changing Ip address to stop keylogger?

[shadowwill]

hi there, yesterday my brother stupidly went on a website that had a keylogging hacking thing on. he was on habbo hotel and when he clicked on it he got logged out, does this mean this hacker is already on my network? and is this stuff virus based? i was told that he can go trhough my IP address and get my host and be able to browse through our network and get confidential information which is very worrying. So we dissconnected out internet and phoned my ISP which is talk talk, they assured us that we have a dynamic IP address which keeps changing. The guy who told me about this said that if u change ur ip address this hacker will have an invalid ip address, so he couldnt do anything. Would this dynamic IP address of mine stop it? if not what should i do, if this virus is on the pc that it was downloaded to, can it spread accross my network to my other pc's? if i reformat the pc that was used to click on the link, will it stop it? please help from what ive heard this is very serious, Thankyou for your help.

regards, Will B

[Cellus]

If your system is compromised, it doesn't matter what IP address you have (dynamic or not). Malware on your computer can "phone home" by itself. Also dynamic IP addresses from ISPs do not change as often as people think - if you are always-on/connected, you can hold the same IP for quite a long time (days, weeks, even months).

If you were to completely wipe the PC and start from scratch then it can wipe out an infection, however you could also try cleaning your PC.

Take a look at our HijackThis 5 Step Process and post a HijackThis log in our HijackThis Log Help board, where a member of our security team will assist you in cleaning your PC. Our security team is very busy, so please expect some delay in reply.

[shadowwill]

hi there, thanks for your reply, however the pc that was used to click on the link and get the virus is full of disease anyway so we will just reformat the hard drive. So once the hard drive is wiped, there is no way that this can continue? or can this hacker still get to us? and also can this damage or infect our router? i dont think it should but just checking, cheers mate :)

[johnwill]

While it's theoritically possible to infect a router, it would be VERY difficult, and I know of no virus strains that have tried to date.

[shadowwill]

ok so if we reformat the hardrive on that pc, we will be safe ? and theres no way it can happen to our other pc's on the same network, like, could it have moved itself across our network, we have all done scans on every pc and its found nothing. Thanks for your help.

[johnwill]

Well, malware can move around your network, though most of it tends to require your participation to infect other machines on the network.

[shadowwill]

alright we'll just reformat the hardrive and pray to god we are safe, thanks for your help.

Will B

[shadowwill]

OK coming back to this, ive not had the pc plugged into the internet at all, but because im still cautious, i was wondering if theres a way to view who is on your network, something that will pick up hjow many pc's or devices are on the network at the same time, is there aw ay to do this or is there a prgram which will enable me to do this?
cheers

[johnwill]

Well, you can use something like SuperScan to find all of the TCP/IP devices in a specific address range.

[shadowwill]

mhh, i typed in my ip and it says after a scan

Live hosts this batch: 1

______________________________________________

Total live hosts discovered 1
Total open TCP ports 0
Total open UDP ports 0


does this mean it found my router ?
ive looked in my network connections and my LAN and 1394 net adapter connection (think its my router) and both say they are firewalled. This is really bugging me, Give me your honest opinion, are we safe ? ive unplugged the pc with the virus on and done scans on all my computers and found nothing, is this enough for this hacking person to give up or not be able to do anything?

[johnwill]

I guess that would depend on the IP address of the host found. Is it the IP address of your router?