PDA

View Full Version : WARNING!!! I have Been hit by a VIRUS!!!



Royal Dragon
01-07-2003, 10:57 PM
Anyone who recives an E-mail from me today should just delete it without even opening it!!!!

It got on my system somehow, filled my harddrive to the max, opened my E-mails, and probably sent a copy of itself to everyone in my Address book.

I have sent NO E-mails to anyone today, so if you got something from me, it's not good.

I had to strip my hardrive, reinstall an operating system, and load all my files in from my backup drive.

SevenStar
01-07-2003, 11:21 PM
Do you know which virus it was?

Royal Dragon
01-07-2003, 11:38 PM
No, but I sat there and watched my hard drive go from having about 800 megs to almost 2 gigs in about 15 20 minutes.

I was having wierd problems, lockups and such, so I went to system tools, and checked the drive space on my C drive. It locked up wile I was watching it, and other than the chart going up and up, I couldn't do anything. Heck, I couldn't even turn it off. My reset was not hooked up, so I had to unplug it hot to stop it. When I rebooted, it started all over again.

I have my hardrives partitioned with 2 gigs set aside for the operating system, and the balance of 8 gigs for files. All my files appear OK, but the C drive filled up to almost the max before i realised what was going on.

Later, I thought everything was OK because I ran the windows 2000 beta repair utility, and it was working fine again. It sat unattended for a few hours, and when I came back all my E-mails had been opened. I don't know if a Virus does that, or if someone hacked into me, or both.

I had over 100 unopened e-mails from KFO, that had been sitting there unopened for a week or so , and ALL of them had been opened in a period of about 2 hours wile I was watching Arrmagedon on cable and not paying atttention to the PC.

Once I figured it was a hack or a virus, opened the case, pulled my backup drive out, and then procceded to strip my main hardrive.

I reinstalled window 2000 beta, but my cable modem would not initialise, so I striped it again, loaded windows NT, and then upgraded to the 2000 beta and it is working fine now. I just have to load all my software back in.

all my data was intacked on the back up hardrive, but if I clicked on anything in my software files on the main drive, I got errors telling me the files were not there. BUT, if I switched the drives around, and booted off my backup drive with windows 98, it was all there on my main drive as if nothing was wrong.

Sound familliar?

SevenStar
01-07-2003, 11:44 PM
were the files hidden and renamed? I've seen variants of Nimda that will take an mp3, for example, and mark it as hidden. It will then make a copy of itself (the virus) and name itself as the mp3 file it just hid. When you click on it, you run an executable that makes the virus copy itself again.

Royal Dragon
01-07-2003, 11:52 PM
I don't know, at one point I was in explorer trying to find where all the extra files were, and there was nothing in there I saw out of the ordinary.

Keep in mind, i just installed a new motherboard, Athalon 1.6 gig processor, and memeory, and upgraded to windows 2000 (Beta), so I am VERY familiar with what is "Suposed" to be on my C drive. I saw nothing out of the ordinary, but it kept locking up, and filling up. When i finnaly saw the c drive with 1.8+ Gigs on it, I knew something was really wrong.


I had some problems with it yesterday, but i ran the repair utility, and it fixed it. Then today, same stuff. I again ran the repair utility, and it fixed it.

I noticed it because I was sitting on the couch, and my hardrive was going nuts. That is what caught my attention, because it should have been doing nothing but running my "Fireplace" screensaver. Certianly nothing to make the hardrive run full out for a long periood of time.

Laughing Cow
01-07-2003, 11:56 PM
Royal Dragon.

Check your Firewall and Anti-virus settings.
If you haven't got any firewall installed there are some free ones on the Net.

Not sure how stable and safe Windows 2000 (beta) is, I myself run Windows 2000 Pro and a few Win 98 machines on my Home-Lan.

So far I have been virus free for 7+ yrs.

Royal Dragon
01-08-2003, 12:04 AM
I was running 2000 pro for a wile too, but it ws not reliable. My dad bootleged it, and I think the copy was corrupted, so I went back to the Beta version as it is pretty solid. The problem, is it won't support my Cable modem on it's own. BUT, if I load Windows NT, and Upgrade to 2000 beta, it works great. I didn't even need the install disk for the cable modem, it just worked on it's own.

I need to reinstall my Norton anti virus. I have never run a firewall before. Infact, I don't even know much about them. All my computer skills have been aquired basically by blundering through it blind by trial and error. Just loook at my website, and you will see what I mean.

