If you have to support end users in your organization, you're probably familiar with frantic claims like "I think I've been hacked!" whenever a computer fails. While some situations require immediate action, others are simple cases of user overreaction. To help you identify and troubleshoot when a user has truly been hacked, check out the following scenario. We'll present an end-user's problem followed by diagnoses and possible courses of action to take from three Windows security experts.
The user's problem
"I'm an IT administrator with a little over 500 end users running Windows 2000 and XP. One of our users is experiencing a problem: Her Internet connection drops suddenly for no apparent reason. When she restarts her computer, everything works fine for awhile, but then the connection drops again. The funny thing is, she's noticed that her AOL Instant Messenger service still works even when she can't access her e-mail. We've already run Netstat and noticed that more unknown open connections are being used to certain ports. This particular user has a laptop and works from home frequently, so we're not sure all updates have been installed. Has her computer been hacked?"
The experts' take
Lawrence Abrams: CTO of a New York-based ISP, and owner/creator of BleepingComputer.com, a website devoted to teaching basic computer concepts focusing on the removal of malware.
Kevin Beaver: CISSP, Principle Logic LLC, author of Hacking For Dummies, co-author of Hacking Wireless Networks For Dummies.