Hello,
This will especially interest those with cable connections (who can be
online all the time) and probably all internet users in general. I
don't know... it might be old news but it wasn't to me.
You see, yesterday something very interesting happened with my system.
I was racing a couple of buddies via the net when I experienced
several major and then one total screen pause. Normally my races are
silky smooth so this was unusual. So I CTRL ALT DELed to bring up the
Task List. There were more programs in it than I expected to see; one
of which said "FTP," I thought this a bit strange but since I'd done a
PowWow File Transfer not twenty minutes earlier I just figured that it
had not shut down.
Upon closing the Task List a message was revealed on my Desktop. It
said "Are you ***ing with me?" Really was unusual that is. Since I'd
heard somewhere about the possibility of another viewing my Win95
system I wondered whether I had a visitor. The selected default answer
to the query was Yes. I wondered whether selecting the wrong one would
result in something bad happening to my precious system. Like a global
formatting perhaps? I pondered which answer the hacker might really
want - recalling the poisoning scene in The Princess Bride and feeling
very much like the loser of that dilema. In the end I clicked Yes.
Nothing seemed to happen. A little relief there.
At about the same time - maybe after I clicked Yes - my IE4 browser
opened and timed out going to www.manhole.com . Hmmm. Yeah this is
looking bad I thought. Still, whoever was having fun at my expense was
not going to spoil the movie I'd started to watch (Grand Prix) so I
shut everything down and sat down to enjoy it. I even shut down ICQ to
see whether my intruder could return without it running. At this point
I was still holding out the hope that what seemed to be happening was
not really. Shit I didn't want to have to start backing up multi megs
of files.
Fast forward through some spectacular racing scenes and I'm sitting
still watching the movie when my CD tray opens and shuts two times.
You can bet that got my attention. So I look at the Desktop and can
just make out a new message. It says "ur ***ed," At which point my
system shuts down - freezing at the Win95 shutdown screen. Oh yeah, I
thought, someone has been calling on me.
I reset and held my breath. Thankfully it rebooted. Now I am really
getting concerned. I call my friend in Vancouver and he says he read
something about Back Orifice. It is a program that installs itself
(somehow) on your system so that others with not much of a life can
get their jollies annoying people like myself. Well it's long distance
and, besides, my friend is watching the movie too. So I sit down again
to do the same whilst comtemplating just how I am going to figure this
one out.
Another fif*** or thirty minutes passes and another message appears
on my Desktop. This one criticizes my choice of wallpaper... the fact
that I've cropped it and it isn't full screen like it should be. He
called me at lamer!? Amusing. Critics are everywhere.
The movie finishes and I decide to check my drives. Since I have five
one gig partitions I don't really expect to find anything but, low and
behold, right in the root of C (where I never save anything) are two
BMPs and three other new files. The two BMPs are before and after
screenshots of my desktop. How he took them without me noticing him
opening Paint Shop Pro is beyond me. The other three files are named
333; NULL and "um u know u really should be doing stuff on the net
istead of sitting idle" - or words to that effect. His spelling was
worse than I can remember. He's cool isn't he?
The movie finishes and it's time to call my Videotron Tech guy. I've
always gotten courteous, professional help from them but didn't really
expect much with this problem. Dave really sounded informed and had
read about Back Orifice too. He said that it doesn't infiltrate files
but is a program itself and could be anywhere on my system; under any
name. Since it is a new problem he couldn't really help much but he
did put me onto the site: [link lost in import]
a Search for "Back Orifice," produced the following:
[link lost in import]
Read that. It was bang on. In the Windows\System dir I did indeed find
a file exactly of 124,928 bytes. The really weird thing is that, while
Explorer's Size column showed the approximate size, the name was
invisible. The only reason I noticed it so quickly was because a blank
line appeared in the long list of filenames. But checking its
properties revealed that it did have a name. EXE~1. That was all.
Anyway I've deleted it and the Registry entry. Take THAT you scumbag.
Oh and to delete the EXE~1 I had to drop to DOS. I couldn't overcome
its protection in Win95.