Royal Dragon
01-08-2003, 12:08 AM
Well, I just tried to install my Norton anti virus, and it says it only works on windows 95. Looks like I will be making a trip to the store.

Laughing Cow
01-08-2003, 12:09 AM
RD.

Have a look at this Firewall:

Zonealarm (http://www.zonelabs.com)

They have a basic free Version, I run the Pro version.

Very little knowledge is needed to set it up and to configure it.

It downloads quickly and will be up and running in a few minutes.

You will be shocked to see what will be blocked initially.

Hope this helps.

P.S.: I am using Win 2000 Pro both at work, home and our clients so far we have had no problems reported.
Win XP is another story altogether.

Laughing Cow
01-08-2003, 12:13 AM
Ooops.

Forgot to mention that my Lan-hub also provides basic firewall, IP-masking, print server and other functions that keep the Lan clean.

Seeya.

Royal Dragon
01-08-2003, 12:14 AM
Yeah, I hear 2000 pro is a good platform, but I got my 2000 beta about a year before 2000 was relesed to the public. I got it for free, and have never had a problem wiht it. you just have to install it by upgrading from NT. I got my 2000 Pro later, but like I said, it ws a bootleged copy, and it never worked right.

My windows NT is an original disk, and the 2000 beta was given to my dad's company for review prior to the original public release, so it too is a clean original disk.

I will download the firewall tonight, or tomorrow, Thanks.

Laughing Cow
01-08-2003, 12:24 AM
Final advise.

DON'T use Outlook or any other Microsoft supplied/sponsored Mail software.

Get a 3rd party Software (Freeware) which you can customize:
1.) Not do download attachments automatically.
2.) Settings for non-html or html mail.
3.) Customizable mail filters.
4.) Collect mail froim multiple mail servers.
etc.

And so on.

All it takes is a few simple steps to get clean and stay clean.

Hope this helps.

GunnedDownAtrocity
01-08-2003, 01:57 AM
"Looks like I will be making a trip to the store."

if i ever hear of you paying for software again i will come to your house and slap you.

txwingchun
01-08-2003, 06:52 AM
Originally posted by GunnedDownAtrocity
"Looks like I will be making a trip to the store."

if i ever hear of you paying for software again i will come to your house and slap you.

You mean people actually pay for software.

Ming Yue
01-08-2003, 07:39 AM
Zonealarm is great.

Download a little app called "Tauscan" too. It's a trojan removal tool. The file inflation sounds like a virus, but your emails opening themselves sounds like someone has gained access to your machine.

Trojan apps hide in all kinds of downloaded media and executable files, usually movies or screensavers.

Tauscan is free (I think it's shareware). It will automatically scan anything you download for trojans and is a very compact little program. It's easily had at tucows or download.com.

and If I were you, I'd reformat those hard drives...

SaMantis
01-08-2003, 07:48 AM
ZoneAlarm rocks, yes indeed. :) I have the free version.

My boyfriend also put a little program called FixIt on my machine. Kind of like Norton Utilities, with antivirus software included.

Radhnoti
01-08-2003, 07:53 AM
Let me second the suggestion to download Zonealarm. I never knew I needed it until I got it a few months back.
"2044 intrusions have been blocked since install. 1067 of those have been high rated." :D

Ming Yue
01-08-2003, 07:57 AM
visit http://www.grc.com and check out thier "ShieldsUp" online internet security tester. It will tell you a whole lot about the vulnerability of your computer.

It's a reputable site with a lot of really useful firewall/PC security info.

:)

Royal Dragon
01-08-2003, 09:26 AM
Hi guys,
I already striped and reformated the main drive, but I left the backup drive alone as it did not appear infected. The backup was windows 98 based, so my Norton antivirus ran on it, and didnot find anything, so I think I'm Ok now. Everything is running much faster now too.

As fro paying for software, I don't see a problem with that. ESPECIALLY with all the problems I had with the Windows2000 pro, which was pirated. My Windows NT is a legit still in the original wrapper copy, and my 2000 Beta was an evanluation version ok'd to be copied and passed around inside my dad's company back inlike 1998 (I've had it since summer of 99). Since there is no copy protection on it, it works fine.

As for the antivirus and firewall stuff,I'm going to just bite the bullet and buy the stuff so I know it actually works. i'd hate to find there was some sort of copy protection on it that disables it by getting infected again.

