Re: [SLUG] addendum

From: steve szmidt (steve@szmidt.org)
Date: Thu Jun 18 2009 - 13:04:37 EDT


On Wednesday 17 June 2009, Pamela J. Ashworth (webmail) wrote:
> -----Original Message-----
>
> >From: "Shawn J. Goff" <shawn7400@gmail.com>
> >
> >I'm not quite understanding the problem. Is it that something is using
> >up your cpu but you don't know what?
>
> it's possibly you only saw part 2.
> something *was* running up my system. my brother investigated. it was
> someone from an IP in Romania running a "scanner"?
>
> but actually my question was, how in the heck do I shut down KDE without
> shutting down the whole machine. "Log out" isn't logging me out.
> And I don't want to control, alt, backspace.

Well, with your visitor from Romania, it looks like you pretty much just need
to backup your data (documents etc that you have created) and do a fresh
install. Which would include the vital step of reformatting your drive.

If someone is running something on your computer, then you don't know what
else they may have done. There is a good likelyhood that there now is a nice
backdoor for them to get in through whenever they feel like it.

On the otherhand if someone was simply remotely scanning your computer to see
what open connections there might be on your computer, then it does not mean
they gained access to your computer.

The odd thing here (with the limited information you've given) is that you
said you were running at a very high CPU load, apparently at the same time as
the Romanian was there. If that is the case then it definitely sounds like
a "break-in".

People break in to computers for many different reasons. Some is to use your
computer as part of a much larger nefarious scheme against someone else.
Leaving you and your fellow victims to answer authorities. Some do it for
fun, others install programs that will record all your keystrokes, recording
how you for example login to your bank account, etc.

Organized crime moved online years ago and are behind a lot of the online
crimes these days. The thing is that your only realistic way out of being
part of their "team" is to do a fresh install.

The only thing to do now is to attempt to establish if they left signs of
being there or if by now they have cleaned out all log entries.

Stopping you from logging out could be an intentional thing done to stop the
application(s) they left there from being killed, or simply a by product
where they wanted enough time to do their thing.

If possible it would be good to find out what services you have running on
your computer. In otherwords there has to be some program running which
accepts a remote connection or they can't break in without gaining physical
access to the computer.

One of the commonly running services is a program written to allow secure
remote connections. It is called Secure Shell. It runs under the name sshd.
It is very secure provided your logins are using secure passwords.

A lot of people think that they don't have anything anybody would want, but
even if that was true - how would they know without breaking in first?

The other thing is that all people with an internet connection can become part
of a large unknowing and unwilling group of people who's computers are used
to attack others. So even if you don't have anything of value in your
computer, your connection is of value to online criminals.

Find someone with the time and knowhow to walk through your computer and
verify passwords and check logs to see what it looks like. At this point I
would say the odds are heavily against you if indeed your computer load was
at 26 and you had a visitor from Romania at the same time.

-- 

Steve Szmidt

"They that would give up essential liberty for temporary safety deserve neither liberty nor safety." Benjamin Franklin ----------------------------------------------------------------------- This list is provided as an unmoderated internet service by Networked Knowledge Systems (NKS). Views and opinions expressed in messages posted are those of the author and do not necessarily reflect the official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 20:17:32 EDT