Printable View
Sort of in conjunction with the recent hacking threads, I just got hit with either a remote or a sub 7 or some type of trojan. You know the type that the victim has to have running?
Something that a "hacker" probably spet weeks setting up I removed in less than 10 minutes.
weeks lol your ignorance amuses me... in fact he isnt a hacker hes a script kiddie and he probably sent you some file recently that you executed and bingo he got in... wow that was hard... no skill required :(Quote:
Originally posted by Shadow
Sort of in conjunction with the recent hacking threads, I just got hit with either a remote or a sub 7 or some type of trojan. You know the type that the victim has to have running?
Something that a "hacker" probably spet weeks setting up I removed in less than 10 minutes.
What port?
Check here to see if it was indeed s7. If not probably the back orfice, dolly, satellyte, or hackman, among many others. Dang script kiddies anyhow.
Ok, I removed the files and stuff yesterday. I am getting no unsual activity what-so-ever. However, the files I was removing all started with Win. One of them was Winkit.exe or Winhit.exe, I am not sure. The executables resided in my windows\system folder. I simply went to dos, went to the folder, removed all it's attributes, and deleted it. This one would make copies of itself, and rename itself so it may once again load into memory in the background while windows was running. It would run while offline. I did ctrl+alt+del to see what programs were running, everytime I knew something was wrong, the file's name was all jibberish or pointless lettering not even in the hacker mumbo jumbo. So, I opened msconfig.exe and sure enough, another exe file was set to load everytime windows started. I went to dos, removed THIS NEW ONE'S attributes, then deleted it. The reason I went straight to dos, is so I could have full access of the file. Otherwise, I could not have deleted it in Windows because "windows was using it".
Everytime I found entries in the windows\system folder with MsConfig.exe and they were always executables.
Everytime I suspected strange behavior, I found a new program in the close programs dialog box (ctrl+alt+delete).
Symptoms: My computer would slow down terribly, and my "connected to the internet light" would stay a solid light. 2 major slowdowns when nothing was going on. This was my indication that I was not the only one using my computer.
I just said the heck with it and deleted windows....that's all I needed to do because my computer is fine now. If I need to take extra measures ( I'm pretty sure I don't )....I'll just reformat. :D
BTW, I got it as an e-mail. The program downloaded immediately, and installed itself just by clicking on it. I'm going to tinker with my "on hard-drive" mail program to turn on some saftey precautions, and also whip up a quick program to remove, then re-install my mail program ( sort of like backing up stuff incase something happens ).
Oh, and $null - find better things to do with your time. You sure know all the terms don't you.Quote:
weeks lol your ignorance amuses me... in fact he isnt a hacker hes a script kiddie and he probably sent you some file recently that you executed and bingo he got in... wow that was hard... no skill required
I just fix problems with a computer, or I purposely create them. That's all there is to it.
>>"on hard-drive" mail program
Oh boy. Even worse than IE for getting viruses.
I've manually deleted my fair share of viruses from friends computers as they either didnt own virus scanners or in two cases, their virus scanner refused to fix the problems (McAffee and Norton respectivly actually). It pays to know how to do this kind of thing. Just consider it as useful experience, Shadow. :)
I did take it as a learning expierence.
I look at it like this though:
I've received my fair share of viruses, and I've removed them all. This was the first time I got a trojan I believe - or one like this. Anyhow, with time I could've figured out how to manually remove it out of the system with some research, and the same goes for the viruses I've encountered. Myself though, I have a fairly quick deleting / formatiing routine. It works best for me this way.
BTW, when I build my ultimate emulation PC pretty soon here...it ain't touching the outside world. Infect the computer that's connected to the internet all you want. It's the lesser quality one. If it goes, oh well, I aint missing much. :)
>>I got it as an e-mail. The program downloaded immediately, and installed itself just by clicking on it.
You mean opening the _email_ gave you a trojan or opening the _attachment_?
It was probably a bot in the email. Then it was logging on to a chat room to tell its master it was up and running and get a RAT (remote access trojan).
A poor one at that if it does not wait for keystrokes/internet traffic to hide the fact it is using your modem. (hard to type and watch the modem lights at the same time)
> You mean opening the _email_ gave you a trojan or opening the _attachment_?
I went to click on it to delete it, and away it went. I have configured some options to get rid of that though. I'm going to look into stuff that's similar to friends lists for messengers. Block all these address, if this e-mail isn't this, yadda yadda, then simply delete it no questions asked.
It was a forward also, it had the subject of honey, it had an attachment. I simply clicked on it ( single click.....to delete it ) and away it went.
Something I've found useful is a thread manager. One virus I had had the attribute of System file, and I culd not delete it, and when I tried to go in thru winfile.exe (C:\windows\...) It froxe my box. I deleted its sys thread, shift+del'd it, zappo!