Does anyone know how to identify a virus ahead of time? I think I may know where it came from.

brothernumber9
01-08-2003, 09:39 AM
I was hit with a version of the Blebla worm last year, it sounds kinda like what happened to you, a bunch of my file associations were destroyed. I only had some shelf bought guardians but none of them detected it beforehand and I'm too lazy to keep downloading updates. I got a version of Inoculate that seems to work well now and has detected a few virus/worms since. but I'm a relative noob to these things so disregard it if its already elementary.

Ming Yue
01-08-2003, 09:46 AM
identify one ahead of time?

Before you get it: most AV programs have an option to run in the taskbar and will scan whatever you tell it to. It will tell you what it finds when it finds something nasty in an email attachment or download.

After you get it but before it explodes: you can run a virus scan every time you shut down, or even schedule one to run in the middle of the night (if like me, you don't shut down the PC very often)

is that what you were asking?

Royal Dragon
01-08-2003, 09:52 AM
Well, I just put that Zonealarm guy on my system. It's only free fro a 30 day trial, but if it works out good, I'm buying it. I want my Norton system back on too.

The one I have does not work with the Windows NT platform, only the Windows 98 and down.

I used to have it running all the time, and scedualed to run a full scan over night.


I think I know the site I picked it up on. The URL is somewhere in my system. If I find it, I'll post it, and the name of the suspected file so you guys can form your opinion.

IronFist
01-08-2003, 12:06 PM
That's why I don't use address books.

Hope you get all your computer troubles fixed. Viruses suck nuts.

IronFist

Sharky
01-08-2003, 12:43 PM
by the way, there's a new firus that attatches itself to mp3's or something :eek: be careful

call me paranoid, but i have a mac (not many people bother making virii for a mac, only 0.5% of people with computers have one or something, and they're harder to make) and still run a firewall and a virus checker.

if anything happened to this computer i'd be very, very upset.

MonkeySlap Too
01-08-2003, 12:45 PM
This is one of the many reasons I use a Mac. How many Windows programs did you have to load just to get stuff to work?

Yipes. A computer should be like a phone - you pick it up, and it works.

Royal Dragon
01-08-2003, 01:12 PM
Usually, it does work well. See, the problem is I want Windows 2000, but I don't want to pay for it, so I'm useing this Beta version I got for free. BUT, the beta version is not complete so if you want to use all the networking features you have to upgrade from NT as opposed to doing a fresh install.

It's working good now, I just have to reinstall all my software. You know MS office, the utility I use for my flyers etc.

Laughing Cow
01-08-2003, 04:39 PM
RD..

Did you download ZoneAlarm PRO or Zonealarm??
Zonealarm should still be FREE, with no trial period.

Pro is better but might be a bit overkill for you, I use it as I use my Notebook BOTH at work, client and at Home.

We get to buy our PC's from IBM via the Company at 25% of retail.
;) :p :D

Pleasures of working on own PC at the Company are that I can install what I want and get tons of Software from the Company for FREE.
Just need a good reason for why I need it and they will buy it.

prana
01-08-2003, 05:25 PM
It is not necessary for a user to double-click on the attachment to become infected as this worm can exploit a security vulnerability in Microsoft Internet Explorer, Outlook and Outlook Express. To prevent reinfection, users of Microsoft Outlook and Outlook Express should install the following patch available from Microsoft:
http://www.microsoft.com/technet/security/bulletin/MS01-027.asp
(This patch fixes a number of vulnerabilities in Microsoft's software, including the one exploited by this worm.)

On the 25th of March and the 22nd of May this virus will display a message box containing the text "Happy Birthday Dear". Also the operation of the mouse buttons will be swapped.


Just patch it, disable Active-X and dont double click strange emails. Update MOST patches within 2 days of release, and update your AV daily (some patches are buggy and can create more problems. :D

Disable NetBIOS over TCP/IP and close off all ports that are listening or at least listen only on loopback if that is all that is req'd.

Cable is great for hacking :p

Laughing Cow
01-08-2003, 05:35 PM
Even simpler.

Get rid of:
Internet Explorer
Outlook
Outlook Express.

Have fun Guys.

Royal Dragon
01-08-2003, 07:50 PM
And replace it with what?

Laughing Cow
01-08-2003, 07:59 PM
Originally posted by Royal Dragon
And replace it with what?

Explorer can be replaced with any of the following:
Netscape
Mozilla
Opera

Outlook & Outlook Express:
For pure mail Netscape Mail will do or any other 3rd party mail Software like npop, Incredimail, Eudora, etc.

