We have Notebook PC that has not been used by anyone other than the
normal user, but he is suspicious that a business rival may have
installed (or tried to install) eBlaster (or similar) onto it.

The notebook is used on an ADSL connection but does not have a static
IP address. It is also firewalled.

However the user cannot be sure that he has not executed an e-mail
attachment that might have done this.

So my question is: how can we check for this type of intrusion?

Any help would be much appreciated (but please dont just tell us to
replace Windows with Linux!)

Thanks in anticipation,

JohnK

On Mon, 16 Aug 2004 16:10:27 GMT, *email_address_deleted* (John F Kappler)
wrote:

John,

How current is your virus protection? Try one or more of these free online
virus scans, which should complement your current protection:
<http://www.bitdefender.com/scan/license.php>
<http://www.pandasoftware.com/activescan>
<http://www.ravantivirus.com/scan/>
<http://security.symantec.com/ssc/home.asp>
<http://housecall.trendmicro.com/housecall/start_corp.asp>

Now check for, and learn to defend against, additional problems.

Start by downloading each of the following free tools:
AdAware <http://www.lavasoftusa.com/>
CWShredder <http://www.majorgeeks.com/download4086.html>
CoolWWWSearch.SmartSearch (v1/v2) MiniRemoval
<http://www.majorgeeks.com/download4113.html>
HijackThis <http://www.majorgeeks.com/download.php?det=3155>
LSP-Fix and WinsockLSPFix <http://www.cexx.org/lspfix.htm>
Spybot S&D <http://www.safer-networking.org/index.php?page=download>

Install and run Stinger.
<http://us.mcafee.com/virusInfo/default.asp?id=stinger>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. AdAware and Spybot S&D have install routines - run them.
The other downloaded programs can be copied into, and run from, any convenient
folder.

Start by closing all Internet Explorer and Outlook windows, and running
CoolWWWSearch.SmartSearchMiniRemoval, then CWShredder. Have the latter fix all.

Next, run AdAware. First update it ("Check for updates now"), configure for
full scan (<http://www.lavahelp.com/howto/fullscan/>), then scan ("Start" - "Use
custom scanning options" - "Next"). When scanning finishes, select everything,
and hit Next again.

Next, run Spybot S&D. First update it ("Search for updates"), then run a scan
("Check for problems"). Trust Spybot, and delete everything ("Fix Problems")
that is displayed in Red.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and post it, or a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

And John, please don't contribute to the spread and success of email address
mining viruses. Learn to munge your email address properly, to keep yourself a
bit safer when posting to open forums. Protect yourself and the rest of the
internet - read this article.
http://www.mailmsg.com/SPAM_munging.htm

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

Thanks for that comprehensive list Chuck.

We do have up to date Virus scanning (Norton), and are firewalled
(most of the time), and we had run Ad-Aware, which had found nothing.
I must admit that it never occured to me that AV software would find
something like that...

I'll work my way through the rest of your list (which I'll keep on my
noticeboard for future reference.

Thanks again,

JohnK

p.s. Will work on the e-mail addressing too!!

On Mon, 16 Aug 2004 18:55:31 GMT, johnk@pceffect.co.uk (John F
Kappler) wrote:

If you don't have norton running remove the registry keys manually.
You can also search the registry for eblaster. The keys are listed on
the following site.
http://securityresponse.symantec.com....eblaster.html