Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251

Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2251
POSSIBLE HACK...PLEASE, PLEASE HELP!
POSSIBLE HACK...PLEASE, PLEASE HELP!

POSSIBLE HACK...PLEASE, PLEASE HELP!

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
POSSIBLE HACK...PLEASE, PLEASE HELP! Annie 07-20-2008
Posted by =?Utf-8?B?RGFu?= on July 21, 2008, 7:16 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks for your feedback to Annie on this Milo. What would be your best
suggestions for cleaning the machine? Would Windows LiveOneCare be able to
clean it fully or would it take a combination method of this and perhaps
things like Spybot Search and Destoy which I see Annie already run. Annie
also apparently ran Adaware SE (shudder --- too many false positives --
wrecked a computer once when I ran it and applied the fixes without the
proper backups to that computer in place --- I know better now and learned my
lesson well and would never suggest anyone to use it in the future.) Annie,
I am changing your title, to lowercase because uppercase is like shouting in
the discussion newsgroup and the title based on Milo's expertise of the
situation that has come to light. Annie, which antivirus program did you
run. I also like 2 other tools which are cwshredder and HiJack This which
Annie will need to run. Once, we can get your machine cleaned then we can
help to offer the appropriate safeguards via safety and security of your
machine to help prevent such problems in the future.

"Milo" wrote:

> Annie the way you describe it alone but am not saying yet that you have one
> but you may have a PE infection ( Virus ) and well recently we have a what
> we call PE_Sality / PE_Patch infector that are being delivered by
> polymorphic malicious files Trojan and Downloaders with combo rootkit since
> it bypassed your Firewall.
>
> If it opened up all your program on their own that was stage 1 ( that would
> be in injecting itself already )
> taking too much time and almost all of the file was modified to the recent
> date ( it means injection compeleted file headers already modified )
>
> next time maybe you ought to invest on a better Anti-virus or/and Firewall.
>
>
> > The tech had me come up with a long password for the network key. Is that
> > the password you're talking about? He does know it and I'm not sure how
> > to
> > change it on my own. (I'll figure that out later) If that's not what
> > you're
> > talking about, I have no idea if he changed anything else from default.
> > Guess I'll have to call the BrightHouse tech tomorrow.
> >
> > I ran my antivirus: no virus
> > I ran AdAware: about 200 cookies
> > I ran Spybot: fixed 68
> >
> > Computer was taking forever to reboot so I manually turned it off (by the
> > button). I knew right there something was wrong. All files were modified
> > with today's date, too. ???
> >
> > Thanks so much for the info.
> >
> > "Shenan Stanley" wrote:
> >
> >> <snipped>
> >>
> >> Shenan Stanley wrote:
> >> > Oh - are you on high-speed Internet (Cable Modem, DSL, etc) and if
> >> > so - do you have a router between you and the internet? (Do you
> >> > connect directly to the Internet and get an actual external IP
> >> > address or an internal IP address?)
> >> >
> >> > If you are unsure - do the following..
> >> >
> >> > 1) Find out your IP address internally:
> >> > - Clcik on the Start button
> >> > - Select RUN
> >> > - Type in: cmd /k ipconfig
> >> > - Note the IP address...
> >> >
> >> > 2) Find out your external IP address:
> >> > - Open Internet Explorer
> >> > - Visit the following web page:
> >> > http://whatismyip.com
> >> > - Note the IP address...
> >> >
> >> > Are they different? Is your internal IP address 10.x.x.x or
> >> > 192.168.x.x? If so - you are behind a router. Hopefully this
> >> > router has been properly configured and the administrator password
> >> > on it changed.
> >>
> >> Annie wrote:
> >> > I'm using high-speed internet with a router. The tech brought
> >> > their own so it's brand new...Netgear. How could the password
> >> > change after he configured it? I'm lost.
> >>
> >> Annie wrote:
> >> > I'm using high-speed internet with a router. The tech brought
> >> > their own so it's brand new...Netgear. How could the password
> >> > change after he configured it? I'm lost.
> >>
> >> No - I said I *hoped* it had been changed fromt he DEFAULT... It comes
> >> from
> >> the factory with a default password set that anyone with the same router
> >> (or
> >> Internet access, or just guessing probably) could know.
> >>
> >> If you have a router - you were probably not hacked unless the 'tech' did
> >> it
> >> or that default password was not changed. By having a router - it makes
> >> you
> >> virtually invisible to the outside world (public internet) and without
> >> forwarding ports and services on the router itself - people are not going
> >> to
> >> be likely to get onto your computer. Those routers do not *require* that
> >> you change the password from default to work - nor do they usually
> >> require
> >> any actual configuration - just plug them in and go.
> >>
> >> Now - if the default (from the factory) password was not changed on your
> >> Netgear router - it is possible you got infested/infected with something
> >> that could give someone access to your computer despite the router being
> >> there and/or change the router settings to allow more remote control.
> >>
> >> If that router has been in place the whole time you were connected to the
> >> Internet and it did have its default password changed to something only
> >> you
> >> know (or your IT tech..) - then it is unlikely that you have been
> >> *hacked* -
> >> however - you may have been infested with a Trojan, a worm or spyware or
> >> adware. If so - that software could have easily sent out your
> >> information
> >> and/or whatever it wanted to whatever address(es) it was programmed to
> >> do.
> >> A software firewall *might* have helped in such a situation if it
> >> monitored
> >> outgoing traffic - but then again - it might not - as it may have been
> >> modified by the installation itself to allow for it to go unnoticed.
> >>
> >> --
> >> Shenan Stanley
> >> MS-MVP
> >> --
> >> How To Ask Questions The Smart Way
> >> http://www.catb.org/~esr/faqs/smart-questions.html
> >>
> >>
> >>

