Is it normal for IE history to log system activity/contents?

[papilio]

I should begin this by stating that I know I've got security issues. For instance, My BIOS password was changed (and even Dell Tech Support couldn't reset it), the user-side password to access the browser-based settings console to my Linksys router was changed, locking me out (I've quit using the router for now), the built-in Administrator account has been logged into and a password set ... and many other events, but right now I just have a specific question.


I'm on a home PC (Dell L702X) running Windows 7 SP1 and am not knowingly connected to any network (though various monitoring apps on my system are telling me otherwise).

I use Firefox, never IE, but just on a hunch I thought I'd take a look at IE's history. It showed the browser as having visited certain security-related sites which I'd been to, it had been to the IP address of my router console (specifically the wireless security page, where I'd disabled the device's wireless capability) and has also accessed certain documents on my system, typically saved logs and other files related to my attempts at security forensics.

The day after I found this suspicious activity in the IE history, I noticed that IE had switched to private browsing.

Some people with whom I've shared this are speculating that this is probably just one way Windows natively logs certain types of activity, but given what's shown up there I find this suggestion less than tenable.

Is this likely to be the case, or not?


Thank you!

 

[Jacee]

Who else shares this particular computer with you?

Who else shares your Internet connection in your home? (other computers?)

 

[papilio]

Who else shares this particular computer with you?

Who else shares your Internet connection in your home? (other computers?)

Nobody, and nobody (legitimately, anyway). Nor does anybody have physical access to it.

 

[papilio]

Hi Jacee,

Any more you can add to my original question?

Thank you.

 

[ThrashZone]

Hi
There have been a few windows updates that gather and send info,
http://www.sevenforums.com/general-...windows-10-upgrade-updates-windows-7-8-a.html

 

[papilio]

Thank you ThrashZone! Yeah, I'd imagine MS may get a lot of flack for what they've put into Windows 10.

What I've seen with IE however shows up even on fresh installations, not immediately but after I've taken the system online yet before any WUs are installed.

 

[UsernameIssues]

~~~
I'm on a home PC (Dell L702X) running Windows 7 SP1 and am not knowingly connected to any network (though various monitoring apps on my system are telling me otherwise).
~~~

Can you keep the computer off of the internet?

What monitoring apps?

What network(s) did the computer connect to?

 

[ThrashZone]

Hi,
Not sure about all of the other issues you've encountered but you might review Control panel/ Internet options/ General section and browser history settings button,
There should be three sections
Temporary internet files set it to Never if you don't use ie,
History 0 days
Cache and databases Uncheck use cache.... first set it to 0mb.

Save that and go to Delete button and Check all boxes except for the very top box leave it unchecked,
Apply and okay your way out.

Firefox has it's own setting I'm sure you're aware of

With a click/ click to continue generation too silly to read terms of usage it will take time before people realize what win-10 actually does.
The new Google is where M$ want to be because Google is way more successful and people don't seem to mind all of the spying so M$'s view is join them as Android has proved people really do not care

 

[papilio]

~~~
I'm on a home PC (Dell L702X) running Windows 7 SP1 and am not knowingly connected to any network (though various monitoring apps on my system are telling me otherwise).
~~~

Can you keep the computer off of the internet?

What monitoring apps?

What network(s) did the computer connect to?

Hi UsernameIssues, thank you for your reply.


I'm variously shown as being connected to Local Area Connection, Local Area Connection 2 and Local Area Connection 3. The IP configurations of each of these have shown up in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles.


I've installed WinPatrol and GlassWire. I've set WinPatrol to monitor some of the TCP keys in the registry and it's reporting the changes in network configuration which I'm seeing. GlassWire seems to be doing a good job of alerting me to the comings and goings of unknown network devices, changes in DNS settings and other elements of my IP configuration.

A family friend who is a retired programmer with Seagate has also written for me a Python program to monitor a comprehensive list of settings but it hasn't yet shown him enough to allow him to come to any conclusions. He's looking for the hacker's entry point and his feeling currently is that it seems to be a BIOS exploit.

Which brings me to the issue of keeping off of the internet -- I can disable my adapter and even unplug the Ethernet cable from the router, thereby losing my own ability for any internet activity (set up via the router as exclusively Wired and having none of my PC's Wireless adapters installed). Yet evidence of Remote Access, which I've disabled as well as I know how, continues under these conditions.

It is primarily these events which lead my Seagate friend to suspect a BIOS exploit, these along with the apparent absence of such activity before my BIOS was hacked and the password changed.


For a time I was using Windows 8.1 Pro and had locked down system access to some extent via Group Policy, but Event Logs would report changes in the Group Policy profile along with entries reporting Group Policy as having been changed to a shared resource.



I'd not seen evidence of significant tampering with system settings for about the past couple of weeks until a few nights ago when my connection was lost, the Network Troubleshooter reported that my Gateway (ordinarily my router) was unavailable and my Network Adapter had been disabled (this was not displayed in the Device Manager). The diagnostic details reported the Gateway as being located on an unknown remote host.

Hi,
Not sure about all of the other issues you've encountered but you might review Control panel/ Internet options/ General section and browser history settings button,
There should be three sections
Temporary internet files set it to Never if you don't use ie,
History 0 days
Cache and databases Uncheck use cache.... first set it to 0mb.

Save that and go to Delete button and Check all boxes except for the very top box leave it unchecked,
Apply and okay your way out.

Firefox has it's own setting I'm sure you're aware of

With a click/ click to continue generation too silly to read terms of usage it will take time before people realize what win-10 actually does.
The new Google is where M$ want to be because Google is way more successful and people don't seem to mind all of the spying so M$'s view is join them as Android has proved people really do not care

Thank you ThrashZone, very helpful info to have. My understanding of networks, their settings and issues is still quite elementary.


