Hackers, Problems. Help.

Html33 · 08-01-2008, 12:17 PM

Hello! Thankyou for reading my thread and i hope you can help me!

The other day i was recived admin at Fagex.net. I was happy as i can assure you would be if you had worked hard for it. There were many people who did not like this and whom were jelous.

Somone paied $500 for my account on there to be hacked. And like a fool i did not change my password from the last database that was leaked, And it was cracked - Or was it?

My website which i will not name had nulled VB on it and ended up with this Java Virus which appentaly takes all my stored information in Firefox IE stored passwords etc. A few days later the "Hacker" started tanting me yes thats right, he was rigning me house phone, Knew EXACTLY where i lived. You could say he knew me better than i knew my self.

Then i got to the question - How? How did he do it? When? Why?

At the time i had just installed Windows Vista 64Bit and as im sure you've all do you just dont get around to installing an Anti-Virus well this was exactly what i had done. I had not installed any Anti Virus and when i did it spotted it after a scan.

He said he Injected a Keylogger remotly so this made me think How can i prevent it?

I've so far installed BitDefender [Paied version] and updated it.
I've done ALL updates.
I use Firefox - So no risk of ActiveX
I've Installed SuperAntiSpyware

But, What can i really do to stop or hold him back? Because he got the root password for the entire site! And worst of he knew me like i was his best friend!

EDIT: I have reinstalled windows, I did not want to risk getting rid of them and not removing it 100%

EDIT: I thought i would install a Hijack this report this is on my new os and i do NOT think it's infected.

Quote:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:16:11, on 01/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Internet Download Manager\IDMan.exe
C:\Program Files (x86)\Xfire\xfire.exe
C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
C:\Program Files (x86)\Analog Devices\SoundMAX\SMax4.exe
C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
C:\Program Files (x86)\SpeedFan\speedfan.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Aidan\Documents\Downloads\Programs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\Antispam32\IEToolbar.dll
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Xfire.lnk = C:\Program Files (x86)\Xfire\xfire.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CF188FF-9DD5-4599-AAA8-6541D1E02F57}: NameServer = 192.168.1.254
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 6804 bytes

My system specs are

Intel Quad Core Q6600 @ 3.1Ghz
Asus P5k - Premium Wifi
BFG 8800GT OC2
4Gb Crucial Balstixs Ram @ 1066Mhz

I dont think you need any more information, If so ask me in the thread :)

**af3** · 08-01-2008, 12:21 PM

Quote:

Somone paied $500 for my account on there to be hacked. And like a fool i did not change my password from the last database that was leaked, And it was cracked - Or was it?

No, your password was leaked, like you said.

Disable the current root and make a new obscure root account with a LONG password.
https://www.grc.com/passwords.htm

This stuff fascinates me, please excuse. It is highly illegal, contact the FBI if he did not in fact wipe the server logs somehow.

I doubt the FBI would help you out with this.

Html33 · 08-01-2008, 12:25 PM

Quote:

Originally Posted by af3

No, your password was leaked, like you said.

Disable the current root and make a new obscure root account with a LONG password.
https://www.grc.com/passwords.htm

This stuff fascinates me, please excuse. It is highly illegal, contact the FBI if he did not in fact wipe the server logs somehow.

I doubt the FBI would help you out with this.

The server is now secure. And so is my pc [As far as im aware]

I want to prevent it now!

EDIT: I have reinstalled windows, I did not want to risk getting rid of them and not removing it 100%

**af3** · 08-01-2008, 12:27 PM

Prevent what? He has your information. Have you spoken to him? Are you in danger?

Html33 · 08-01-2008, 12:29 PM

Quote:

Originally Posted by af3

Prevent what? He has your information. Have you spoken to him? Are you in danger?

Prevent him injecting a keylogger on to my system again.

I know he DID because i found it. And i DO NOT download on the machine its used only for sorting hosts out etc.

He has my information, Correct. But i want to prevent him getting the server detials again as that is now secure. I Have spoken to him he added me on msn. This is what made me do a scan because he said he put a keylogger on there. And he did.

**af3** · 08-01-2008, 12:41 PM

Eh, he can't do it if you have JavaScript disabled on your browser. Turn it off, and make exceptions for trusted sites.

Do you use IE? Turn your security all the way up by default, and add trusted sites to your trusted zone.

Why do you use MSN?! There you go, another attack vector! I wish I could direct you to a security for dummies post but I have not found one as of yet.

Html33 · 08-01-2008, 01:01 PM

Quote:

Originally Posted by af3

Eh, he can't do it if you have JavaScript disabled on your browser. Turn it off, and make exceptions for trusted sites.

Do you use IE? Turn your security all the way up by default, and add trusted sites to your trusted zone.

Why do you use MSN?! There you go, another attack vector! I wish I could direct you to a security for dummies post but I have not found one as of yet.