Posted by =?Utf-8?B?RGFu?= on July 21, 2008, 7:05 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Sorry, Shenan. I disagree. AVG Free 7.5 antivirus is a good program.
Unfortunately with Free AVG 8, the company apparently broke many of their own
rules and I cannot suggest AVG anymore unless a user is running the legacy
version with AVG 7.5 in which support supposedly is ending in August.

The reason is that AVG 8 has too many false positives on both my system and
my dad's machine when we tried it on XP Professional for me and XP Home for
him. I do not like to disagree with an MVP and please do not jump down my
throat and forgive me for stating my opinion. I am not overly happy with
Avast either if the user is using a 9x machine (such as Windows 98 Second
Edition) but if the machine is using a more modern operating system such as
Windows XP then I would suggest Microsoft's antivirus of Windows Live One
Care because I have not had issues with it so far except the stupid red
notification it gives me because I do not enable automatic updates since I
enjoy reading about every security update.

"Shenan Stanley" wrote:

> Annie wrote:
> > Windows firewall and Zone Alarm firewall. Which one do you
> > recommend I keep on?
>
> Given that you are asking - the Windows Firewall will be more than
> sufficient and easier to use and keep updated.
>
> My Suggestion: Uninstall Zone Alarm completely and just utilize the built in
> Windows XP Firewall and an updated antivirus application. Occassionally run
> an AntiSpyware application to see if you have been infested with anything
> and/or purchase one. SuperAntiSpyware is a good free/for pay one. AVG
> AntiVirus is a good Free AV application (8.0).
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Posted by =?Utf-8?B?QW5uaWU=?= on July 21, 2008, 7:50 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thank you, Dan and Milo.

So what is the next step? I'm not going to turn on that computer just yet.
Where do I find the PE_Sality / PE_Patch at a safe site and should I download
that first before anything else? Should I then run the programs Dan
suggested...in that order?

I'm running Windows XP Home edition on that computer.

I checked my IP addresses per Shenan's advice, they're different. I tried
to login as 'admin' and put the default password in. I then got a 'warning'
screen' so just clicked cancel because I didn't know where that was going to
take me. Could I have clicked OK and then just closed the next page had it
submitted? I realize if I did go to the next page my password was 'not'
changed from the default which is bad. I just didn't know where to take it
from there.

Thank you so much for your help.

One more thing...if this was what Milo said it was..does someone out there
have all my personal data (documents, photos, passwords, etc.).