What I'm hoping to learn currently is whether the activities in the IE history (and a good number of other suspicious settings, registry changes and Event Log entries) are just normal Windows behavior which I'd not yet noticed, or whether they might point to evidence of the intrusion which I'm experiencing.

 

[papilio]

ThrashZone,


p.s. Going into Internet Settings and making the changes which you suggest reminded me that I had initially done some of those things upon first discovering the activity in IE history. The following day I noticed that IE had been changed to Private Browsing.

 

[ThrashZone]

In-Private browsing is very similar to deleting everything on exit with the same setting as I posted
You can also go into the Advanced settings and check the box or confirm it's checked to delete on exit too.

In issues like this it might be best to reset the modem and or router to it's defaults and change the access password too.

 

[papilio]

In-Private browsing is very similar to deleting everything on exit with the same setting as I posted
You can also go into the Advanced settings and check the box or confirm it's checked to delete on exit too.

Thank you ThrashZone, I'd figured it was somewhat similar.

In issues like this it might be best to reset the modem and or router to it's defaults and change the access password too.

I'm afraid those have already been done, time and again, without resolving the issue. At one point I saw that IE had visited the wireless security URL of the router, but when I attempted to log in myself to check for changes I discovered that the router's password had also been changed. Unlike the similar hack of the BIOS however, the router issue was of course easily fixed with a reset. The BIOS hack, with even Dell tech unable to reset the password, will require a new motherboard ... once this is all cleaned up.


I suspect I've done clean installs of both 7 and 8.1 more than half a dozen times over the past couple of months, but each time everything reoccurs again from the start.



Thanks again for our help!

 

[ThrashZone]

Just curious you haven't selected a region or state flag yet on your profile :/
I'm wondering what neighborhood to stay away from
Seems a pretty cleaver fellow is near by possibly ?

 

[papilio]

Just curious you haven't selected a region or state flag yet on your profile :/

Ha! Done (Minnesota).

I'm wondering what neighborhood to stay away from
Seems a pretty cleaver fellow is near by possibly ?

Ah, if only it were as innocent as that.
In the words of one IT security specialist with whom I spoke, I appear to have in my system a "top-shelf hacker".

Most curious, especially as I've not experienced any of the more common hacking symptoms, financial/identity theft and so on. The only one of my online accounts which shows clear evidence of unauthorized access is my email, and nothing significant seems to have resulted.

 

[mdd1963]

Let's see them hack in if you're using the Linux Mint 17 Live CD!

Was this computer ever used in any remote tech support issues? (LogmeIn, Teamviewer, AMMY, etc)

1. New router, allow only one wireless user (limited to your MAC address), or , disable wireless altogether (until you get this sorted out)
2. Possible you have some sort of rootkit
- do a search for aswMBR
- and Kasperky's TDSS killer

3. Or, next time reformatting, hook your drive up to external Linux machine to examine all partitions

 

[papilio]

Let's see them hack in if you're using the Linux Mint 17 Live CD!

Thank you for the reply mdd1963!

Apologies for not responding sooner ... just after I received the notice of your post my internet connection was lost again, by the time it was restored I had forgotten about the notification until I noticed it again in my inbox this afternoon.


That's definitely worth a shot, thank you for the suggestion.

One of the issues which I've experienced however has been that, even in instances where I've first unplugged my hard drives and disconnected both router and modem, when I've run a Live CD of Ubuntu (or even MiniXP) indications of intrusion were evident on the system by the time the desktop had loaded. I would immediately experience abnormal system behavior (such as an inability to obtain root privileges), and I also discovered numerous entries in the various setup/system event logs written by Ubuntu, a seeming avalanche of critical or fatal error messages toward the end of the setup process.

One more type of event which would seem possible only in the context of a BIOS exploit scenario.

Was this computer ever used in any remote tech support issues? (LogmeIn, Teamviewer, AMMY, etc)

The laptop was purchased several years ago on eBay so I can't vouch for its history (I recall that the seller claimed to be a student, finding the laptop to be too heavy to carry between classes), but I've not seen any hints of this sort of behavior during most of my ownership. In any case it's been through a good number of drive replacements and clean reinstalls since its purchase -- primarily since my becoming aware of the security breach, but some of this before that point as well.

1. New router, allow only one wireless user (limited to your MAC address), or , disable wireless altogether (until you get this sorted out)

Unfortunately all of these have been tried without resolving the intrusion issues. I had set up the router just as you suggest, including allowing only one device and disabling wireless. However in the case of the current router, a Linksys E2500, I happened to notice in the IE history (again, I never use IE) that the URLs of one of the browser-based router settings console panels had been visited, specifically the page on which wireless is disabled. Upon attempting to log in to the console myself to look for unauthorized changes I discovered that the access password had been changed and I was locked out. I reset and reinstalled the router, which was merely followed by a repeat of the above events.

2. Possible you have some sort of rootkit
- do a search for aswMBR
- and Kasperky's TDSS killer

Again, both have been tried with nothing being detected, these along with other rootkit scans such as Sophos.

3. Or, next time reformatting, hook your drive up to external Linux machine to examine all partitions

Each time I've performed a clean install (7 times in about the past two months) it's been done on a brand new SSD. A return of the intrusion has been evident in each case soon after, in some cases by the time I first get to the fresh desktop and examine the event logs. The installations have been off of OEM CDs obtained by myself directly from Dell.


I don't mean in the least to be dismissive of your intelligent suggestions, I very much appreciate the assistance! Thanks again for your reply.