[Closed] I am being hacked.

Hello all!

Now I know its a rather bold thread title, and some may think that I am jumping to conclusions, but I believe that I am being hacked.

Now this all started a while back, when in a game an argument broke out, with someone who I know. He got quite mad off, and started throwing out stuff that he would get me banned from the game, etc.
A couple of weeks pass, and I receive a message from the same person. "Enjoy your break". As soon as the message was received, my internet goes down for about 2 hours. Suspicious.
This has happened a few more times, with similar messages. And in the periods of disconnection, sometimes when I manage to get back online, I message the person why he may be doing this, and I get disconnected again straight away.
I know where this person lives, in Sweden.
So, I have been checking my firewall logs to see whats been up, and around the time of the disconnections, I find this:
Packet blocked by active defense (IDS)
192.168.1.10:50060
213.80.109.150:80
and alot of similar stuff like it:
21/03/2010 14:34:52 Communication denied by rule fe80::9853:f86c:4b35:123c.:1900 ff02::c.:1900 UDP Block outgoing SSDP (UPNP) requests C:\Windows\System32\svchost.exe NT AUTHORITY\LOCAL SERVICE

Packet blocked by active defense (IDS)
213.80.109.150:80
192.168.1.10:50095
TCP
I did a whois on the ip [removed] and it turns out its an internet end user from Sweden.
I'll attach a link to my firewall log (eset smart security) so you guys can look through it fully.
The funny thing is aswell, when my internet goes down, its not only on this PC, which is wirelessly connected to the router, its also on the PC that is connected directly to the cable.
Link to Firewall log, there is alot of suspicious stuff going on when my internet is "down", which is pretty much the entire duration of the log: http://www.sendspace.com/file/ydhi1n
When I ran GMER I got blue screen of death.

Another attachment: A wireshark recording of a couple of seconds after a disconnection.: http://www.sendspace.com/file/pwq1x8

Hello and Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise. This may cause a delay, but I will do my best to keep it as short as possible. I am checking over your log , I will post back shortly with instructions.

Hi,

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
• Do not install/uninstall anything on your computer unless advised.
• Do not run any other scanning tools other than those instructed for you to use.
• Follow the instructions on the order they are given.
• Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
• If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
• If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 24 hours then the topic will be closed.
• And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

You will need to right click and choose "Run as Administrator" to run the tools we will use.

Are you using a proxy server?
Can you tell me more about this program? C:\Program Files\WhatPulse\WhatPulse.exe

–Next–

You have µTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/d/security-centra…-p-id-theft-103

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

I would recommend that you uninstall µTorrent, via Control Panel -> Add or Remove Programs.

However, if you do not wish to remove this program please be advised not to use the said program during the course of cleaning your machine.

References for the risk of these programs can be found in these links:
http://www.esecurityguy.com/p2p_file_sharing
http://www.microsoft.com/protect/data/down…ilesharing.aspx

–Next–

Please download DeFogger to your desktop.
Right click DeFogger then choose "Run as Administrator" to run the tool.

• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• If it needs to, DeFogger may ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.

–Next–

Try running GMER again, if that fails, try running it in safe mode:
To do this,

• Restart your computer.
• Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
• When a list of menu appears, scroll to Safe Mode using the arrow keys then press Enter.
• Log in with an Administrator account.

To post in your next reply:
1. About proxy the file above.
2. Defogger log.
3. GMER log.

WhatPulse (whatpulse.org) is just a program that measures stuff like how far in miles youve moved your mouse, and how many clicks you do and uploads it to whatpulse.org, totally harmless. defogger: defogger_disable by jpshortstuff (23.02.10.1) Log created at 16:43 on 24/03/2010 (Zerohour) Checking for autostart values… HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. HKCU:AlcoholAutomount -> Removed Checking for services/drivers… Unable to read sptd.sys SPTD -> Disabled (Service running -> reboot required) -=E.O.F=- GMER gave me a blue screen even in safe mode, in safe mode it crashed when at the bottom it said scanning the hidden shadow volume or something, and in my event viewer I can find this which corresponds to it: Volume Shadow Copy Service error: Writer with name WMI Writer and ID {a6ad56c2-b509-4e6c-bb19-49d8f43532f0} attempted to subscribe in safe mode. Operation: Initializing Writer Context: Writer Class Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0} Writer Name: WMI Writer

Hi,

How about the proxy server? Are you using it?

–Next–

Let's try GMER once more, run GMER, this time on the right hand column, click on "Files" on the box beside it to uncheck then try running GMER again, try it first in normal mode then go for safe mode if still won't work.

If that fails then do the following:
We Need to check for Rootkits with RootRepeal
Please download RootRepeal one of these locations and save it to your desktop
Here
Here
Here

• Right click [external image: Posted Image] then choose "Run as Administrator" on your desktop to run the tool.
• Click the [external image: Posted Image] tab.
• Click the [external image: Posted Image] button.
• Check just these boxes:
• [external image: Posted Image]
• Push Ok
• Check the box for your main system drive (Usually C:, and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post.

–Next–

OTL:

• Download OTL to your desktop.
• Right click on OTL.exe then choose "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• Copy and paste the following bold text into the box under Custom Scan
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  /md5stop
  CREATERESTOREPOINT
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt and post it with your next reply along with the Extras.txt log.

To post in your next reply:
1. About the proxy server.
2. GMER/RootRepeal log.
3. OTL logs.

Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 24 hours.

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic