Re: Help, some one's hacked into my home computer

[Robert Graham <robert_david_graham () yahoo com>]

--- Denise Lucas <denise_lucas () yahoo com> wrote:
> It looks like they ftp'd some files called
> ffastun.ffl, ffastun0.ffx, ffastun.ffo, ffastun.ffa
> and made some changes to system files.

Yes, this is evidence of pretty famous hacker named "Bill Gates". :-)

These files are generated by "FindFast". It is a feature of Microsoft Office
that indexes your files in the background, and allows you to search for Office
documents. If your machine is slow, and the disk drive is in constant motion,
then look for FINDFAST.EXE in your process list.

I personally loathe FINDFAST, namely because its "background" process causes
more of a noticeable impact on my dual-450a-celeron-UDMA machine than an
intrusion-detection-system running at 148,800 frames/second (which I ran for a
week-straight in the background preparing for our demo at Interop).

There is a Find Fast control panel that you can use to turn off FindFast.

The files it indexes are:

.doc, .dot, .htm* Microsoft Word 6.0-8.0 documents  
.xl* Microsoft Excel workbooks  
.ppt, .pot, .pps  Microsoft PowerPoint® presentations  
.mpp, .mpw, .mpt, .mpx, .mpd Microsoft Project files  
.mdb Microsoft Access files  
.obd, .obt  Office Binder files  
.rtf, .txt Rich text and text files  

> Any suggestions, please, please call me.

It sounds like maybe you weren't hacked, other than by Microsoft.

Rob.

_____________________________________________________________
Do You Yahoo!?
Free instant messaging and more at http://messenger.yahoo.com