I have posted the following problem (pasted in next paragraph) in the small
business server general questions because I believed my problem was
configuration or something related. However, I'm curious to know, can someone
possibly be working "behind me" and causing some mischief? No one else
should have access to administrator. My virus defs are up to date. I don't
see any unusual activity in log files, but then I'm not sure of what kind of
stealth is available to a sophisticated hacker.
If someone is toying with my network, is it possible to know for certain?
Please read my scenario as follows:

>I have a user that when I tried to remote to their machine this morning, the
>first attempt was met with - "there are several users logged on, which user
>would you like to assist?" There in fact was only one (that I know of).

>Then after successfully logging in a moment later, the session was ended
>with "the user has ended the session" - she didnt'.

>Then when I try to go back in, the response is not repeatedly, "the user has
>denied remote assistance"
>The same thing happened moments later when I tried to log in to another users >session on another computer. - kicked out and then denied on repeated attempts


Any help would be great.

RE: novice question by Pandaman

Pandaman
Fri Dec 16 13:03:02 CST 2005

Virus software and definitions up-to-date !!!
Full scan on all machines with all settings ON ,like heuristic,all files +
compressed ...


Antispyware software (with real time) and its definitions up-to-date !!!
Full scan on all machines !!!

@ Microsoft Antispyware
http://www.microsoft.com/download

@ Ad-Aware SE Personal ed. (free for personal and non-commercila purpose_
http://www.lavasoftusa.com/software/adaware


All Updates for Windows (or any other operating systems) downloaded and
installed

Full firewall on all machines ,servers protected and stuff like that.

Don't you have administrators or any other people who can really check what
is up?
For us and especially for me it is difficult to know what's on in a
corporate environment.


Panda_man
--
Let's beat malware black and blue
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://www.microsoft.com/protect




"instauratio" wrote:

> I have posted the following problem (pasted in next paragraph) in the small
> business server general questions because I believed my problem was
> configuration or something related. However, I'm curious to know, can someone
> possibly be working "behind me" and causing some mischief? No one else
> should have access to administrator. My virus defs are up to date. I don't
> see any unusual activity in log files, but then I'm not sure of what kind of
> stealth is available to a sophisticated hacker.
> If someone is toying with my network, is it possible to know for certain?
> Please read my scenario as follows:
>
> >I have a user that when I tried to remote to their machine this morning, the
> >first attempt was met with - "there are several users logged on, which user
> >would you like to assist?" There in fact was only one (that I know of).
>
> >Then after successfully logging in a moment later, the session was ended
> >with "the user has ended the session" - she didnt'.
>
> >Then when I try to go back in, the response is not repeatedly, "the user has
> >denied remote assistance"
> >The same thing happened moments later when I tried to log in to another users >session on another computer. - kicked out and then denied on repeated attempts
>
>
> Any help would be great.
>
>

RE: novice question by instauratio

instauratio
Fri Dec 16 13:18:03 CST 2005

I have a pix firewall that is pretty tight. I am the only admin. The system
is relatively new (less than 1 year). The firewalls on individual machines
are on.

So, I gather from you response that it's possible that some worm or trojan
is on the machines and is preventing my access?

I should add, that I just tried back again and this time it let me in.!?
Don't know what I've done different.

All feedback is welcome and much needed. thanks

"Panda_man" wrote:

> Virus software and definitions up-to-date !!!
> Full scan on all machines with all settings ON ,like heuristic,all files +
> compressed ...
>
>
> Antispyware software (with real time) and its definitions up-to-date !!!
> Full scan on all machines !!!
>
> @ Microsoft Antispyware
> http://www.microsoft.com/download
>
> @ Ad-Aware SE Personal ed. (free for personal and non-commercila purpose_
> http://www.lavasoftusa.com/software/adaware
>
>
> All Updates for Windows (or any other operating systems) downloaded and
> installed
>
> Full firewall on all machines ,servers protected and stuff like that.
>
> Don't you have administrators or any other people who can really check what
> is up?
> For us and especially for me it is difficult to know what's on in a
> corporate environment.
>
>
> Panda_man
> --
> Let's beat malware black and blue
> Panda TruPrevent - the most intelligent technology to combat unknown malware
> http://www.pandasoftware.com
> http://www.microsoft.com/protect
>
>
>
>
> "instauratio" wrote:
>
> > I have posted the following problem (pasted in next paragraph) in the small
> > business server general questions because I believed my problem was
> > configuration or something related. However, I'm curious to know, can someone
> > possibly be working "behind me" and causing some mischief? No one else
> > should have access to administrator. My virus defs are up to date. I don't
> > see any unusual activity in log files, but then I'm not sure of what kind of
> > stealth is available to a sophisticated hacker.
> > If someone is toying with my network, is it possible to know for certain?
> > Please read my scenario as follows:
> >
> > >I have a user that when I tried to remote to their machine this morning, the
> > >first attempt was met with - "there are several users logged on, which user
> > >would you like to assist?" There in fact was only one (that I know of).
> >
> > >Then after successfully logging in a moment later, the session was ended
> > >with "the user has ended the session" - she didnt'.
> >
> > >Then when I try to go back in, the response is not repeatedly, "the user has
> > >denied remote assistance"
> > >The same thing happened moments later when I tried to log in to another users >session on another computer. - kicked out and then denied on repeated attempts
> >
> >
> > Any help would be great.
> >
> >

