately means
> reinstalling from a restore media or eventually flatten and rebuild.
> Unless you can get in contact with a very skilled person who is able
> to declare your machine "clean", this unfortunately is the only way to
> make sure you got rid of the nasty if your machine was in fact
> compromised. All this "try this" and "try that" is senseless and may
> only remove the symptom.
>
> In either case first make sure to have backups of your important data
> and have notes of your usernames and passwords for mails etc. in a
> safe place. Also make sure to have all your license codes etc. ready
> in case you need to re-install something.
>
> Also, if you do suspect your router may have been hacked, hard reset
> it and do the basic router securing (maybe get someone to help you do
> it):
>
> * change the default admin password
> * make sure any administration access from the WAN side is turned off
> * make sure UPnP is turned off
> * encrypt your wireless connection with at least WPA and a long random
> pass phrase
>
>
> Then for the future you also need to educate yourself about safe hex.
> The most important security measures being:
>
> * Keep your system patched (this is true for both the OS as well as
> applications you've installed).
>
> * Use a restricted user account for daily use and use only the admin
> account for what it was intended (software installation, configuration
> changes and the like)
>
> * Don't run or install software unless you fully trust it. Do not
> install software from dubious sources.
>
> * Use robust software and stay away from IE and OE unless you're
> running Vista and can run IE in protected mode.
>
> * Don't blindly open / run e-mail attachments.
>
> * Don't click links in e-mails without thoroughly checking them.
>
> * Turn the windows firewall on and stay away from 3rd party firewall
> illusionware.
>
> * Configure your router as described already
>
> * Be skeptical and implement common sense.
>
> Such precautions will keep you safe from the vast majority of
> problems. There is no such thing as 100% security. You can add a good
> anti-malware product as an extra level of protection, but anti-malware
> is not something you should ever rely on. No anti-malware can protect
> you from yourself.
>

 

[Annie]

Just called BrightHouse and they had to reset my router. This seemed to take
care of my ZA messages. I think my computer is clean according to HJT
people...so...I'm logging off.

Thanks to everyone who helped. You guys are amazing!




"Annie" wrote:

> Thanks, Root Kit.
>
> A response from the other site regarding my HJ logs said he thinks I'm
> actually pretty clean at the time. No malware.
>
> So now I'm thinking my issue is with ZA. Maybe I'll hold off on
> reformatting/reinstalling. ?? Will try to figure out what would be
> comparable to ZA in regards to security and try a new program.
>
> I took off all personal data from my computer and backed everything up. I
> do have the recovery disk if needed.
>
> Thanks again.
>
>
>
> "Root Kit" wrote:
>
> > On Sun, 20 Jul 2008 16:30:00 -0700, Annie
> > <Annie@discussions.microsoft.com> wrote:
> >
> > >Three days ago, I had RoadRunner (cable internet connection) hooked up. The
> > >tech turned off both my firewalls and DIDN'T tell me! (Shame on me for not
> > >checking) Just a few minutes ago, while I was surfing, all my programs
> > >opened up, one by one.
> >
> > There could be more reasons for such behavior.
> >
> > >Was my computer hacked and did someone get all my personal information?!
> >
> > Impossible to tell from a distance.
> >
> > >I'm running my virus program right now. What else should I do? Please help.
> > > I'm a nervous wreck right now!
> >
> > Okay, let's sum up....
> >
> > After reading through the entire thread I find no hard evidence that
> > you have been hacked, but it's impossible to tell from a distance. The
> > results from Spybot indicate that there are areas in which your
> > security could improve, though.
> >
> > If you still feel uncomfortable, I suggest 2 options:
> >
> > 1) Take your computer to someone trustworthy who knows what he's doing
> > - and I'm not talking about the "tech guy" next door.
> >
> > 2) Revert your machine to a known clean state. This ultimately means
> > reinstalling from a restore media or eventually flatten and rebuild.
> > Unless you can get in contact with a very skilled person who is able
> > to declare your machine "clean", this unfortunately is the only way to
> > make sure you got rid of the nasty if your machine was in fact
> > compromised. All this "try this" and "try that" is senseless and may
> > only remove the symptom.
> >
> > In either case first make sure to have backups of your important data
> > and have notes of your usernames and passwords for mails etc. in a
> > safe place. Also make sure to have all your license codes etc. ready
> > in case you need to re-install something.
> >
> > Also, if you do suspect your router may have been hacked, hard reset
> > it and do the basic router securing (maybe get someone to help you do
> > it):
> >
> > * change the default admin password
> > * make sure any administration access from the WAN side is turned off
> > * make sure UPnP is turned off
> > * encrypt your wireless connection with at least WPA and a long random
> > pass phrase
> >
> >
> > Then for the future you also need to educate yourself about safe hex.
> > The most important security measures being:
> >
> > * Keep your system patched (this is true for both the OS as well as
> > applications you've installed).
> >
> > * Use a restricted user account for daily use and use only the admin
> > account for what it was intended (software installation, configuration
> > changes and the like)
> >
> > * Don't run or install software unless you fully trust it. Do not
> > install software from dubious sources.
> >
> > * Use robust software and stay away from IE and OE unless you're
> > running Vista and can run IE in protected mode.
> >
> > * Don't blindly open / run e-mail attachments.
> >
> > * Don't click links in e-mails without thoroughly checking them.
> >
> > * Turn the windows firewall on and stay away from 3rd party firewall
> > illusionware.
> >
> > * Configure your router as described already
> >
> > * Be skeptical and implement common sense.
> >
> > Such precautions will keep you safe from the vast majority of
> > problems. There is no such thing as 100% security. You can add a good
> > anti-malware product as an extra level of protection, but anti-malware
> > is not something you should ever rely on. No anti-malware can protect
> > you from yourself.
> >

