Member Avatar for acejames1

ok so i feel like my computer screen is being watched like remote desktop but not exactly and it is being done thru a website. like lets say you have a computer. its some what like that kinda program but it doesnt have a program that you have to use and you dont have any control over what going on basically and so its pretty interesting and its probably some old school technique. ill check back in a couple days to see what you have figured out. thanx

Edited by Ezzaral because: Removed code fomatting.
  • 5 Contributors
  • 10 Replies
  • 282 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by acejames1

Dani AI

Generated

Thread context: reports feeling “watched” after finding processes like Akamai and MySQL on an HP ProBook purchased through TigerDirect; replies from , and pushed toward malware checks and port inspection. The correct first step is evidence collection rather than guessing intent: capture network connections, running services, install timestamps and ARP state. Those artifacts distinguish a benign OEM/service client or a local database from a persistent backdoor or ARP spoofing.

Run an elevated command prompt / PowerShell and save these outputs to the Desktop for later analysis (all commands run as admin):

netstat -abno 5 > "%USERPROFILE%\Desktop\netstat_loop.txt"
tasklist /v /fo csv > "%USERPROFILE%\Desktop\tasklist.csv"
wmic process get Name,ProcessId,ExecutablePath > "%USERPROFILE%\Desktop\procpaths.txt"

In an elevated PowerShell session capture installed-program registry entries:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* ,
HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName } |
Select-Object DisplayName,DisplayVersion,Publisher,InstallDate |
Sort-Object InstallDate |
Out-File "$env:USERPROFILE\Desktop\InstalledPrograms.txt"

Notes: netstat -abno shows executables tied to sockets but requires admin; wmic product is incomplete for non-MSI installs so the registry query is more comprehensive. InstallDate is often missing — timestamps in Event Viewer and file properties are usually more reliable.

To capture possible ARP poisoning, record ARP before/after network activity and compare gateway MACs:

arp -a > "%USERPROFILE%\Desktop\arp_before.txt"
ping -n 20 8.8.8.8
arp -a > "%USERPROFILE%\Desktop\arp_after.txt"
ipconfig /all > "%USERPROFILE%\Desktop\ipconfig_all.txt"

Interpretation and containment: unsigned or unexpected executables, persistent listening sockets to unknown hosts, or gateway/MAC mismatches are strong indicators. If compromise is suspected, isolate the machine from the network, collect the saved files with a clean rescue environment, inspect digital signatures of suspicious EXEs (Properties → Digital Signatures), then rebuild from known-good media. OEM recovery partitions and preinstalled agents or local databases are common — their presence alone is not proof of remote spying.

Recommended Answers

All 10 Replies

Member Avatar for JorgeM

for your computer to have been taken over, since you are on a private network behind a NAT router, there must be software running on your PC that is maintaining a connection. The attacker would not be able to initiate a connection into your intranet unless a port forwarding rule had been created at your router mapping back to your system with a program listening for the attacker.

I would ensure that your computer has the latest microsoft (if that is the OS you are running) patches in place, malware protection up to date, and I would download Malware bytes as their tool is free and very good at finding malware that other AV products miss.

You can also download a port scanning tool and see if there are any open ports listening.

Member Avatar for acejames1

here i have something that might help i had a certain software called akamai installed on my computer before i even got it. it was installed as of 5/14/2011 and i didnt receive my computer til 9/18/2011 for college. anyways let me know cause that software definitely is not microsoft software.

Edited by Ezzaral because: Removed leading tab that was causing code format to be applied.
Member Avatar for acejames1

also installed before i had recieved it was a program that has to deal with server's something like my sql server 2005 .... and then how is the partitions suppose to look on a hard drive when you buy it direct from tigerdirect.com is it suppose to have extra partitions and are you suppose to have recieved a disc for your computer with that computer itself still really need help people and would really appreciate it

Edited by Ezzaral because: Removed leading Tab which caused code formatting.
Member Avatar for JCampbell32

Most PC distributors don't send disks anymore, though you can request them within a limited time and pay a little extra. It is possible that your hard drive is partioned, but then again there is no requirement for it.

A search from google (or anywhere else for that matter) will net plenty of info about akamai. Just like anyother software it can be uninstalled. It is unclear exactly what you are asking about? Many computer manufacturers pre-install programs, we comonly call them "bloat ware" and most can be uninstalled easily. From your post, it appears your computer is running Windows, if you don't want the extra software, request the OS disk, dowload the drivers, then perform a clean install yourself.

If your hard drive does have an extra partition, that was configured when you purchased it from Tiger Direct, that partition most likely has the software on it required to reload your computer. It has become pretty standard to recieve OTC computers configured this way. You can make install disks from this partition. The manual that came with your computer will have the proceedure to do this.

JorgeM gave some pretty good advice on some programs to relieve malware issues. Your last post indicates you relly need help... did the partition explanation help, or is there more to the question that I misread?

Member Avatar for TheFixer

Have you checked for rootkits? Kaspersky has a free anti rootkit tool. Also,If not tried yet, try malwarebytes. It will find and remove some of the toughest stuff out there. If you are clear of rootkits and malware, try Comodo internet security free version. It has a great reputation, and will let you see your outgoing connections easily.

Member Avatar for acejames1

i know without a doubt my computer is clean guys i watch my task manager i know how to see something missing or see something that is extra but the real thing is is that http://en.wikipedia.org/wiki/File:Akamaiprocess.png that is the reason i feel i am being watched and mysql server 2005 is a sun/linux product if i have windows 7 why would it be necessary for them programs to be put on the computer. ex. if a computer has a program that would invade the privacy of the owner why would tiger direct or hp put the program on the computer. they are not the ones im trying to target here. i did not find that the install for the program was there im saying the programs were already on my computer and running and there is an administrator account on my computer when as far as i know microsoft did away with that and just made it the account for the computer that is the owners. my computer is an hp probook 4530s now if anyone has seen a computer that came with them programs preinstalled on a computer from them then i guess im wrong but i feel my privacy was invaded within them two programs and i dont think tiger direct would put them programs on the computer and i dont think hewlett packard would either.

Edited by Ezzaral because: Please stop beginning your posts with two tab indents. It causes the editor to treat your post as code when it is not.
Member Avatar for adityatandon

Well, u never know.. Apple too claims not to collect user data, but there have been many complaints regarding the same... Though nothing has been proven in the court of law till date..

Member Avatar for acejames1

i just set my computer back to factory settings how do i upload a file that will tell you all that is on my computer with dates they are installed at

Member Avatar for acejames1

imma screenshot it and upload it to image shack brb then ill post a link here

Member Avatar for acejames1

how about this i feel i am being arp poisoned how would one prove that is happening

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.