There are plenty of cheap or even free 3rd party softwares that will do the same functions.

I just regenerated my Web-Site with Netscape Composer 100% pure HTML.

Check on Cnet and similar sites.

prana
01-08-2003, 09:09 PM
why not just install Linux then ?

Laughing Cow
01-08-2003, 09:18 PM
I would love to go Unix based, but alas I need Win 2000 to do Business.
We still got a lot of clients that insist on it.

These doesn't mean that I need to use Microsoft supplied Software, especially since it is so buggy and full of security holes.

Not sure what RD runs he might need some apps that require a Windows OS.

Just letting him know that there are alternatives to those Softwares.

Serpent
01-08-2003, 09:25 PM
OK, here's a question. Assuming I only use my computer for home use, e-mail, internet, Word, Excel and music and video stuff, what would be the best software set to use, taking into account ease of use and cross-compatability? Also, would Mac be better? What Mac setup?

Laughing Cow
01-08-2003, 09:32 PM
Originally posted by Serpent
OK, here's a question. Assuming I only use my computer for home use, e-mail, internet, Word, Excel and music and video stuff, what would be the best software set to use, taking into account ease of use and cross-compatability? Also, would Mac be better? What Mac setup?

You can get a lot of the Windows Software like MS Office for Mac now.

I would recommend Macintosh with OS X.
Macintosh handles music and video a LOT better than Windows.

Internet Browser my choice at the moment is Netscape 7.0.1 you can use their mail interface or get a 3rd party mail soft.
I use Incredimail as it allows me to retrieve mail from multiple servers.

Hope this helps.

Serpent
01-08-2003, 09:42 PM
Interesting. You really think a Mac is better than a PC nowadays? What about files from other people with PC's? Is their a problem opening things? What about if I do a word doc (for example) on a Mac and need to send it to someone with a pc? Can I just send it or do I need to reconfigure it or what?

Obviously, I'm a neaderthal with all things technological, so please excuse the ignorance!

Laughing Cow
01-08-2003, 09:55 PM
Originally posted by Serpent
Interesting. You really think a Mac is better than a PC nowadays? What about files from other people with PC's? Is their a problem opening things? What about if I do a word doc (for example) on a Mac and need to send it to someone with a pc? Can I just send it or do I need to reconfigure it or what?

Obviously, I'm a neaderthal with all things technological, so please excuse the ignorance!

There shouldn't be any problems, especially if the file was created by the same Software and Version.

These days Softwares and Files are very combatible to minimise these things from happening.

Yes, I think a Mac or Linux machine today is better than a Windows PC.

If you e-mail or ftp a file than the chance of errors are even more reduced than by copying via other media (floppy, CD, etc.)

Example: I use a "256MB Clip-Drive" to transfer Media/Data between my friends Mac and my Windows machine. Plug it into a USB port and off you go, no Drivers, no configuration needed.

Serpent
01-08-2003, 09:59 PM
What's ftp?

(Sorry, I'm such an amatuer!)

Laughing Cow
01-08-2003, 10:05 PM
Originally posted by Serpent
What's ftp?

(Sorry, I'm such an amatuer!)

No problem:
FTP = File Transfer Protocol

like when you upload a file to a Internet Server or similar you use an FTP or File Transfer Software.

It is also often used when transfering a File between different Operating Systems.

The FTP Software will handle all the bits that need to be taken care of.

Serpent
01-08-2003, 10:10 PM
I see. So you could technically say to someone, "I've prepared that file for you; you can collect it from www.blahblahblah" is that right?

And also, even if I had a Mac, I could use MS Word 2000 and it would still produce a xxx.doc file?

(Thanks for your help here, I really appreciate it).

Laughing Cow
01-08-2003, 10:15 PM
Originally posted by Serpent
I see. So you could technically say to someone, "I've prepared that file for you; you can collect it from www.blahblahblah" is that right?


Either that or if both are online at the same time you could dump it directly onto his machine, if you know his IP-Address or vice-versa.

Chat softwares like ICQ, AIM and similar can also be used to exchange files.

For smaller Files I would still go with E-Mail.



And also, even if I had a Mac, I could use MS Word 2000 and it would still produce a xxx.doc file?

(Thanks for your help here, I really appreciate it).

Correct. The File will be named the same and be readable by his MS Word 2000.

Glad to have been of assistance.

