Hello Everyone.
I have been in computers since 1982 and 2 years ago I had a 6 hour spinal fusion and it was a failure so I spend most of every day in bed suffering with severe pain.
On March 13th I was hacked on my 4 home Windows XP from the Port 3389 RDP flaw that Microsoft released. The culprit ruined 20 years of data and about 20 terabytes of home data.
So I needed one computer or laptop to fix the others. For the last 2 weeks I have been purchasing and returning laptops and various routers as they were hacked at the BIOS level.
What I have found out is this. I do an ARP -a from the command prompt and it shows my router's dynamic address and then 4 other static IP's.
224.0.0.22, 192.168.2.255, 224.0.0.252 and 255.255.255.255.
I use GPEDIT.MSC and lock down all remote access and disabled netmeeting and Windows Media Center Sharing. I block most default incoming rules for my firewall and I disable the 6to4 microsoft adapter, the Teredo Tunneling Pseudo-Interface as well as ISATAP from gpedit.
I also go into the network card properties and remove the IPv6 and file and print sharing.
I then go into device manager and select "view Hidden Devices" Even though I disable the various VPN tunneling and RAS adapters they still come back.
I had my 6th returned router configured at the lab from the Vendor I purchased it from. The hacker still hacked the 16 hexidecimal admin password and set up a route to allow 224.0.0.22, 192.168.2.55, 224.0.0.252 and 255.255.255.255. I am uncertain and very stressed on how someone can easily hack my router and add a vpn tunnel into my laptop even though my router has all vpn turned off.
I noticed that they use Powershell, WBEM and Systems Management BIOS and Windows Media Center Sharing to somehow hook my laptop's NVRAM so even after you format the hard drive or hard set your router their routes come back. Their tunneling bypasses my Windows Group policies.
I am in severe pain, and I am getting married this summer and would love if someone can help me solve this before it kills me as it has been going on for the past 6 weeks. Thank you! Brent Waddell email brentavv@gmail.com