I think you're being alittle harsh here. I came to this place for advice. And so far you have not givvin me ANY!

I do not use IE as STATED in the post. I use Firefox.

Why do i use MSN? Who doesent it's a good commincation porint. So you do not use software? Because MSN is one of the most common and is probably quite safe. And to say that i need a Secuirty post for dummys is way of.

**linderman** · 08-01-2008, 01:10 PM

aF3 ..... I agree with OP; this type of statement is not welcome here at TSF

"I wish I could direct you to a security for dummies post but I have not found one as of yet."

The OP has the frustrations of dealing with security issues which he needs to get under control.

provoking posts will not be tolerated. If you have something to add that is of "substance" then; by all means please do ......

thank-you for your understanding ....... hoepfully we can get this thread back on track with some meaningful discussion.

best regards

joe

**af3** · 08-01-2008, 01:50 PM

Provoking posts? linderman, is there a security faq or "Security For Dummies" style write-up for website admins? I had hoped anyone would know what I mean by Security For Dummies... (Helpful Books)

I thought "For Dummies" and "Frequently Asked Questions" were exchangeable phrases, please excuse.

To answer as politely as possible:
A comprehensive security policy is advised. For example, don't save passwords. This must be published somewhere but I cannot locate it at the moment.

And to directly answer your main questions:

Quote:

But, What can i really do to stop or hold him back? Because he got the root password for the entire site!

Contact the proper authorities (whoever they may be) and give them as much information about this individual as possible including any server logs that have evidence of his attacks. You have stated that the site and your computer is now secure, so my only answer is adopt a strict security policy.

EDIT:
This stuff should help:

Serverside:
http://www.netshinesoftware.com/secu...trategies.html
Clientside:
http://www.grc.com/sn/sn-038.htm

Html33 · 08-01-2008, 02:37 PM

Quote:

Originally Posted by af3

Provoking posts? linderman, is there a security faq or "Security For Dummies" style write-up for website admins? I had hoped anyone would know what I mean by Security For Dummies... (Helpful Books)

I thought "For Dummies" and "Frequently Asked Questions" were exchangeable phrases, please excuse.

To answer as politely as possible:
A comprehensive security policy is advised. For example, don't save passwords. This must be published somewhere but I cannot locate it at the moment.

And to directly answer your main questions:

Contact the proper authorities (whoever they may be) and give them as much information about this individual as possible including any server logs that have evidence of his attacks. You have stated that the site and your computer is now secure, so my only answer is adopt a strict security policy.

EDIT:
This stuff should help:

Serverside:
http://www.netshinesoftware.com/secu...trategies.html
Clientside:
http://www.grc.com/sn/sn-038.htm

Thankyou, Much better hehe.

I will contact the law enforcements and get them to do somthing about it, Although these are "Kids" doing the injections of the keyloggers etc and wont understand exactly what they're doing. So as far as server side goes i cant do much more, but as far as my system goes what should i do to protect it?

Bitdefender along enough?

**af3** · 08-01-2008, 07:17 PM

Wait, one more thing. The OWNER of the site should contact the authorities. You are an admin, but are there others? If so, please consult them and compile your evidence and work on a defense plan as a group. I have no idea what your site is about, so I can't make any specific recommendations.

BitDefender is great, but use a good Anti-Spyware too.

dai · 08-01-2008, 08:49 PM

http://www.microsoft.com/protect/you...rd/create.mspx
http://www.techsupportforum.com/showthread.php?t=15968

Html33 · 08-02-2008, 02:27 AM

Quote:

Originally Posted by af3

Wait, one more thing. The OWNER of the site should contact the authorities. You are an admin, but are there others? If so, please consult them and compile your evidence and work on a defense plan as a group. I have no idea what your site is about, so I can't make any specific recommendations.

BitDefender is great, but use a good Anti-Spyware too.

Thanks, That's great.

Quote:

Originally Posted by dai

http://www.microsoft.com/protect/you...rd/create.mspx
http://www.techsupportforum.com/showthread.php?t=15968

Yeah. I happend to be browsing the forum and see the TSF thread and for the microsoft one my password was pretty secure.

So, From what i can see there is not much else i can do is there?

Mcninjaguy · 08-02-2008, 03:17 AM

In firefox 3 download this No-script add on to disable java script
https://addons.mozilla.org/en-US/firefox/addon/722

Html33 · 08-02-2008, 10:41 AM

Quote:

Originally Posted by Mcninjaguy

In firefox 3 download this No-script add on to disable java script
https://addons.mozilla.org/en-US/firefox/addon/722

Alright, That sounds good. Although i can only assume that will block Java Script?

Hmmm ....

I'm a tricky and picky customor haha

Mcninjaguy · 08-02-2008, 11:03 AM

yea.. there's a couple more addons i uselike adblock plus, WOT and Adblock Plus: Element Hiding Helper. You can also get flashblock.