RE: novice question by Pandaman

Pandaman
Sat Dec 17 08:43:24 CST 2005

You are the administrator ,ok.

I am not supposing anything .

You need to check all the machines for any malware .
Hackers use tools (trojans,spywares,hack tools and other) and if there is
somethings ,the security softwares will check for that.

There are so many trojans and hack tools these days that you can't just
suppose and think:
"Do I have a trojan" "Don't I have a trojan" ???
You need to check .

By the way ,in your first post you mentsion there is no unusual activity
Isn't your disablity to log in suspicious (unusual).

If there is NO malware found ,you should check the settings because not only
hackers can prevent you.Any person with real physical contact and with enough
knowledge can do everything.

Good luck !

Panda_man
--
Let's beat malware black and blue
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://www.microsoft.com/protect




"instauratio" wrote:

> I have a pix firewall that is pretty tight. I am the only admin. The system
> is relatively new (less than 1 year). The firewalls on individual machines
> are on.
>
> So, I gather from you response that it's possible that some worm or trojan
> is on the machines and is preventing my access?
>
> I should add, that I just tried back again and this time it let me in.!?
> Don't know what I've done different.
>
> All feedback is welcome and much needed. thanks
>
> "Panda_man" wrote:
>
> > Virus software and definitions up-to-date !!!
> > Full scan on all machines with all settings ON ,like heuristic,all files +
> > compressed ...
> >
> >
> > Antispyware software (with real time) and its definitions up-to-date !!!
> > Full scan on all machines !!!
> >
> > @ Microsoft Antispyware
> > http://www.microsoft.com/download
> >
> > @ Ad-Aware SE Personal ed. (free for personal and non-commercila purpose_
> > http://www.lavasoftusa.com/software/adaware
> >
> >
> > All Updates for Windows (or any other operating systems) downloaded and
> > installed
> >
> > Full firewall on all machines ,servers protected and stuff like that.
> >
> > Don't you have administrators or any other people who can really check what
> > is up?
> > For us and especially for me it is difficult to know what's on in a
> > corporate environment.
> >
> >
> > Panda_man
> > --
> > Let's beat malware black and blue
> > Panda TruPrevent - the most intelligent technology to combat unknown malware
> > http://www.pandasoftware.com
> > http://www.microsoft.com/protect
> >
> >
> >
> >
> > "instauratio" wrote:
> >
> > > I have posted the following problem (pasted in next paragraph) in the small
> > > business server general questions because I believed my problem was
> > > configuration or something related. However, I'm curious to know, can someone
> > > possibly be working "behind me" and causing some mischief? No one else
> > > should have access to administrator. My virus defs are up to date. I don't
> > > see any unusual activity in log files, but then I'm not sure of what kind of
> > > stealth is available to a sophisticated hacker.
> > > If someone is toying with my network, is it possible to know for certain?
> > > Please read my scenario as follows:
> > >
> > > >I have a user that when I tried to remote to their machine this morning, the
> > > >first attempt was met with - "there are several users logged on, which user
> > > >would you like to assist?" There in fact was only one (that I know of).
> > >
> > > >Then after successfully logging in a moment later, the session was ended
> > > >with "the user has ended the session" - she didnt'.
> > >
> > > >Then when I try to go back in, the response is not repeatedly, "the user has
> > > >denied remote assistance"
> > > >The same thing happened moments later when I tried to log in to another users >session on another computer. - kicked out and then denied on repeated attempts
> > >
> > >
> > > Any help would be great.
> > >
> > >

RE: novice question by instauratio

instauratio
Sat Dec 17 15:14:01 CST 2005

I have other reasons to be suspicious, but I guess I didn't want to be
paranoid. I'm quickly changing my mind though.