 

[Dan]

Annie, the key word you used is that you Think your Machine is Clean (TMC)
and unless you run anti-virus programs like Windows Live One Care, Spybot
Search and Destroy, Kaspersky, and AVG 7.5, and others then how will not be
sure. Please make sure only one antivirus program is installed at a time and
beware of false positives because anti-virus programs like Avast have gotten
much worse over time. For example, Avast Antivirus thought that Yahoo web
portal had malware when it did not.

Please take Milo's advice and also at least call Microsoft and let a tech
use easy assist to ensure your machine is indeed safe at a bare minimum if
you are unwilling to do a clean install. Actually, I would highly suggest
contacting Microsoft at their PC Safety Line. Please inform us what the
Microsoft technician tells you and try and get a knowledgeable one because
sometimes the less clever ones are not really helpful at least to me.

In addition, you must realize that if your machine was cleverly infected by
perhaps a Root Kit/Virus Combination then you might not be able to tell that
there ever was a problem. Trust Me Please because safety and security of
information technology is vital. Have a nice day and please don't just give
up and think it is all better when it may not be and your information may
have been compromised especially with what you told us about how Zone Alarm
informed you of your information being redirected. It is possible that
nothing happened but better safe than sorry. Have a nice day.

 

[Annie]

post too long...deleted some.


Thought I had the problem fixed. No such luck.

ZA is still blocking to port 2869. Constant incoming alerts are driving me
crazy. Do I need to have this port open? If not, how do I close it? I
don't have anything networked such as wireless printers,
computer-to-computer, palm, etc. I do, however, have a router. Does this
make a difference?

Again...would love your advice. Maybe I should start a new thread?






"Annie" wrote:

> Just called BrightHouse and they had to reset my router. This seemed to take
> care of my ZA messages. I think my computer is clean according to HJT
> people...so...I'm logging off.
>
> Thanks to everyone who helped. You guys are amazing!
>
>
>
>
> "Annie" wrote:
>
> > Thanks, Root Kit.
> >
> > A response from the other site regarding my HJ logs said he thinks I'm
> > actually pretty clean at the time. No malware.
> >
> > So now I'm thinking my issue is with ZA. Maybe I'll hold off on
> > reformatting/reinstalling. ?? Will try to figure out what would be
> > comparable to ZA in regards to security and try a new program.
> >
> > I took off all personal data from my computer and backed everything up. I
> > do have the recovery disk if needed.
> >
> > Thanks again.
> >
> >
>

 