"Dan" wrote:

> Sorry, Shenan. I disagree. AVG Free 7.5 antivirus is a good program.
> Unfortunately with Free AVG 8, the company apparently broke many of their own
> rules and I cannot suggest AVG anymore unless a user is running the legacy
> version with AVG 7.5 in which support supposedly is ending in August.
>
> The reason is that AVG 8 has too many false positives on both my system and
> my dad's machine when we tried it on XP Professional for me and XP Home for
> him. I do not like to disagree with an MVP and please do not jump down my
> throat and forgive me for stating my opinion. I am not overly happy with
> Avast either if the user is using a 9x machine (such as Windows 98 Second
> Edition) but if the machine is using a more modern operating system such as
> Windows XP then I would suggest Microsoft's antivirus of Windows Live One
> Care because I have not had issues with it so far except the stupid red
> notification it gives me because I do not enable automatic updates since I
> enjoy reading about every security update.
>
> "Shenan Stanley" wrote:
>
> > Annie wrote:
> > > Windows firewall and Zone Alarm firewall. Which one do you
> > > recommend I keep on?
> >
> > Given that you are asking - the Windows Firewall will be more than
> > sufficient and easier to use and keep updated.
> >
> > My Suggestion: Uninstall Zone Alarm completely and just utilize the built in
> > Windows XP Firewall and an updated antivirus application. Occassionally run
> > an AntiSpyware application to see if you have been infested with anything
> > and/or purchase one. SuperAntiSpyware is a good free/for pay one. AVG
> > AntiVirus is a good Free AV application (8.0).
> >
> > --
> > Shenan Stanley
> > MS-MVP
> > --
> > How To Ask Questions The Smart Way
> > http://www.catb.org/~esr/faqs/smart-questions.html
> >
> >
> >

Posted by =?Utf-8?B?RGFu?= on July 21, 2008, 9:24 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I am actually posting this reply via the 98 Second Edition side of my
computer which was not hacked in 2007 after the APS network was hacked and
the XP Professional side was compromised, the 98 SE side rode through the
onslaught like a champ without noticing any problems despite the fact that it
was hooked up to the Internet. This is my main reason for my debate with
Steve Riley but I will discuss that later in the appropriate topic area of
this newsgroup. Identity Theft is really terrible. I want to rant and rave
about my problems but will not redirect to help you.

Okay, first come to grips with the worst case scenario although it might not
be the worst case, I feel it is better to get that over with first and then
try not to worry. Secondly, make sure the compromised portion (XP Home) side
of the PC is not connected to the Internet. I figure we are talking about a
single operating system and do not have to deal with Virtual Machines and or
Dual or Tri-Boots. Please correct me if I am wrong. Since the problem is
with Windows XP Home then I certainly would allow a copy of Windows Live One
Care to attempt to fix the problem. Unfortunately, for you this is a
terrible scenario but it will be useful for Microsoft and others to see how
effectively Windows Live One Care can fix your problem. This will make a
great test case to see the effectiveness of Windows Live One Care. Just so
you all know, I enjoy using Microsoft technology but will not limit myself to
a single software or hardware manufacturer. It must be all fully customized
for me to meet my needs and please sorry Annie but do not see me as
insensitive since your case may indeed help all users out.

1. Try to Install and Run Windows Live One Care --- use cd and make sure
your ethernet, usb or phone cord is not connected --- this is a critical step
as far as not being connected to the Internet with that machine or at least
within the compromised operating system (I presume broadband --- cable/dsl or
narrowband if dial-up) ---- access me and others with another non-compromised
machine at this Microsoft Newsgroup ---- Please let us know the results and I
will attempt to provide further assistant --- Milo, Steve Riley and others
are welcome to add their feedback to this case as well to help Annie.