One public folder has mysteriously lost contacts twice. At first I thought
"user error" but I'm concerned because the there are only 5 users and the
odds of any of them doing twice are slim.

This appears to be an intruder who is toying a little. It's as though he
wants to cause enough mayhem to get noticed but not enough to raise
suspicions??

I don't know, but what I'm trying to understand is: if someone is in control
of a machine by remote - wouldn't I have some way of checking this or seeing
this? Wouldn't he have to leave a footprint somewhere?

I can and will set about securing the network with every concievable method.
But I would really like to know for certain that someone is trespassing or
not. How can I find out. I don't really even care who, I just want to know if
they are, and how they did it (forensics).

I have an idea that I will start loggin firewall activity since all traffice
goes through this one port. but what do I look for in the log?

thanks for all the advice!

"Panda_man" wrote:

> You are the administrator ,ok.
>
> I am not supposing anything .
>
> You need to check all the machines for any malware .
> Hackers use tools (trojans,spywares,hack tools and other) and if there is
> somethings ,the security softwares will check for that.
>
> There are so many trojans and hack tools these days that you can't just
> suppose and think:
> "Do I have a trojan" "Don't I have a trojan" ???
> You need to check .
>
> By the way ,in your first post you mentsion there is no unusual activity
> Isn't your disablity to log in suspicious (unusual).
>
> If there is NO malware found ,you should check the settings because not only
> hackers can prevent you.Any person with real physical contact and with enough
> knowledge can do everything.
>
> Good luck !
>
> Panda_man
> --
> Let's beat malware black and blue
> Panda TruPrevent - the most intelligent technology to combat unknown malware
> http://www.pandasoftware.com
> http://www.microsoft.com/protect
>
>
>
>
> "instauratio" wrote:
>
> > I have a pix firewall that is pretty tight. I am the only admin. The system
> > is relatively new (less than 1 year). The firewalls on individual machines
> > are on.
> >
> > So, I gather from you response that it's possible that some worm or trojan
> > is on the machines and is preventing my access?
> >
> > I should add, that I just tried back again and this time it let me in.!?
> > Don't know what I've done different.
> >
> > All feedback is welcome and much needed. thanks
> >
> > "Panda_man" wrote:
> >
> > > Virus software and definitions up-to-date !!!
> > > Full scan on all machines with all settings ON ,like heuristic,all files +
> > > compressed ...
> > >
> > >
> > > Antispyware software (with real time) and its definitions up-to-date !!!
> > > Full scan on all machines !!!
> > >
> > > @ Microsoft Antispyware
> > > http://www.microsoft.com/download
> > >
> > > @ Ad-Aware SE Personal ed. (free for personal and non-commercila purpose_
> > > http://www.lavasoftusa.com/software/adaware
> > >
> > >
> > > All Updates for Windows (or any other operating systems) downloaded and
> > > installed
> > >
> > > Full firewall on all machines ,servers protected and stuff like that.
> > >
> > > Don't you have administrators or any other people who can really check what
> > > is up?
> > > For us and especially for me it is difficult to know what's on in a
> > > corporate environment.
> > >
> > >
> > > Panda_man
> > > --
> > > Let's beat malware black and blue
> > > Panda TruPrevent - the most intelligent technology to combat unknown malware
> > > http://www.pandasoftware.com
> > > http://www.microsoft.com/protect
> > >
> > >
> > >
> > >
> > > "instauratio" wrote:
> > >
> > > > I have posted the following problem (pasted in next paragraph) in the small
> > > > business server general questions because I believed my problem was
> > > > configuration or something related. However, I'm curious to know, can someone
> > > > possibly be working "behind me" and causing some mischief? No one else
> > > > should have access to administrator. My virus defs are up to date. I don't
> > > > see any unusual activity in log files, but then I'm not sure of what kind of
> > > > stealth is available to a sophisticated hacker.
> > > > If someone is toying with my network, is it possible to know for certain?
> > > > Please read my scenario as follows:
> > > >
> > > > >I have a user that when I tried to remote to their machine this morning, the
> > > > >first attempt was met with - "there are several users logged on, which user
> > > > >would you like to assist?" There in fact was only one (that I know of).
> > > >
> > > > >Then after successfully logging in a moment later, the session was ended
> > > > >with "the user has ended the session" - she didnt'.
> > > >
> > > > >Then when I try to go back in, the response is not repeatedly, "the user has
> > > > >denied remote assistance"
> > > > >The same thing happened moments later when I tried to log in to another users >session on another computer. - kicked out and then denied on repeated attempts
> > > >
> > > >
> > > > Any help would be great.
> > > >
> > > >