[Tom [Pepper] Willett]

http://www.wilderssecurity.com/archive/index.php/t-59493.html

"Annie" <Annie@discussions.microsoft.com> wrote in message
news:5121917C-5F58-4F61-8300-5853E7AD2F79@microsoft.com...
: post too long...deleted some.
:
:
: Thought I had the problem fixed. No such luck.
:
: ZA is still blocking to port 2869. Constant incoming alerts are driving
me
: crazy. Do I need to have this port open? If not, how do I close it? I
: don't have anything networked such as wireless printers,
: computer-to-computer, palm, etc. I do, however, have a router. Does this
: make a difference?
:
: Again...would love your advice. Maybe I should start a new thread?
:
:
:
:
:
:
: "Annie" wrote:
:
: > Just called BrightHouse and they had to reset my router. This seemed to
take
: > care of my ZA messages. I think my computer is clean according to HJT
: > people...so...I'm logging off.
: >
: > Thanks to everyone who helped. You guys are amazing!
: >
: >
: >
: >
: > "Annie" wrote:
: >
: > > Thanks, Root Kit.
: > >
: > > A response from the other site regarding my HJ logs said he thinks I'm
: > > actually pretty clean at the time. No malware.
: > >
: > > So now I'm thinking my issue is with ZA. Maybe I'll hold off on
: > > reformatting/reinstalling. ?? Will try to figure out what would be
: > > comparable to ZA in regards to security and try a new program.
: > >
: > > I took off all personal data from my computer and backed everything
up. I
: > > do have the recovery disk if needed.
: > >
: > > Thanks again.
: > >
: > >
: >

 

[Annie]

Thank you, Tom, but I still don't know how to disable the port. I'm not that
experienced a computer person. I want it disabled as long as it won't
interfere with my wireless internet connection.

Dan, I ran disk cleanup, defrag, Adaware, Spybot, Avast and HJT. I thought
HJT was supposed to be the one that told me if I had anything bad on my
computer. ??? If these programs don't pick up the RootKit/Virus combo,
you're saying Microsoft will?

The computer is running fine except for the incoming, from my IP, to my 2869
port. No outsiders. What will happen if I 'do' have a RootKit/Virus combo?
What should I look for in terms of odd behavior?



"Tom [Pepper] Willett" wrote:

> http://www.wilderssecurity.com/archive/index.php/t-59493.html
>
> "Annie" <Annie@discussions.microsoft.com> wrote in message
> news:5121917C-5F58-4F61-8300-5853E7AD2F79@microsoft.com...
> : post too long...deleted some.
> :
> :
> : Thought I had the problem fixed. No such luck.
> :
> : ZA is still blocking to port 2869. Constant incoming alerts are driving
> me
> : crazy. Do I need to have this port open? If not, how do I close it? I
> : don't have anything networked such as wireless printers,
> : computer-to-computer, palm, etc. I do, however, have a router. Does this
> : make a difference?
> :
> : Again...would love your advice. Maybe I should start a new thread?
> :
> :
> :
> :
> :
> :
> : "Annie" wrote:
> :
> : > Just called BrightHouse and they had to reset my router. This seemed to
> take
> : > care of my ZA messages. I think my computer is clean according to HJT
> : > people...so...I'm logging off.
> : >
> : > Thanks to everyone who helped. You guys are amazing!
> : >
> : >
> : >
> : >
> : > "Annie" wrote:
> : >
> : > > Thanks, Root Kit.
> : > >
> : > > A response from the other site regarding my HJ logs said he thinks I'm
> : > > actually pretty clean at the time. No malware.
> : > >
> : > > So now I'm thinking my issue is with ZA. Maybe I'll hold off on
> : > > reformatting/reinstalling. ?? Will try to figure out what would be
> : > > comparable to ZA in regards to security and try a new program.
> : > >
> : > > I took off all personal data from my computer and backed everything
> up. I
> : > > do have the recovery disk if needed.
> : > >
> : > > Thanks again.
> : > >
> : > >
> : >
>
>
>

 

[Tom [Pepper] Willett]

If it's in your modem, contact your ISP to find out how.

