I have worked with computers since 1972. Started with teletypes, went to demand terminals, mainframes, minis, micros, supercomputers - been there done that. Have a wife who likes to play online games, Limewire, etc. - She gets us viruses, malware, and everything else. Talked to her - she still does it. I also run a web server, email server, ftp server, and we are attacked on a daily basis by various parties. One of them got through or my wife downloaded something that allowed this to happen. That is my background info.
I first realized something was wrong when I noticed our router transferring files like crazy. I immediately shut down the router. After doing a complete check of the systems I found the following strange things:
- TCPView had been deleted off of all of the systems.
- File sharing had been re-instated (I had turned it off).
- Offline file sharing was enabled (I had turned this off as well).
Other than the above - I could not find any additional accounts, groups, locations, partitions, viruses, malware - nothing to account for why or how this was happening.
I went to majorgeeks.com and we went through the malware removal stuff - only - there wasn't any malware detected.
I have five Windows boxes. These are:Server, Graphics, Development, Wife's, and TV. Only Wife, Development, Graphics, and Server were affected. After resetting file sharing and offline files to being turned off my wife's computer and my computer work normally now. I also restored the OS to a backup version of a few weeks ago.
Graphic computer will have to have the OS reinstalled because for unknown reasons the backup of the system does not contain the OS. The Server no longer will talk to the internet UNLESS I plug it back into the backup external USB drive - then it tries to send information over the internet to some unknown location, and re-instates the file sharing and offline files options.
One time I managed to be in the Local Security Policies and was looking at whom I deny logon to the system for and there was a new Location called MININT. This has disappeared and I can not get it to come back so far.
I am loath to just reinstall the OS because I want to find out who has done this and the best way to do that is to figure out what they have done and to undo it. However, we can not get any e-mail until I fix the problem. So I may have to just re-install the OS.
This morning, after posting on majorgeeks.com an update I went to look at what was going on on the network and I discovered that TCPView had been deleted again. So there is something still on my Developer system too. So I may have to re-install the OS there as well to get rid of the problems.
Any idea what may be going on? (Other than a hacker has installed something onto my system and no one seems to be able to figure out what that "something" is?)