OS: Windows 7 Enterprise Edition (90 Day Trial Version)
I put my computer into a DMZ so that I could host a server for a little while. (Port Forwarding was not working in my version of DD-WRT that I had installed on my router.) After a little while someone made a connection to my computer via Remote Desktop Connection. In fact, he is typing to me on the compromised computer right, asking me if "I will license", and that I should "wait 5 minutes". (Needless to say, I typed back and told him to ... well shove it.)
netstat command from the comprised computer showed this
TCP 192.168.1.50:49198 qy-in-f125:5222 ESTABLISHED so I'm guessing he changed my hosts file to that his IP address would be hidden. He also changed the admin password on box, and demoted my account so that it's not admin. I can login to my own account and do the non-admin things that I like, but that's it.
He also comes back every time I turn on my computer, usually within about 25 minutes, but some times as little as 2 or 3 after I turn it on. SO I have a feeling that he uploaded something that runs on startup and calls home.
To me, this seems like the work of a script kiddie, and someone who does not speak English very well. All my doors where open as well as my windows. (No pun intended.) I had RDC enabled to allow remote connections from outside my network.
After this is over I will be formatting the whole computer, but I wanted to know if there is anything I can do to track back this guy so I can hand over his IP address to the cyber crime authorities in my area.
[EDIT] My router had my now compromised computer's IP address on the local network set to the DMZ address in my router. I know how to setup Port Fording, but like I said, it does not work in my version of DD-WRT, I'm using a beta, unstable version of DD-WRT. I did not have the Windows Firewall turned on at all. I believe that it's RDC because Windows asks me if it's OK to allow Administator/DESKTOP-PC to connect. Task Mangager only shows my account, to view the proceess over the other accounts I need Admin, and he's changed my admin password. He was typing to me through the open command line console I had open so that I could do the netstat command. After I did the netset command, I was using another linux laptop to find out if I could get his IP address from his hostname. While I was doing that, I noticed that there was some text in the console that I did not write that said "You will license, wait 5 minutes." in the command line console. This is why I think he is using RDC, because it's apparent that he can see my computer's desktop. I'll try the tcpvcon connection, and I'll give Hiren's Boot CD a go. I'll check the AutoRun log after I have regained admin access to my account, and I'm using the 64bit version of Windows 7. And I will for sure try NetFlow, but I think I'll have to update my router's Firmware to a later version that what I already have. Thank you for your help so far!