"Annie" <Annie@discussions.microsoft.com> wrote in message
news:49799E98-B053-4FDF-8000-62B970D4A2FE@microsoft.com...
: Thank you, Tom, but I still don't know how to disable the port. I'm not
that
: experienced a computer person. I want it disabled as long as it won't
: interfere with my wireless internet connection.
:
: Dan, I ran disk cleanup, defrag, Adaware, Spybot, Avast and HJT. I
thought
: HJT was supposed to be the one that told me if I had anything bad on my
: computer. ??? If these programs don't pick up the RootKit/Virus combo,
: you're saying Microsoft will?
:
: The computer is running fine except for the incoming, from my IP, to my
2869
: port. No outsiders. What will happen if I 'do' have a RootKit/Virus
combo?
: What should I look for in terms of odd behavior?
:
:
:
: "Tom [Pepper] Willett" wrote:
:
: > http://www.wilderssecurity.com/archive/index.php/t-59493.html
: >
: > "Annie" <Annie@discussions.microsoft.com> wrote in message
: > news:5121917C-5F58-4F61-8300-5853E7AD2F79@microsoft.com...
: > : post too long...deleted some.
: > :
: > :
: > : Thought I had the problem fixed. No such luck.
: > :
: > : ZA is still blocking to port 2869. Constant incoming alerts are
driving
: > me
: > : crazy. Do I need to have this port open? If not, how do I close it?
I
: > : don't have anything networked such as wireless printers,
: > : computer-to-computer, palm, etc. I do, however, have a router. Does
this
: > : make a difference?
: > :
: > : Again...would love your advice. Maybe I should start a new thread?
: > :
: > :
: > :
: > :
: > :
: > :
: > : "Annie" wrote:
: > :
: > : > Just called BrightHouse and they had to reset my router. This
seemed to
: > take
: > : > care of my ZA messages. I think my computer is clean according to
HJT
: > : > people...so...I'm logging off.
: > : >
: > : > Thanks to everyone who helped. You guys are amazing!
: > : >
: > : >
: > : >
: > : >
: > : > "Annie" wrote:
: > : >
: > : > > Thanks, Root Kit.
: > : > >
: > : > > A response from the other site regarding my HJ logs said he thinks
I'm
: > : > > actually pretty clean at the time. No malware.
: > : > >
: > : > > So now I'm thinking my issue is with ZA. Maybe I'll hold off on
: > : > > reformatting/reinstalling. ?? Will try to figure out what would
be
: > : > > comparable to ZA in regards to security and try a new program.
: > : > >
: > : > > I took off all personal data from my computer and backed
everything
: > up. I
: > : > > do have the recovery disk if needed.
: > : > >
: > : > > Thanks again.
: > : > >
: > : > >
: > : >
: >
: >
: >

 

[PA Bear [MS MVP]]

Stick with http://aumha.net/viewtopic.php?f=30&t=34821, Annie.

Annie wrote:
> post too long...deleted some.
>
> Thought I had the problem fixed. No such luck.
>
> ZA is still blocking to port 2869. Constant incoming alerts are driving
> me
> crazy. Do I need to have this port open? If not, how do I close it? I
> don't have anything networked such as wireless printers,
> computer-to-computer, palm, etc. I do, however, have a router. Does this
> make a difference?
>
> Again...would love your advice. Maybe I should start a new thread?
>
>> Just called BrightHouse and they had to reset my router. This seemed to
>> take care of my ZA messages. I think my computer is clean according to
>> HJT
>> people...so...I'm logging off.
>>
>> Thanks to everyone who helped. You guys are amazing!
<snip>

 

[Shenan Stanley]

<snipped>

Annie wrote:
> post too long...deleted some.
>
> Thought I had the problem fixed. No such luck.
>
> ZA is still blocking to port 2869. Constant incoming alerts are
> driving me crazy. Do I need to have this port open? If not, how
> do I close it? I don't have anything networked such as wireless
> printers, computer-to-computer, palm, etc. I do, however, have a
> router. Does this make a difference?
>
> Again...would love your advice. Maybe I should start a new thread?

Personally - I think if you are going to continue trying to fix this
yourself - you are going to be better off backing up your important data
(documents, pictures, emails, contacts, etc) and wiping the computer and
installing from scratch.

I don't recommend that lightly - but...

http://groups.google.com/group/micr...0/992fc976519c105d?lnk=st&q=#992fc976519c105d

and

http://groups.google.com/group/micr...1/05fe465138260bcb?lnk=st&q=#05fe465138260bcb

Essentially you have gotten to a point where you are unsure what you have
and whether or not what you might have is good or bad. It is at that point
that the wisest thing to do is (IMHO) start afresh.

- Hook up some external hard disk drive or burn DVDs/CDs of your important
sstuff (keep that machine off the network.) Copy everything you need.
Pictures, documents, spreadsheets, images, emails, contacts, text files,
serial keys, installation files, etc. If you can - get an imaging
application (Norton Ghost, Acronis TrueImage, BootItNG, etc) and make a
complete image of your hard disk drive onto an external device and you can
go back later for anything you did not back up.

