A really frightening experience.

[Greysand]

I've been really upset for the past few day. I've changed the numbers on all my credit & bank cards, I've called the credit bureau's and put out fruad alarts, I've changed most of my passwords and I've given thought to changing my phone numbers.

And I'll tell you why. I've recently moved. And I changed banks. So I wen't online and updated all my information with my bank, eBay, Auto & Home Insurance, Paypal, Gunbroker, and probibly a few others. And I noticed afterwards that my desktop was acting kinda strange. The internet was really slow, and Zonealarm (my current hero) was pulling up requests for strange programs wanting to access the internet. (I denied all of them)

So I looked into it a little deeper and was horrified to discover that I had somehow picked up the Smitfraud-C trojan and that it had downloaded a few other things onto my system. (I blame outlook, But I really don't know how it got in)

Now the really nasty part about this and the reason that I'm posting this here is that one of the things it downloaded was a keystroke monitor. Now how bad could that be you ask? Well the answer is really bad. After I dug around in the windows system32 directory a bit i found a log file that had almost ALL my personal information in it.

Full name. First, Middle, Last
New Address. And Old, and a few others I had entered as searches.
Phone number(s)
(luckly the SS# area of the file was blank)
Email address's and Passwords for said emails (a couple of mine and a few of my friends)
Credit card Numbers. (two of mine, and one that I don't know, might be a program serial#)
Where I work.
Websites I visit, & time spent. Average times I am online (When I am home & gone)
All my search queries via google, eBay, Gunbroker, and everything else.
Major interest = "Firearms"

I'm lucky that I found it. Really lucky. I haven't had a charge on any of my CC's yet. And I think (hope and pray) that Zonealarm kept it from sending any of the information out. The Log on my machine was stored under C:/windows/system32/drv32dta/pstore_010107_010107.txt

So the reason I'm posting - I just wanted to remind everyone that these computer things are really not as secure as we think and hope that they are. And the amount of info that they can collect on us (with & without our knowlage) is really scarry. So please take a look for that directory on your own machine & run a scan.. I'd hate for anyone else to go through what I've had to deal with for the past few days.

Not to mention the possibilty of being robbed. It makes me sick to think that someone - somewhere out there might have a really good profile on who to rob next.

Be Safe out there guys. Keep that virtual powder dry.



Ps, MOD's please move this if the general forum isn't the right place for it. & everyone else, please excuse the lack of a spell checker. I still don't fully trust the desktop and I'm writing this on a vintage 1997 laptop. Win 95 & no spellchecker to be found.

 

[coelacanth]

excellent post - thanks for the heads up

I hope you get by this one unscathed - I've just about quit all internet purchases at this point because it seems the hacker nation is about even with the security folks at this point.

 

[Alphazulu6]

Ouch... Any way to tell where you picked that up??? I hear that they can be stored in cookies that hijacked websites can distribute. Its a sad age we live in with all this technology fraud and exploit that its important to stay on top of it and be proactive about whats going on behind the scenes of our computer.
I run virus scan every other night just to be on the safe side. I would recommend it to any High Road patron to do the same

 

[Kacerdias]

You probably picked it up via a browser hijack. I do network security for a living so I spend much of my time fighting these bits of malware. Internet Explorer (at least the older versions) is more porous than a sponge. There are hundreds of exploitable bugs that could allow infected websites to drop and run various viral payloads. I wouldn't bother trying to "clean" the system as there is no foolproof way to ensure you got every shred of the infection. The only safe way is to back up your data and format/reinstall Windows. As the motto in IT goes - if a badguy can touch your system, it isn't your system anymore.

In my experience, switching to a different browser keeps most of this stuff at bay. I use Opera whenever I can and only use IE when specific (trusted) websites require it. Also, you may want to concider getting a robust antivirus suite and set it to maintain itself. (Zonealarm is a good start, but it isn't an antivirus package) Mcafee makes a great one - be sure to enable the rule that prevents executables from running in the temporary internet cache folder. That will knock out 90% of the browser hijack attempts right off the bat. Oh, and be extremely wary about what you install - many of the "free" programs out there have a hidden price... your data. If you would like help with hardening your system, feel free to PM me.

To keep this thread from drifting too far off topic: I wouldn't worry about the "firearms" interest being broadcast. It is unlikely that you will be targeted specifically for your guns. Information thieves are primarily interested in dealing with personal data and how to use that data to steal your identity. It is far less risk with greater payoff than trying to break into a house where they know the owner to be armed. Report what you have found to your bank and be sure the big 3 credit companies (Experian, Transunion, Equifax) have a freeze on new credit cards in your name.

 

[Trebor]

On this subject, what is the "official" firefox download URL? I'm going to install Firefox on my new system, but want to make sure I'm at the right site and not some fake site full of Trojans first.

 

[Kacerdias]

Trebor, I have PMed you the link. I don't want to drift too far off the firearms topic and upset the mods.

 

[glockman19]

Thanks for the reminder. Don't forget to get a good computer security program and don't forget to run it regularly. Firewalls, virus protection etc...

 

[brerrabbit]

mozilla.com

mozilla is a gnu browser, firefox is the newest implementation of it. They have windows binaries.

 

[FireFalcon]

You could log back on to that computer and run 'netstat' to find his IP address.

once you have it, use www.arin.net to find out where he is coming from. Then report it to the appropriate authorities
(http://www.ic3.gov/), though they may not do much, it might give you some peace of mind.

 

[PatPatPat]

I got me a Trojan today also. First malware in a while. I need zone alarm though.

 

[Greysand]

Thanks Kacerdias, I'll be contacting you when I get all the data on that machine backed up. And I'm ready to re-install. All the spyware programs (spyware S&D, & pandascan) come back clean, but I still just don't trust it. & FireFalcon thanks for the links. I'll take a look at those links before I nuke the machine and start from scratch again.

I'ts nice to know that I likely won't be robbed. But it still burns me up that there are people that have nothing better to do with their time than this virus trash.

I think I may print and frame the data log that they gathered on me. & Post it on my safe as a reminder not to let my guard down.

 

[Jim March]

Almost a year ago I got hit in semi-similar fashion: something tried to turn me into a spam relay zombie. Crawled right through Zonealarm (fully updated pro version).

I found some free software capable of totally eliminating these problems:

http://www.ubuntu.com

Extreme? Maybe. But kissing off Bill Gates was the best thing I ever did.

 

[Dysfunctional Individual]

The only reason Windows gets hit so often is its much greater popularity vs. Linux and Apple. It's certainly not because these other platforms are inherently more secure. The payoff is far larger if you target Windows instead of anything else.

These days, it's best to assume any PC you're using can be compromised and try to work with that, applying various tactics to make life harder for hackers. It's preposterous to the point of being laughable, but that's what we've gotten out of the collective intelligence of all those who've contributed to this fiasco.