[15Peter20]

It's been confirmed to me today that the malware on my computer has been manually installed by an individual who is actively monitoring me for personally malicious reasons (see 'Rootkit question' thread further down the page).

Is there anything you can really do in this situation? I already have antivirus software and a firewall, and if I format my computer they can probably still just hack me again if they so desire. Does anyone have any ideas?

[HCD]

Anti - Virus programme won't make a jot of difference. What firewall are you using? Depending on where you are in world.....differing local solutions on legal redress.

[hrlow2]

hello15Peter20. Don't know about yours, but my firewall allows me to block incoming from any specific IP address if I wish. If you know who did it and can get their IP, just block their access, then sit back and laugh at them. Another cute program is called Slap to let them know that you know.

[15Peter20]

I'm using free ZoneAlarm and I'm in the UK. All the hacker has done so far is make the edit to my post in the rootkit thread, and I don't know who it is (I can't think of anyone I know who'd have the incentive to personally break into my computer, but obviously someone has). Would legal action be possible in the UK by tracing their IP or something?

[hewee]

If you got ZoneAlarm Pro you can Increasing security in the ZA firewall.

Configuring The Standard Settings

Launch ZoneAlarm Pro and click to highlight the "Overview" tab on the left hand side . In the pane that appears on the right hand side click the "Preferences" tab and in the section "Check for updates" check "Manually".
In the "General" section you can also configure ZoneAlarm to load at start up which is advisable because this software is your first line defence against uninvited invasion of your computer by a whole gamult of virues,trojans,spyware, adware and bots! Virus checking software does have its place but remember that prevention is always better than cure!

ZoneAlarm Pro's program control is automatically configured. When you run it for the first time it will ask on behalf of programs installed on your system for permission to access the Internet. Your Browser will be the first to request - just tick the "Yes" box and the "Remember this setting" box and ZoneAlarm will always allow your browser access automatically.

Unless you use online databases etc., there should be no reason for any application other than a browser, email client, ftp client, streaming media player or a download manager to gain access to the Internet.

So consider what type of program it is that needs Internet access before giving ZoneAlarm permission to allow it. If it is just a driver file (.DLL) that requests Internet access, always search Windows to try and identify it. Many seudo-virii such as AdWare and sub class seven Trojans access the Internet from your system using .dll files.


Configuring The Advanced Settings

(Note) If you are NOT on a LAN (connected to another computer in a network) you can use the following section of this guide to give your firewall some real muscle....

Launch ZoneAlarm Pro and click to highlight the "Firewall" tab on the left hand side . In the pane that appears on the right hand side in the section "Internet Zone Security" set the slider control to "High"
Then click the "Custom" button in the same section.
The next settings page is divided into two sections with tabs Internet Zone and Trusted Zone at the top of the page. Under the Internet Zone tab there is a list of settings that can be accessed by scrolling. At the top is the high security settings and the only thing that should check from there is "allow broadcast/multicast". The rest should be unchecked
Scroll down until you get to the medium security settings area. Check all the boxes in this section until you get to "Block Incomming UDP Ports". When you check that you will be asked to supply a list of ports, and in the field at the bottom of the page enter
1-65535
Then go back to the list and check the box alongside "Block Outgoing UDP Ports" and at the bottom of the page enter
1-19, 22-79, 82-7999, 8082-65535
Repeat this proceedure for the following settings
"Block Incomming TCP Ports": 1-65535
"Block Outgoing TCP Ports": 1-19, 22-79, 82-7999, 8082-65535
Then click "Apply", "Ok" at the bottom of the page.

Back in the right hand "Firewall" pane go next to the yellow "Trusted Zone Security" section and set it to "high" with the slider. Click "Custom" and repeat the above proceedure this time choosing the Trusted Zone tab at the top of the settings page.

These settings will stop all incoming packets at ports 1-65535 and also block all pings, trojans etc... this will also stop all spyware or applications from phoning home from your drive without your knowledge!

[Mumbodog]

If you really suspect a Root kit is installed, reinstall the OS clean.

Good rootkits can mask any activity they perform from the operating system or security software that is installed. The only way to get rid of it is to clean install the OS, rootkit scanners don't find all rootkits either.

[15Peter20]

Looks like I'll have to pay for an upgrade to ZoneAlarm pro then, but I'm honestly not even sure that will help because of the nature of the attack. After I reinstall the OS and get ZoneAlarm pro, I'm sure the guy can probably just hack me again if he's determined enough.

[HCD]

I use Comodo Firewall - which is ranked as one of the top 3 firewalls.
http://www.matousec.com/projects/firewall-challenge/
I've also found it to be very easy to adjust settings. In respect of the hacker....you can spend a lot of time tracking inbound data signals without success, there are a number of programmes which will allow you to track the IP address of any rootkit source. I've done that with a private detective a couple of months ago for a customer. We resolved the issue very quickly. My advice to you is clean the PC with a full restore and then after looking at Matousec - use a top notch firewall.