- Install Belarc Advisor on the machine (from an external drive or
something) and run it - print the results. That should have your Windows
Product Key, other software with Product keys that register on the machine,
a list of stuff you have installed and a list of the hardware installed on
your machine.

- Break out all of your installation media and keys/etc (Windows XP
installation CD, any office suites/products you have - etc...) Any program
you need to have installed on the computer, find its installation media
(even if it is an installation executable file and a text file with the
serial number in it) and get it onto media seperated from the machine so you
can install using it later.

- Now that you have everything backed up and everything ready to install...
Clean install Windows XP:
http://www.michaelstevenstech.com/cleanxpinstall.html

- Update the hardware drievrs...

- Get Windows XP SP3 from another computer onto CD or thumb drive or
somehting to the newly formatted drive... Install it.

- Install your other software (AV and such).

- THEN connect to the Internet and get updates from
http://windowsupdate.microsoft.com/ ...

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

 

[Root Kit]

On Thu, 24 Jul 2008 09:22:02 -0700, Annie
<Annie@discussions.microsoft.com> wrote:

>Just called BrightHouse and they had to reset my router.

So afterwards, did you make the basic router securing as suggested?

 

[Root Kit]

On Thu, 24 Jul 2008 10:32:01 -0700, Annie
<Annie@discussions.microsoft.com> wrote:

>post too long...deleted some.
>
>
>Thought I had the problem fixed. No such luck.
>
>ZA is still blocking to port 2869.

If it's blocked there's not that much to worry about.

> Constant incoming alerts are driving me crazy.

Yes, but you asked for that yourself by installing ZA.

> Do I need to have this port open? If not, how do I close it? I
>don't have anything networked such as wireless printers,
>computer-to-computer, palm, etc.

Any peer-to-peer app's?

Skype?

Anyway, download and run CurrPorts from NirSoft to try and identify if
some app is using the port mentioned.
http://www.nirsoft.net/utils/cports.html

 

[Root Kit]

On Thu, 24 Jul 2008 13:03:01 -0700, Annie
<Annie@discussions.microsoft.com> wrote:

>Thank you, Tom, but I still don't know how to disable the port.

I think Tom is suggesting that UPnP is enabled in your router. And he
may very well be right. Did you make the basic router securing as
suggested?

 

[Root Kit]

On Thu, 24 Jul 2008 23:06:31 GMT, Root Kit <b__nice@hotmail.com>
wrote:

>Yes, but you asked for that yourself by installing ZA.

Windows firewall would just have silently blocked it.

 

[Root Kit]

On Thu, 24 Jul 2008 10:32:00 -0700, Dan
<Dan@discussions.microsoft.com> wrote:

>Annie, the key word you used is that you Think your Machine is Clean (TMC)
>and unless you run anti-virus programs like Windows Live One Care, Spybot
>Search and Destroy, Kaspersky, and AVG 7.5, and others then how will not be
>sure.

The app's mentioned cannot in any way guarantee that a machine is
clean. Only a thorough comparison of relevant system files to a known
safe baseline can give a trustworthy hint about a systems state. This
is not a task for Joe Average.

>Please make sure only one antivirus program is installed at a time and
>beware of false positives because anti-virus programs like Avast have gotten
>much worse over time. For example, Avast Antivirus thought that Yahoo web
>portal had malware when it did not.

Anti-malware products often cause more problems than they solve.

 

[Annie]

I disabled UPnP in the router settings. Also disabled UPnP and SSDP
Discovery Service on my computer. No more messages since I did this.
Everything seems to be running smoothly right now.

In doing this, I found a file I don't recognize. B's Recorder GOLD Library
General Service. bgsvcgen.exe Is this something that should be uninstalled?
(it's not in my add and remove folder) I have no idea what it's doing on my
machine.
The HJT guy said he didn't find any malware so I'm guessing it's OK to leave
on.





"Root Kit" wrote:

> On Thu, 24 Jul 2008 09:22:02 -0700, Annie
> <Annie@discussions.microsoft.com> wrote:
>
> >Just called BrightHouse and they had to reset my router.
>
> So afterwards, did you make the basic router securing as suggested?
>