Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have worked with computers since 1972. Started with teletypes, went to demand terminals, mainframes, minis, micros, supercomputers - been there done that. Have a wife who likes to play online games, Limewire, etc. - She gets us viruses, malware, and everything else. Talked to her - she still does it. I also run a web server, email server, ftp server, and we are attacked on a daily basis by various parties. One of them got through or my wife downloaded something that allowed this to happen. That is my background info.

I first realized something was wrong when I noticed our router transferring files like crazy. I immediately shut down the router. After doing a complete check of the systems I found the following strange things:

  1. TCPView had been deleted off of all of the systems.
  2. File sharing had been re-instated (I had turned it off).
  3. Offline file sharing was enabled (I had turned this off as well).

Other than the above - I could not find any additional accounts, groups, locations, partitions, viruses, malware - nothing to account for why or how this was happening.

I went to majorgeeks.com and we went through the malware removal stuff - only - there wasn't any malware detected.

I have five Windows boxes. These are:Server, Graphics, Development, Wife's, and TV. Only Wife, Development, Graphics, and Server were affected. After resetting file sharing and offline files to being turned off my wife's computer and my computer work normally now. I also restored the OS to a backup version of a few weeks ago.

Graphic computer will have to have the OS reinstalled because for unknown reasons the backup of the system does not contain the OS. The Server no longer will talk to the internet UNLESS I plug it back into the backup external USB drive - then it tries to send information over the internet to some unknown location, and re-instates the file sharing and offline files options.

One time I managed to be in the Local Security Policies and was looking at whom I deny logon to the system for and there was a new Location called MININT. This has disappeared and I can not get it to come back so far.

I am loath to just reinstall the OS because I want to find out who has done this and the best way to do that is to figure out what they have done and to undo it. However, we can not get any e-mail until I fix the problem. So I may have to just re-install the OS.

This morning, after posting on majorgeeks.com an update I went to look at what was going on on the network and I discovered that TCPView had been deleted again. So there is something still on my Developer system too. So I may have to re-install the OS there as well to get rid of the problems.

Any idea what may be going on? (Other than a hacker has installed something onto my system and no one seems to be able to figure out what that "something" is?)

share|improve this question

closed as not a real question by TFM, Mokubai, Siim K, ChrisF, Kez Mar 3 '13 at 12:35

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
I think that you might want to make the title of this question a bit clearer and include something about exactly what you want answering. As it is, you've assume you've been hacked in the title but are then questioning it. That might get a few more people looking and prepared to answer. –  Julian Knight Mar 2 '13 at 18:29
2  
Could you maybe edit the question to make it more clear what the actual problem is? I'm not really sure what you're looking for help with... –  nhinkle Mar 3 '13 at 6:01

1 Answer 1

I don't really know where to start.

What's with the paranoia? The OP is determined to find evidence of "hackers" in his computers- despite overwhelming evidence to the contrary.

Let's break it down:

Network traffic on that router was perfectly normal.

There are 5 systems connected to the router. In terms of background network activity, they could have been downloading Windows updates, application updates, anti-virus definition updates, or maybe the OP's wife was running Limewire/streaming radio in the background. In terms of other network activity: the wife could have been been using Netflix, streaming video- or basically anything else you can do on the internet.

Now we will never know. The "suspicious" network activity is no longer happening, and systems have been wiped.

And what about WIRELESS? There is no mention in the question that the OP had ruled this out.

The OP makes wild assumptions and treats them as fact.

Network activity doesn't necessarily mean "files are transferring like crazy". Without knowing what this network activity was, how can you say it's specifically due to file transfers? There are many things you can do using an internet connection that aren't file transfers.

Here's what the OP should have done if he wanted to trace this activity:

  • calmly, without freaking out and unplugging things, see which activity LEDs on the router are active. Make a note of which ports are communicating. This will tell you which computers are involved- and is the basic first step in tracing the network activity. Basic stuff- look at the pretty twinkling lights.

  • next step: go to the computer which is communicating, open Task Manager, and see in the "Networking" tab how much data is really being pushed through (shows as a percentage of the NIC's max bandwidth). It's quick and dirty, but gives you a good overview what is happening in a matter of seconds. Now you are really starting to get an idea what is going on: you would know which computer is involved, and approximately how much data is being transferred.

  • the next step is to see what this data actually is and where it's going/coming from: run "netstat -a" in Command Prompt, and examine the output. This would have allowed someone to answer the OP's question (if he couldn't interpret this information himself)

If the OP did this, he could have solved this small mystery in about 10-15 minutes.

Instead he freaked out, took his network offline, wiped out a system which didn't have a functional system image to restore from, and took his email server offline. Not to mention interrupting the very network activity he wanted to identify, and removing any chance of finding evidence of a problem by wiping systems.

So, in summary:

If anyone else notices any unusual network activity on their own network- do the exact opposite of this guy and you should be fine.

share|improve this answer
3  
As of Windows 7, the Resource Monitor is great for checking which processes have the highest network activity. Performance Monitor is great for long term stats. –  Bob Mar 3 '13 at 12:32
    
@Dan: Nice, reasoned comment. Good to see some sensible responses. –  Julian Knight Mar 3 '13 at 21:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.