RE: novice question by Pandaman

Pandaman
Sat Dec 17 16:46:02 CST 2005

My reply is at the bottom of your message

"instauratio" wrote:

> I have other reasons to be suspicious, but I guess I didn't want to be
> paranoid. I'm quickly changing my mind though.
>
> One public folder has mysteriously lost contacts twice. At first I thought
> "user error" but I'm concerned because the there are only 5 users and the
> odds of any of them doing twice are slim.
>
> This appears to be an intruder who is toying a little. It's as though he
> wants to cause enough mayhem to get noticed but not enough to raise
> suspicions??
>
> I don't know, but what I'm trying to understand is: if someone is in control
> of a machine by remote - wouldn't I have some way of checking this or seeing
> this? Wouldn't he have to leave a footprint somewhere?
>
> I can and will set about securing the network with every concievable method.
> But I would really like to know for certain that someone is trespassing or
> not. How can I find out. I don't really even care who, I just want to know if
> they are, and how they did it (forensics).
>
> I have an idea that I will start loggin firewall activity since all traffice
> goes through this one port. but what do I look for in the log?
>
> thanks for all the advice!
>


Panda_man >> No problem ,you are welcome.
The footprint is more files( huge increase of files) or huge decrise of
files (less files).
Sometimes he/she may leave some file especially for the user (but rarely).

Well, I can't tell you more because I am not a hacker .I don't know what
footprints they leave.By the way they delete all the tracks...:)

The most sure way you can prevent is to have router (hardware firewall)
,firewalls on all workstations.The less exceptions the better.
Why don't you use software for behaviour analyze or a software that would
keep the confidential information so that nothing can get it out from the PCs

Symantec and Panda have such things ,I belive...


instauratio wrote:
> I don't know, but what I'm trying to understand is: if someone is in control
> of a machine by remote - wouldn't I have some way of checking this or seeing
> this? Wouldn't he have to leave a footprint somewhere.

Panda_man >> As I told you ,everything is controled by programs.They use
software (called hack software ) or other malicious software.
As I told you ,check the computers (ALL computers) with

Microsoft Antispyware
Ad-Aware SE

Antivirus software ( your Antivirus software may support hack tools catching
,if it doesn't ,find some)


If the machines are malware free ,you may install a behaviour analyze
software ,like Panda TruPrevent .It isn't advertisement but their products
are may best I have ever used.

It is a new technology created in August 2004 by Panda Software that uses
special
Genetic Heuristic engine and its behaviour analyzis

and that's why it is capable to catch ,block ,neutralize and protect you
from all kind of malware ,such as new viruses ,new trojans or worms ,new
spyware /adware ,dialers ,keyloggers ,hacking software ,suspicious software
and everythings like that.

It has also a proactive technology that protects you even from
known threats that your general AV or AS has dropped (missed)
It has technology to detect intrusion attemps.

It doesn't generate false positives !

And make sure ,it has may be best instinct of self-preservation .There is
no malware that can turn it off.


Also ,its behaviur analyzis helps to block any suspicious operation .It
scans all proceses and then decides .It would block it.If somehow something
bypasses the firewall and the other regular securities ,Panda will detect it.

Panda TruPrevent is available in two versions:
1. Personal edition
2. Corporate edition

You say the network is 5 computers only so may be the Personal ed. would be
better but you have the choice only.

You may get the free trial version from here ,use it for 30 days and they
buy or remove:
http://www.pandasoftware.com/products/TruPrevent_Personal2006.htm

http://www.pandasoftware.com/download/register.htm?CodigoProducto=42&TipoLead=2&TipoUsuario=2&Tipo=1&Ref=WWEN-TPC5-DES&Idioma=2&Country=US&sec=down


And ,just a suggestion ,don't be so paranoid :-)
If you can't find anything or these instructions seems difficult ,find
someone who can help you in place ,I mean ...can see the machines personally
and work on them .It is difficult for me to talk such a general things
,because you know it is difficult to control such a things remotely.
I mean ,I told you the general things that should be done but nothing more
because I am not in front of the machines.

Good luck !!!

