I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi since I knew it was unprotected. I put all of the files I wanted to keep onto two external hard drives. Then I deleted them from the internal hard drive. When I went to find a file on the external hard drive a day later, it wasn't there, so I performed a system restore from a very old back up, and then I downloaded a recovery tool from cnet downloads. My intent was to get all of the files back and repeat the saving. I did that and got some files back, so I just left the program open and the computer on, but in sleep mode. I thought I disabled the wifi connection, its my usual practice to do so, but I admit, I may not have.

Due to work/travel I just left the computer on for like 3 or so months in the sleep state with the program open under my windows user profile. It would occasionally leave sleep mode but the screen would stay off, I could just hear it wake and then sleep, I assumed it was just me stepping too hard and moving the mouse or something like that. When I woke the computer on purpose after all that time, it was open in under my dad's windows user profile, which isn't password protected. I also checked and saw that the wifi was connected.

I live alone, so the odds of someone physically using my computer is ~.001% as I haven't had guests, and nothing was missing and there was no sign of entry. Also on the desktop of my dad's user profile was the verizon fios home manager icon which seemed new, but then again I never was on his profile, but I personally don't remember this being there, and he never used the computer, I just set it up for him.

  1. Was I hacked?

  2. How can I check?

  3. Could someone have accessed my plugged in external hard drive? I had WEP protection on my Fios router. Which I know isn't safe (now). Sorry for the long post. Just wanted to be thorough.

Additional info: I downloaded Avast immediately after I thought something was wrong and I turned on the highest level firewall and disconnected the wifi. I scanned every drive 3 or 4 times and didn't find anything. I then turned the computer off and haven't had it on since. That was approximately a month ago.

  • There is so much you say that you don't know, I'm not sure how we will know when you don't. – schroeder Oct 4 '15 at 3:23
  • From what you have said, an attacker wouldn't need a virus. The machine was open and available for someone to simply crack the machine remotely. Blow away the machine and reinstall from backups. – schroeder Oct 4 '15 at 3:26
  • @schroeder thanks, any way to check if it was accessed? And would it have been difficult for them to see my external hard drive data or simple – DavidR Oct 4 '15 at 3:29
  • @schroeder also, is there a standard motive behind this? like should I be concerned that someone was trying to steal financial information? or my photos? there wasn't anything worth stealing, so I'm just trying to understand why they would do this. – DavidR Oct 4 '15 at 5:14

I would certainly format the computer but if you do not want to, and assuming you do not have a rootkit, you could:

-Use netstat to check active connections and see if there is something strange going on.

-If you are willing to, would be to proxy the traffic of your computer through another device and have wireshark or tcpdump capturing the traffic(a small raspberry pi?). Analyze it.Using a trusted external device would rule out the possibility of seeing tampered results.

-Check your running processes and startup ones. Check for those with high/intermittent cpu or high/intermittent network usage. When you are away from your pc, do as i do and disconnect the network cable. Check if the computer turns on even with the cable unplugged. This won't probably rule out anything if the malware connects to a malicious server but let us assume it is the opposite (the server connects to your pc and wakes it up).

-Paranoid mode: create a usb bootable kali and run some AVs and rootkit detectors on the hard drive. Running an AV on a compromised machine rarely works. You can also check the applications running on boot through the bootable distro. This also rules out the possibility of the OS misbehaving.

-As for the wireless, go to the admin page of the AP and disable wifi (to prevent a hacker who found your password from keeping the access). Change to WPA2-PSK and change the password (bigger is better). Through the interface check the connected devices: mac addresses and compare them against your list of devices. A malicious AP could also be ruled out by having you capture wireless/ethernet traffic from it to your devices to check if it is compromised and attempting to compromise the internal network.

Good luck and stay safe ;)

  • what reason would someone have to do this? Do you think they were out to steal my documents/pictures or financial info or something else – DavidR Oct 4 '15 at 16:31
  • What do you mean a reason to do this? Why should people do all this? Is that the question? In that case the answer is depends on the assets you are protecting. If you do not have anything special on your pc, just format it (faster,safer). If you need to check for compromise signs you cant escalate your paranoia from simple netstat to external proxy host. It depends on your needs and paranoia. Not sure if i answered but let me know if i did not – BrunoMCBraga Oct 4 '15 at 19:10
  • sorry for not being clearer, why would a hacker put any effort into compromising my machine, I'm a male, don't have any assets worth their time. So I'm seeking understanding as to why my machine was targeted. Also, the only time I used the Internet was to download recover from cnet downloads, but I did leave the Internet connected through wifi for one month while the computer was idle. Don't know if that changes anything. – DavidR Oct 5 '15 at 0:51
  • I will completely erase and reinstall, and probably only use the machine offline as its not my main computer anymore, I just was hoping you could give insight as to whether I should be expecting to see my pictures surfacing on the Internet somewhere or funds being stolen. I didn't have anything racy (if I did it was just screenshots from online) and I changed all my bank passwords/info. Thank you for your answers. – DavidR Oct 5 '15 at 0:55
  • Oh, i understand now. The typical internet user which was infected was typically at the wrong place at the wrong time. Unless you have an evil neighbor or someone who dislikes you, you will probably catch a malware from some hacker who intended to infect as much people as he could. If you happened to be an NSA employee, he has won the lottery, otherwise he may keep your data just in case. As for the wi-fi, if you changed the security to WPA and put a big key, you do not need to worry. Don't worry. Just format the pc, be careful and good luck;) – BrunoMCBraga Oct 5 '15 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.