The candidate I'm working for got HACKED. Please, help.

[mistertrickster]

The opposition apparently hacked into his program. We know they did because they posted a complete e-mail that he sent on a chat board as well as specific pieces of information that could only be found on the candidate's computer drive.

The candidate has used security/anti-virus programs and identified some kind of "harvester" program.

He refuses to take my advice and disconnect the computer from his cable when not in use.

My questions to you experts

1. Are security/anti-virus programs good enough protection against this hacker, and if so, why didn't they work to stop him earlier?

2. Other than going to the local police (which would tie up the computer before the election), is there some way to identify the culprit and even punish him for hacking into to our computer?

Thank you for any advice you can provide.

[trotsky]

1. Does he use a firewall, or is he connecting his computer directly to the Internet?

If the latter, that's a big problem and probably how he got infected.

Though if confidential information was taken and posted, he may have gotten tricked into running a program that came in on an e-mail. No anti-virus or anti-malware application can get EVERYTHING, and even if it was suspicious and warned him about running something, he may have clicked OK anyway.

Doubtful you'll be able to track down the culprit. Best avenue might be with the administrator of the chat board, to see if the person who posted the e-mail and other sensitive info can be identified.

I think the #1 thing you should do is try and get him a different computer to work on. That one's been compromised.

[PennDem]

2. Don't rule out someone working on the inside

Put a router in between the computer and the internet modem for minimum protection.

Read through the logs of the security program that is place for a slight chance of getting an ip address of the source. Though it most likely was spoofed anyway.

Look over Berserker's Security Help post pinned near the top of this group and run some of the vulnerability tests against the computer in question.
http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=242x1314