by Global

Created on: October 15, 2008   Last Updated: October 20, 2008

First why would someone want to hack you in the first place? Lots of reasons I can think of. For fun, you are holding some information valuable to hacker or his/her employer, you are someone famous so they want to see if you have some home made porn, to make you their "zombie" to sell something or to attack someone else. Etc,etc.

How to know if you are hacked? Well, if MIB rings on your door and arrests you for computer crime and you did not do anything maybe your computer served someone else to do something :). Really, it's hard to know if you don't look for it. Lots of hacks pass unnoticed until all is over or never at all especially on home computers. How many home users ever read firewall or system logs or use IDS? Or play with auditing logons and system events? Rare I guess. And this is prevention as well as cure (maybe). Reading logs. Firewall log will show you most attempts to connect to your computer. Check for location of those logs and good idea would be to store them on removable media every day because hacker will also look for those to delete him/herself from it. It goes for system logs. Backup so if you are hacked at least you can go back and try to see for how long this was happening.

Regularly check event viewer in administrative tools (Win XP). For example if you are not logging to your machine as administrator but you have that entry in the log, guess, someone entered your computer as admin. It goes if you notice logons while you were away. You get the idea.

Also look for strange behaviors on your computer like large amounts of upload and download, slowdowns, restarts etc. But notice that you wont see these if you deal with skilful hacker.

Lets say you are being hacked this moment. Do you disconnect from Internet or not? This is for debate I think. If you were on your office computer you would call your admin to decide of course. At home you must decide yourself. If you disconnect you lose opportunity to try to trace intruder. But that is anyway next to impossible for home user. If you reboot you will lose anything that was loaded in RAM or maybe in page file plus hacker could install something to reformat your hdd or delete partitions on reboot. Possibilities are endless really. So I guess best would be, to disconnect, leave computer running (if it is still operational after hack of course) and get some help. From friendly hackers, you have one or two right, or if you have something really important on computer, from police. And I would prefer police since they will have better tools and can dig out more data from ISPs.

Learn more about this author, Global.
Click here to send this author comments or questions.