Sharky
01-08-2003, 10:16 PM
pleeeeeeeeease lets not start a mac vs pc debate: the internet is littered with them (search any audio engineering forum for example) and we don't need another one.

there's nothing you can do on a mac that you can't do on a pc. pc's are also MUCH cheaper.

let's not 'do this'

Laughing Cow
01-08-2003, 10:22 PM
Sharky.

This is not a Mac vs PC vs Linux debate.

People asked my opinion and I gave it.

Granted PC's are cheaper, but also more prone to viruses and similar which is what started the discussion.

As a person working in the Industry I know what is good and what is bad on ALL of those hardwares and Softwares.

There are still a few things you can't do on either Mac, Windows or Unix based machines.

BTW, I run Windows & Unix based machines both at work and at home.
But my next machine at home will be a Max with OS X or newer.

Serpent
01-08-2003, 10:27 PM
Thanks Laughing Cow, you've been very helpful.

Sharky, go and rap or something; you don't have to read it! ;)

Laughing Cow
01-08-2003, 10:45 PM
Sharky.

After having been in the Industry for nearly as long as you have been alive I can make a few recommendations based on my experience and knowledge.

I remember PC-Dos, MS-Dos, and even when the first Macintosh was released.
Totally mind-blowing it had a Graphic interface and funny device called a mouse.

I think I still got Windows 1.06 lying around somewhere at home.

Microsoft based their windows design on the Mac GUI, but the Mac was more designed for the specialist market ( Graphic Designers). Similar to the Amiga machines.

Apple by releasing OS X which is UNIX-based made a big step forward and at the moment it beats Windows hands down.

UNIX based Operating Systems are the way to go may it be OS X, Linux or whatever, even mainframes are running it now.

Unix based systems have come a long way in the last 20 or so years.

Just my opinion n

Serpent
01-08-2003, 10:48 PM
So what would be your ideal set up then?

(And how much would it cost, roughly).

Laughing Cow
01-08-2003, 11:00 PM
Serpent.

My Setup would look as follows, if it were solely used for home-use with no specific extra functions like web-designs.

Prices I can't give you as they vary from location to location.

Apple I-Mac (PowerPC for me) :D
OS X
Netscape 7.0.1
MS Word & Excel for Macintosh
(No need to to install the rest of office)

This should do all your everyday stuff.

In case of PC.

PC = anything goes.
OS = NT 4.0, Win 98 or Win 2000
Netscape 7.0.1
MS Word & Excel.
(Don't even start Explorer, Outlook and Outlook Express)
Zonealarm (Free)
AV-Software
Free Utils like:
Win-Ftp
Incredimail
Irfanview
etc.

JusticeZero
01-09-2003, 11:18 AM
Remove Outlook. Remove Outlook Express. Replace them with Eudora. (Free with an ad in an out of the way and inaccessible corner of the interface)
Download ZonAlarm.
Go hunting for the latest copy of F-prot Free and run it in DOS for a free virus sweep and clean. The free version doesn't scan, and it's in DOS, but **** it works good for detecting and cleaning viruses already on your system.
For good measure, grab the latest copy of AdAware and clean out the spyware and adware you have lying around.

JusticeZero
01-09-2003, 11:21 AM
Oh, and by the way:

You can probably bypass needing to get MS Office by downloading OpenOffice. That's a free download too.

Royal Dragon
01-09-2003, 11:38 AM
He he he eh, I started running the trial of Zone Alarm, and it stopped 4 possible Hack attempts today.

Unfortunetly, it's only a 30 day trial. If anyone knows where I can download a perminant free version, i'd be much obliged.

FatherDog
01-09-2003, 11:40 AM
Personally, I use Redhat 7.3 at home. But I also deal with Unix and Linux for a living, so I'm not a typical user.

I agree with Laughing Cow that MacOSX is an excellent OS for a standard user. I've done some work on it to set it up on clusters here, and it's got a fairly friendly interface with good graphics capabilities.

Some of the newer Linuxes that have come out with specific redesigns to make them more accessible (SUSE, Mandrake 9.0, Redhat 8.0, Lindows) are supposed to be very approachable. I don't have much personal experience with most of them, but The Register and Newsforge have done several articles on installing various linuxes from an 'average user' point of view that were pretty complimentary of them, particularly Lindows, in terms of being userfriendly.

GunnedDownAtrocity
01-09-2003, 01:54 PM
"If anyone knows where I can download a perminant free version, i'd be much obliged."

email me at abaddon@1st.net and i can point you to full versions of win2k (though id recommend xp personally) and norton 2002.