Hack/Spoof

[Bounty]

Ok I feel the need to tell you guys of a spoof I experienced a while back.

It was about a year and a half ago I think, but I still remember my exact emotions and feelings like it just happened.

At this time I didn't have as much knowledge in computers and the internet I have now, obviously not in hacking at all.

It wasn't so much of a hack that it was a spoof. I was going about my normal internet activities, surfing, e-mail'ing... ICQ and all that. Suddenly a window came up, I was familiar with it.. the reformatting window. I looked at it, it said "Reformatting Drive C" and the progress bar started to rise.

I had no internet security firewall as I was on dial-up and was so naiive as to what people were capable of at the time.

I panicked.

At first I hit the power button on my computer, only to remember that it needs to be properly shut down. So, I did the next best thing and yanked the power cord from the wall (I don't suggest this, can cause power surges and create bad file sectors)

I haven't had any experiences with hackers since, however my friend who is totally clueless when it comes to computers as is anyone in the house with that computer is continuously hacked.

I'm fairly certain they have some sort of Trojan or BO server installed on their computer as they constantly have people opening/closing their CD drive and such. I've offered to download the appropriate fixes, but they didn't want me to.

I guess if you want to be taken advantage of, you can. To me it seems like behind haunted. The ghots will do what they want if you let them, but you can always exorcise them http://www.speedguide.net/ubb/smile.gif

------------------
Bounty

[bug]

I have seen a Web Page that does the 'Formating Drive C' senerio, as a joke. They were using Java, and you could not close the webpage down till it finished it's little skit. Scared the hell outta allot of people. Guy thought it was funny. What a twit!

[Addikt]

There's a possibility that you have something like SubSeven installed on your system, which would allow a user to do just that.

As for your friend's comp, that's EXACTLY what he has installed, SubSeven. You can do that and much more with it. Not that I know or anything. http://www.speedguide.net/ubb/wink.gif

------------------
dualboot (http://dualboot.net/cgi-bin/Ultimate.cgi)

[Juggernaut]

Addikt, you can't be so sure it was SubSeven tho. There are tons of those types of programs out there that can do things like that. I agree that it's a trojan tho. I'm just posting this reply because if u do a search on the friend's computer for SubSeven and nothing comes saying he has it, don't start thinking that u'r safe. Like I said, there are tons of those programs out there. Dumb people like to get their kicks by screwing over anonymous people.

[bug]

So get yourself a trojan killer like The Cleaner from www.moosoft.com (http://www.moosoft.com) Works for 30 days, easy enough to crack http://www.speedguide.net/ubb/smile.gif

[CoolJ]

Stupid Hackers, I Hope They ALL Get Caught!

[FunK]

Yeah, definitely a trojan.
The best way to learn about them is to get a LAN and infect your other machine.
Then use the trojan itself to remove the server. Most trojans allow you to remove the server.
The best way to find out if you are infected and being messed with, is to use a firewall. Get Atguard, ZoneAlarm etc. Set the security HIGH and then leave your computer on.
Go back and look @ the logs.
Most idiots that use trojans don't change the default port assignment on the server.
Hence if you are getting connections on port 27374, it's probably Sub7.
If 12345, Netbus.
I fyou know the port, you can use the trojan itself to clean the server.

Just do a search on the net for trojans and read about them.
As for the progress message that you saw, that was not the computer actually formatting your drive. It was more than likely one of those funny little exe's that play and show that type of progress indicator and then ask you if you have good virus protection.
Nevertheless, the question remains, "How did the exe get there?" and "Who ran it if you didn't?"
Most good virus programs will catch the server on your computer. But if the server is executed and then deleted, you will never find it with anti virus software.
Just monitor your connections closely.

Peace
FunK