Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I suspect that my system has been hacked into. I see huge drops in free hard disk space for a while and then the space returns to near old values. A few days ago, when i clicked 'my computer', i saw the properties of the computer instead of 'my computer'. Start menu showed me the same thing. I rebooted my system and things became normal. All my browsers hang for a while. Additionally, sometimes my FB login page looked weird and unlike the regular page (Browser injection???) Then, there are these chinese alphabets in the attached image.

HKEY_CLASSES_ROOT\楖敤䱯乁嘮䍌汐杵湩.1

Is it possible that my system is infected with some stealthy malware? If yes, how do I check if it is really malware?

I am worried to death now. all the paid av, sandboxing, no-scripting finally might have amounted to nothing. :(

Thanks in advance.

enter image description here

share|improve this question
I assume/hope you've run multiple anti-virus scans? Malwarebytes, etc.? – Anorov Mar 1 at 9:38
Which browser, AV, firewall and sandboxing applications were you using? I'd really like to know. – Matrix Mar 1 at 13:01
@Matrix - why do you want to know? – FirstName LastName Mar 2 at 17:46
@Anorov - Ok, I admit that I am a little lazy to take the trouble of installing multiple AV's. But, I doubt if MBAM or any other software would help at this stage. – FirstName LastName Mar 2 at 17:56
@FirstNameLastName - To see what other people are using. – Matrix Mar 2 at 23:28

2 Answers

up vote 1 down vote accepted

Source appears to be the VLC browser plugin. The weird name is a text encoding bug (ASCII as UTF-16).

Not anything to worry about in itself.

share|improve this answer
bobince - oops. got that. but, the other behaviors really bother me. how do i investigate? – FirstName LastName Mar 1 at 9:55
Can you post an example of what you mean by the Facebook page being different? – bobince Mar 2 at 13:14
bobince - sorry, i did not take screenshots of all that. But, now I notice that my computer usually becomes slow for a few seconds when I search for facebook. – FirstName LastName Mar 2 at 17:50
up vote 2 down vote

If you in any way suspect that your system has been hacked first and foremost you should focus on backing up your data. Chances are you are going to have to wipe your entire system and start over, and you don't know how long you will be able to use your system.

Once you have safeguarded your data there are some avenues for investigation I would pursue:

  1. Look at what is taking up space on your disk. Try and save some of it externally. There are few good reasons that your free space usage would see-saw like that
  2. Do a packet capture on your network interface and see what your system is contacting. Filter out what is genuine, and look up some of the rest to see if any are known c&c hosts for botnets

Of course, if your system has been taken over there's nothing you can do to gain 100% assurance that you've fixed it, as these days malware tends to be extremely persistent. Investigating these things tends to be more of an academic exercise, to find out what has taken over and understand it. You can sink a lot of time on investigation with no result, if it were me I'd back up my critical data and rebuild.

share|improve this answer
GdD - I suspected that it would be an academic exercise. Damn. But, I am skeptical that a back up could help. If this is really a malware attack, then the back up could be infected too, making the whole exercise futile and fatal. What do you think? – FirstName LastName Mar 2 at 17:51
It is a legitimate concern, however the risk is actually pretty minimal. Most malware does not act as a virus, infecting other files, so in all likelihood your files are safe. The exceptions to this are the files that infected you, if you opened a fake attachment for example. Besides, if you don't back up your date what will you have to work off of? – GdD Mar 2 at 20:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.