"Annie" wrote:

> Thank you, Dan and Milo.
>
> So what is the next step? I'm not going to turn on that computer just yet.
> Where do I find the PE_Sality / PE_Patch at a safe site and should I download
> that first before anything else? Should I then run the programs Dan
> suggested...in that order?
>
> I'm running Windows XP Home edition on that computer.
>
> I checked my IP addresses per Shenan's advice, they're different. I tried
> to login as 'admin' and put the default password in. I then got a 'warning'
> screen' so just clicked cancel because I didn't know where that was going to
> take me. Could I have clicked OK and then just closed the next page had it
> submitted? I realize if I did go to the next page my password was 'not'
> changed from the default which is bad. I just didn't know where to take it
> from there.
>
> Thank you so much for your help.
>
> One more thing...if this was what Milo said it was..does someone out there
> have all my personal data (documents, photos, passwords, etc.).
>
>
>
>
> "Dan" wrote:
>
> > Sorry, Shenan. I disagree. AVG Free 7.5 antivirus is a good program.
> > Unfortunately with Free AVG 8, the company apparently broke many of their
own
> > rules and I cannot suggest AVG anymore unless a user is running the legacy
> > version with AVG 7.5 in which support supposedly is ending in August.
> >
> > The reason is that AVG 8 has too many false positives on both my system and
> > my dad's machine when we tried it on XP Professional for me and XP Home for
> > him. I do not like to disagree with an MVP and please do not jump down my
> > throat and forgive me for stating my opinion. I am not overly happy with
> > Avast either if the user is using a 9x machine (such as Windows 98 Second
> > Edition) but if the machine is using a more modern operating system such as
> > Windows XP then I would suggest Microsoft's antivirus of Windows Live One
> > Care because I have not had issues with it so far except the stupid red
> > notification it gives me because I do not enable automatic updates since I
> > enjoy reading about every security update.
> >
> > "Shenan Stanley" wrote:
> >
> > > Annie wrote:
> > > > Windows firewall and Zone Alarm firewall. Which one do you
> > > > recommend I keep on?
> > >
> > > Given that you are asking - the Windows Firewall will be more than
> > > sufficient and easier to use and keep updated.
> > >
> > > My Suggestion: Uninstall Zone Alarm completely and just utilize the built
in
> > > Windows XP Firewall and an updated antivirus application. Occassionally
run
> > > an AntiSpyware application to see if you have been infested with anything
> > > and/or purchase one. SuperAntiSpyware is a good free/for pay one. AVG
> > > AntiVirus is a good Free AV application (8.0).
> > >
> > > --
> > > Shenan Stanley
> > > MS-MVP
> > > --
> > > How To Ask Questions The Smart Way
> > > http://www.catb.org/~esr/faqs/smart-questions.html
> > >
> > >
> > >

Posted by =?Utf-8?B?QW5uaWU=?= on July 21, 2008, 4:56 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thank you everyone for trying to help. This is just too overwhelming for me.
I'm just going to take my computer in to the shop and have the reinstall the
OS and I'll have to reinstall all my other programs.

My router says it has a double firewall so I still don't know how all of
this could've happened eventho that guy turned my Windows firewall off.
Makes no sense to me.

Thanks again. I hope all these posts help anyone else who has this problem
and are a bit more experienced than myself.

"Dan" wrote:

