4 replaced http://serverfault.com/ with https://serverfault.com/
source | link

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493https://serverfault.com/a/218011/146493 , by RobMRobM, is a good read, with sane and important steps.

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, https://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

3 added 464 characters in body
source | link

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

2 added link to robm answer
source | link

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps. 

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc).

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, http://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps. 

1
source | link