:-)

Panda_man
--
Let's beat malware black and blue
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://www.microsoft.com

RE: novice question by instauratio

instauratio
Sat Dec 17 17:30:02 CST 2005

I will do my best - thanks

"Panda_man" wrote:

> My reply is at the bottom of your message
>
> "instauratio" wrote:
>
> > I have other reasons to be suspicious, but I guess I didn't want to be
> > paranoid. I'm quickly changing my mind though.
> >
> > One public folder has mysteriously lost contacts twice. At first I thought
> > "user error" but I'm concerned because the there are only 5 users and the
> > odds of any of them doing twice are slim.
> >
> > This appears to be an intruder who is toying a little. It's as though he
> > wants to cause enough mayhem to get noticed but not enough to raise
> > suspicions??
> >
> > I don't know, but what I'm trying to understand is: if someone is in control
> > of a machine by remote - wouldn't I have some way of checking this or seeing
> > this? Wouldn't he have to leave a footprint somewhere?
> >
> > I can and will set about securing the network with every concievable method.
> > But I would really like to know for certain that someone is trespassing or
> > not. How can I find out. I don't really even care who, I just want to know if
> > they are, and how they did it (forensics).
> >
> > I have an idea that I will start loggin firewall activity since all traffice
> > goes through this one port. but what do I look for in the log?
> >
> > thanks for all the advice!
> >
>
>
> Panda_man >> No problem ,you are welcome.
> The footprint is more files( huge increase of files) or huge decrise of
> files (less files).
> Sometimes he/she may leave some file especially for the user (but rarely).
>
> Well, I can't tell you more because I am not a hacker .I don't know what
> footprints they leave.By the way they delete all the tracks...:)
>
> The most sure way you can prevent is to have router (hardware firewall)
> ,firewalls on all workstations.The less exceptions the better.
> Why don't you use software for behaviour analyze or a software that would
> keep the confidential information so that nothing can get it out from the PCs
>
> Symantec and Panda have such things ,I belive...
>
>
> instauratio wrote:
> > I don't know, but what I'm trying to understand is: if someone is in control
> > of a machine by remote - wouldn't I have some way of checking this or seeing
> > this? Wouldn't he have to leave a footprint somewhere.
>
> Panda_man >> As I told you ,everything is controled by programs.They use
> software (called hack software ) or other malicious software.
> As I told you ,check the computers (ALL computers) with
>
> Microsoft Antispyware
> Ad-Aware SE
>
> Antivirus software ( your Antivirus software may support hack tools catching
> ,if it doesn't ,find some)
>
>
> If the machines are malware free ,you may install a behaviour analyze
> software ,like Panda TruPrevent .It isn't advertisement but their products
> are may best I have ever used.
>
> It is a new technology created in August 2004 by Panda Software that uses
> special
> Genetic Heuristic engine and its behaviour analyzis
>
> and that's why it is capable to catch ,block ,neutralize and protect you
> from all kind of malware ,such as new viruses ,new trojans or worms ,new
> spyware /adware ,dialers ,keyloggers ,hacking software ,suspicious software
> and everythings like that.
>
> It has also a proactive technology that protects you even from
> known threats that your general AV or AS has dropped (missed)
> It has technology to detect intrusion attemps.
>
> It doesn't generate false positives !
>
> And make sure ,it has may be best instinct of self-preservation .There is
> no malware that can turn it off.
>
>
> Also ,its behaviur analyzis helps to block any suspicious operation .It
> scans all proceses and then decides .It would block it.If somehow something
> bypasses the firewall and the other regular securities ,Panda will detect it.
>
> Panda TruPrevent is available in two versions:
> 1. Personal edition
> 2. Corporate edition
>
> You say the network is 5 computers only so may be the Personal ed. would be
> better but you have the choice only.
>
> You may get the free trial version from here ,use it for 30 days and they
> buy or remove:
> http://www.pandasoftware.com/products/TruPrevent_Personal2006.htm
>
> http://www.pandasoftware.com/download/register.htm?CodigoProducto=42&TipoLead=2&TipoUsuario=2&Tipo=1&Ref=WWEN-TPC5-DES&Idioma=2&Country=US&sec=down
>
>
> And ,just a suggestion ,don't be so paranoid :-)
> If you can't find anything or these instructions seems difficult ,find
> someone who can help you in place ,I mean ...can see the machines personally
> and work on them .It is difficult for me to talk such a general things
> ,because you know it is difficult to control such a things remotely.
> I mean ,I told you the general things that should be done but nothing more
> because I am not in front of the machines.
>
> Good luck !!!
>
> :-)
>
> Panda_man
> --
> Let's beat malware black and blue
> Panda TruPrevent - the most intelligent technology to combat unknown malware
> http://www.pandasoftware.com
> http://www.microsoft.com