> I am actually posting this reply via the 98 Second Edition side of my
> computer which was not hacked in 2007 after the APS network was hacked and
> the XP Professional side was compromised, the 98 SE side rode through the
> onslaught like a champ without noticing any problems despite the fact that it
> was hooked up to the Internet. This is my main reason for my debate with
> Steve Riley but I will discuss that later in the appropriate topic area of
> this newsgroup. Identity Theft is really terrible. I want to rant and rave
> about my problems but will not redirect to help you.
>
> Okay, first come to grips with the worst case scenario although it might not
> be the worst case, I feel it is better to get that over with first and then
> try not to worry. Secondly, make sure the compromised portion (XP Home) side
> of the PC is not connected to the Internet. I figure we are talking about a
> single operating system and do not have to deal with Virtual Machines and or
> Dual or Tri-Boots. Please correct me if I am wrong. Since the problem is
> with Windows XP Home then I certainly would allow a copy of Windows Live One
> Care to attempt to fix the problem. Unfortunately, for you this is a
> terrible scenario but it will be useful for Microsoft and others to see how
> effectively Windows Live One Care can fix your problem. This will make a
> great test case to see the effectiveness of Windows Live One Care. Just so
> you all know, I enjoy using Microsoft technology but will not limit myself to
> a single software or hardware manufacturer. It must be all fully customized
> for me to meet my needs and please sorry Annie but do not see me as
> insensitive since your case may indeed help all users out.
>
> 1. Try to Install and Run Windows Live One Care --- use cd and make sure
> your ethernet, usb or phone cord is not connected --- this is a critical step
> as far as not being connected to the Internet with that machine or at least
> within the compromised operating system (I presume broadband --- cable/dsl or
> narrowband if dial-up) ---- access me and others with another non-compromised
> machine at this Microsoft Newsgroup ---- Please let us know the results and I
> will attempt to provide further assistant --- Milo, Steve Riley and others
> are welcome to add their feedback to this case as well to help Annie.
>
> "Annie" wrote:
>
> > Thank you, Dan and Milo.
> >
> > So what is the next step? I'm not going to turn on that computer just yet.
> > Where do I find the PE_Sality / PE_Patch at a safe site and should I
download
> > that first before anything else? Should I then run the programs Dan
> > suggested...in that order?
> >
> > I'm running Windows XP Home edition on that computer.
> >
> > I checked my IP addresses per Shenan's advice, they're different. I tried
> > to login as 'admin' and put the default password in. I then got a 'warning'
> > screen' so just clicked cancel because I didn't know where that was going to
> > take me. Could I have clicked OK and then just closed the next page had it
> > submitted? I realize if I did go to the next page my password was 'not'
> > changed from the default which is bad. I just didn't know where to take it
> > from there.
> >
> > Thank you so much for your help.
> >
> > One more thing...if this was what Milo said it was..does someone out there
> > have all my personal data (documents, photos, passwords, etc.).
> >
> >
> >
> >
> > "Dan" wrote:
> >
> > > Sorry, Shenan. I disagree. AVG Free 7.5 antivirus is a good program.
> > > Unfortunately with Free AVG 8, the company apparently broke many of their
own
> > > rules and I cannot suggest AVG anymore unless a user is running the legacy
> > > version with AVG 7.5 in which support supposedly is ending in August.
> > >
> > > The reason is that AVG 8 has too many false positives on both my system
and
> > > my dad's machine when we tried it on XP Professional for me and XP Home
for
> > > him. I do not like to disagree with an MVP and please do not jump down my
> > > throat and forgive me for stating my opinion. I am not overly happy with
> > > Avast either if the user is using a 9x machine (such as Windows 98 Second
> > > Edition) but if the machine is using a more modern operating system such
as
> > > Windows XP then I would suggest Microsoft's antivirus of Windows Live One
> > > Care because I have not had issues with it so far except the stupid red
> > > notification it gives me because I do not enable automatic updates since I
> > > enjoy reading about every security update.
> > >
> > > "Shenan Stanley" wrote:
> > >
> > > > Annie wrote:
> > > > > Windows firewall and Zone Alarm firewall. Which one do you
> > > > > recommend I keep on?
> > > >
> > > > Given that you are asking - the Windows Firewall will be more than
> > > > sufficient and easier to use and keep updated.
> > > >
> > > > My Suggestion: Uninstall Zone Alarm completely and just utilize the
built in
> > > > Windows XP Firewall and an updated antivirus application. Occassionally
run
> > > > an AntiSpyware application to see if you have been infested with
anything
> > > > and/or purchase one. SuperAntiSpyware is a good free/for pay one. AVG
> > > > AntiVirus is a good Free AV application (8.0).
> > > >
> > > > --
> > > > Shenan Stanley
> > > > MS-MVP
> > > > --
> > > > How To Ask Questions The Smart Way
> > > > http://www.catb.org/~esr/faqs/smart-questions.html
> > > >
> > > >
> > > >

Similar ThreadsPosted
Attempted Hack? January 17, 2007, 11:43 am
I need a system the U.S. government cannot 'hack' November 19, 2005, 12:27 pm
Event ID 529 Hack Attempts September 26, 2006, 12:37 pm
I'm being threatned by someone who is threatning to hack my accoun April 9, 2006, 3:40 pm
Windows Security Center Hack April 29, 2006, 1:55 pm
RE: Windows Security Center Hack April 29, 2006, 8:28 pm
If you hack a server joined to domain, how much info can you get ?<