Have I been hacked? - Page 2

Plonking · 16-05-2004, 19:52

Unfortunately, I wasn't browsing the same site as before... in fact, I only had excel open to print some lecutre notes, with no IE in sight!

I'll run that browser hijack program as soon as the antivirus has finished

I was wondering if it was a newish backdoor thing that hasn't been identified yet.. what are the DDE and MCI windows, anyways?

Theere was also an MSN-messenger style query window open with no text in it. I read somewhere some viruses use these to get in, because the ok button at the bottom of the query window can be clicked to allow access to others.

HOWEVER, weirdly enough - I don't trust messenger at all, so have my firewall block it whenever i am not using it. at the time the weird events i have described occurred, messenger was closed and supposedly blocked by my firewall. yet ten msn-related windows suddnely popped up!

16-05-2004, 19:55

Quote:

Originally Posted by Plonking

Hey all!

It's happened again!

This is getting frustrating now!

This time I was using powerpoint and not doing anything else. Again, a tonne of windows were opened - I IMMEDIATELY unplugged my internet connection. Currently running a virus scan on the pc. It's d/ced from the internet right now; I can't figure out how people keep getting into it. It's windows xp and I have put into effect all the latest updates and so on, so am REALLY starting to get confused by all this!

I'll post some piccies from the last time it happened in a few moments...

P

Hi Plonking

have you tried running 'Hijack This' available from

http://www.spywareinfo.com/~merijn/downloads.html

- be very careful, though, & make absolutely sure a process is dodgy before zapping it.

<edit> looks upwards & it's Iadom who beat me to it this time

Plonking · 16-05-2004, 20:01

Hey Gaz... cheers for the info - and yeah i think you were beaten to it!

The virus scan is on the letter D at the moment, so it may be a while before i can run the hijack thing- if i see any dodgy processes, i'll come here and ask about them first before messing up my pc too much, lol!

can these hijack programs really work when i have no internet browser open? i've noticed that outlook express has stopped asking me for a password when i open it.. might that be connected to all this in some way?

iadom · 16-05-2004, 20:06

Quote:

Originally Posted by Plonking

Hey Gaz... cheers for the info - and yeah i think you were beaten to it!

The virus scan is on the letter D at the moment, so it may be a while before i can run the hijack thing- if i see any dodgy processes, i'll come here and ask about them first before messing up my pc too much, lol!

can these hijack programs really work when i have no internet browser open? i've noticed that outlook express has stopped asking me for a password when i open it.. might that be connected to all this in some way?

Sorry Gaz

you can use Hijackthis to produce a log that you can past here, someone will be able to identify any bogies it lists on your system.

Plonking · 16-05-2004, 20:09

Cool! Well the scan is on program files now, so it won't be too long! I've downloaded hijackthis on this pc (I'm getting so paranoid now about windows i'm using redhat instead!) and will transfer it across as soon as the scan is done

thanks for the help you guys! i'll post the results of the scan here when done ... *crosses fingers* !

TheBlueRaja · 16-05-2004, 20:11

Please post a screenshot of one of the windows that pops up. You can do this by selecting one and pressing ALT and Print Scrn at the same time.

Plonking · 16-05-2004, 20:39

hiya!

i have attached some more piccies to this message, as well as the log file from hijackthis...

the pictures.. one of them is of the messenger style window that came up, and the second is what my desktop looked like. it has lots of window headers -

unfortunately i can't give a more accurate pciture of the *moment* it happened - after unplugging the modem, i tried closing some of the windows that had opened before taking a picture. a whole host of windows from different programs opened, and its all very, very confusing!

If it happens again (hopefully it won't), i'll get more accurate piccies!

P

Dave Stones · 16-05-2004, 21:07

i get a window like the second pic you uploaded just then when sygate blocks a process from running... (the one with the "do not show this again" checkbox).

are you running sygate?

Plonking · 16-05-2004, 21:09

ah yeah i am indeed running good old sygate

i'm still really confused as to where all this stuff came from and how it happened, though! any thoughts or theories?

Dave Stones · 16-05-2004, 21:11

Quote:

O8 - Extra context menu item: Download with Go!Zilla - file://C:\PROGRA~1\Go!Zilla\download-with-gozilla.html

just noticed this.... do you have gozilla running? the free version of that has plenty of spyware etc floating around in it i think...

[edit] also

Quote:

O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab

this is spyware apparently...

Plonking · 16-05-2004, 21:12

howdy.. yeah i do have gozilla.. although i never use it - last time i tried to, it said i should uninstall it as it was corrupt -

ok ill get rid of it right this second.. cheers for the suggestion!

Plonking · 16-05-2004, 21:20

well gozilla is gone, and it was probably doing something to my pc - all the user icons for xp have changed to being the chesspieces, and also, after typing in my user name and password, everything loaded a helluva lot faster than normal...

ill get rid of that other piece of spyware too! thanks for your help !

16-05-2004, 21:53

Quote:

Originally Posted by Plonking

well gozilla is gone, and it was probably doing something to my pc - all the user icons for xp have changed to being the chesspieces, and also, after typing in my user name and password, everything loaded a helluva lot faster than normal...

ill get rid of that other piece of spyware too! thanks for your help !

I should have noticed gozilla, it's notorious for nasties.

- Plonking I left you a message on my bulletin board

Plonking · 16-05-2004, 22:01

lol nah i'm the

for having gozilla in the first place!

i've got firefox but keep using ie... silly me! firefox has that nice d/l control thing.

anyways i hope these troubles don't spring up again! i had no idea my browser could be hijacked when it wasn't even open!

lol, i have seen your message and replied already :P

16-05-2004, 22:52

Quote:

Originally Posted by Plonking

lol nah i'm the

for having gozilla in the first place!

i've got firefox but keep using ie... silly me! firefox has that nice d/l control thing.

anyways i hope these troubles don't spring up again! i had no idea my browser could be hijacked when it wasn't even open!

lol, i have seen your message and replied already :P

saw that - thanks

none of the replies had any nasties - I think you may be clear? - and thanks for your feedback