I dunno what to suggest but keep the browser simple so you don`t need to mess with options all the time

The only thing you have to fool around with in NoScript is allow websites to display their info otherwise it blocks anything extra in the site.

I haven`t got a pop up and 90% of ads are missing in sites since I`ve used the NoScript and Adblock plus

Html33 · 08-02-2008, 11:10 AM

Quote:

Originally Posted by Mcninjaguy

yea.. there's a couple more addons i uselike adblock plus, WOT and Adblock Plus: Element Hiding Helper. You can also get flashblock.

I dunno what to suggest but keep the browser simple so you don`t need to mess with options all the time

The only thing you have to fool around with in NoScript is allow websites to display their info otherwise it blocks anything extra in the site.

I haven`t got a pop up and 90% of ads are missing in sites since I`ve used the NoScript and Adblock plus

Alright, Cheers for the advice!

08-01-2008, 12:27 PM	#4 (permalink)
af3 TSF Enthusiast Join Date: Jun 2008 Location: USA Posts: 1,173 OS: XP32, the gaming OS. My System	Re: Hackers, Problems. Help. Prevent what? He has your information. Have you spoken to him? Are you in danger?

08-01-2008, 12:41 PM	#6 (permalink)
af3 TSF Enthusiast Join Date: Jun 2008 Location: USA Posts: 1,173 OS: XP32, the gaming OS. My System	Re: Hackers, Problems. Help. Eh, he can't do it if you have JavaScript disabled on your browser. Turn it off, and make exceptions for trusted sites. Do you use IE? Turn your security all the way up by default, and add trusted sites to your trusted zone. Why do you use MSN?! There you go, another attack vector! I wish I could direct you to a security for dummies post but I have not found one as of yet.

08-01-2008, 01:10 PM	#8 (permalink)
linderman Moderator, Hardware Team Join Date: May 2005 Posts: 20,440 OS: win 2000 pro / Win XP pro My System	Re: Hackers, Problems. Help. aF3 ..... I agree with OP; this type of statement is not welcome here at TSF "I wish I could direct you to a security for dummies post but I have not found one as of yet." The OP has the frustrations of dealing with security issues which he needs to get under control. provoking posts will not be tolerated. If you have something to add that is of "substance" then; by all means please do ...... thank-you for your understanding ....... hoepfully we can get this thread back on track with some meaningful discussion. best regards joe __________________ I still know nothing and I respect that fact, striving to improve and, along the way, help anyone that comes from the place that I used to be! Power Supply Selection LEARN TO BACK-UP YOUR DATA FREE & EASY YouTube - Runtime Software DriveImage XML tutorial

08-01-2008, 07:17 PM	#11 (permalink)
af3 TSF Enthusiast Join Date: Jun 2008 Location: USA Posts: 1,173 OS: XP32, the gaming OS. My System	Re: Hackers, Problems. Help. Wait, one more thing. The OWNER of the site should contact the authorities. You are an admin, but are there others? If so, please consult them and compile your evidence and work on a defense plan as a group. I have no idea what your site is about, so I can't make any specific recommendations. BitDefender is great, but use a good Anti-Spyware too. Last edited by af3; 08-01-2008 at 07:18 PM.

08-01-2008, 08:49 PM	#12 (permalink)
dai Manager, Hardware Forums Join Date: Jul 2004 Location: west australia Posts: 56,678 OS: win 7 32x 64x rtm	Re: Hackers, Problems. Help. http://www.microsoft.com/protect/you...rd/create.mspx http://www.techsupportforum.com/showthread.php?t=15968 __________________

08-02-2008, 03:17 AM	#14 (permalink)
Mcninjaguy Temporarily Banned Join Date: Jun 2008 Location: Ottawa, Ontario, Canada Posts: 10,422 OS: Windows 7 Ultimate 64bit My System Blog Entries: 1	Re: Hackers, Problems. Help. In firefox 3 download this No-script add on to disable java script https://addons.mozilla.org/en-US/firefox/addon/722

08-02-2008, 11:03 AM	#16 (permalink)
Mcninjaguy Temporarily Banned Join Date: Jun 2008 Location: Ottawa, Ontario, Canada Posts: 10,422 OS: Windows 7 Ultimate 64bit My System Blog Entries: 1	Re: Hackers, Problems. Help. yea.. there's a couple more addons i uselike adblock plus, WOT and Adblock Plus: Element Hiding Helper. You can also get flashblock. I dunno what to suggest but keep the browser simple so you don`t need to mess with options all the time The only thing you have to fool around with in NoScript is allow websites to display their info otherwise it blocks anything extra in the site. I haven`t got a pop up and 90% of ads are missing in sites since I`ve used the NoScript and Adblock plus