Hopefully my visitor has been shut out. Still, he may have left a
calling card. I just ran AntiVirus Toolkit Pro in Deep Scan mode and
found three files infected with two variations of the Trojan virus.
The infected files are:
C:\Windows\patch.exe
C:\Windows\System\windll.dll
A zip called mp3compressor.zip
Anyone know if I just just delete the above .exe and .dll ?
AVP could not disinfect them. What can? Anyone?
The virus names are:
Trojan.Win32.Netbus.160
Trojan.Win32.BO
Two corrupted files are also listed:
C:\Windows\Temporary Internet Files\...\ww980912.zip
E:\Download\TinyWeb.zip
Summary:
It seems the net has become even more dangerous. From what I think I
know, not only could this... uh... person (let's give him the benefit
of the doubt) have deleted files; but he could also have done
things... illegal things... on the net whilst passing himself off as
me. Hopefully he's just a kid getting his jollies. Nothing seems to be
missing.
Oh and I forgot to mention what I thought might have been his way into
my system... A cute little animated greeting card.exe (supposedly from
Hallmark) that a friend had passed along to me. Now I don't think it
was that because after taking the above measures I ran the card again
and the EXE~1 didn't re-install. Besides I got that weeks ago. Still,
I deleted it.
Well? What do you all make of it? Wish you hadn't read this? I
certainly intend to bone up on this subject and find out what measures
I can take to prevent it happening again. WinNT is supposed to be a
lot more secure then Win95/98. Would it protect against this?
You can bet every now and then I'll check for the reappearance of that
EXE~1 file.
To paraphrase Dorothy in The Wizard of Oz:
"I don't think we're in Kansas anymore Toto,"
JB
Shaken a bit in Edmonton, AB,
>Well? What do you all make of it? Wish you hadn't read this? I
>certainly intend to bone up on this subject and find out what measures
>I can take to prevent it happening again. WinNT is supposed to be a
>lot more secure then Win95/98. Would it protect against this?
I'm not an expert on security but I believe it is possible to protect
Win NT much more so than Win95 (but I think you would need to purchase
a "firewall" security program). I may actually switch to NT once I get
my cable modem, as I don't reallly run DOS programs any more.
Thanks for the "heads up". One question: do all Win95 games now run on
NT? Glide, OpenGL, and D3D? What about performance, is there a
performance hit by going to NT?
Joe
Not to be mean, but you should have know this or been told by the people who
installed the cable modem about stuff like this. To help you out, the way
that a cable modem works is that it connects to your cable line(you already
know this...I hope) then it meets at a node. You are on a big LAN, if you
are using a network card, which is fairly common, especially if you are
using Road Runner. So your problem is that everyone on your node can see
everyone else's computer. So someday your neighbor may come over to your
house and ask if he can get the printout that he sent to your printer. The
way that you keep this from happening again is by passwording all of your
drives, use a alpha numeric password, and then save the password. That
should keep your computer protected. Hope I helped other people who are on
cable.
Cya,
Stuart Becktell
Quoted text (141 lines)
>Hello, >This will especially interest those with cable connections (who can be >online all the time) and probably all internet users in general. I >don't know... it might be old news but it wasn't to me. >You see, yesterday something very interesting happened with my system. >I was racing a couple of buddies via the net when I experienced >several major and then one total screen pause. Normally my races are >silky smooth so this was unusual. So I CTRL ALT DELed to bring up the >Task List. There were more programs in it than I expected to see; one >of which said "FTP," I thought this a bit strange but since I'd done a >PowWow File Transfer not twenty minutes earlier I just figured that it >had not shut down. >Upon closing the Task List a message was revealed on my Desktop. It >said "Are you ***ing with me?" Really was unusual that is. Since I'd >heard somewhere about the possibility of another viewing my Win95 >system I wondered whether I had a visitor. The selected default answer >to the query was Yes. I wondered whether selecting the wrong one would >result in something bad happening to my precious system. Like a global >formatting perhaps? I pondered which answer the hacker might really >want - recalling the poisoning scene in The Princess Bride and feeling >very much like the loser of that dilema. In the end I clicked Yes. >Nothing seemed to happen. A little relief there. >At about the same time - maybe after I clicked Yes - my IE4 browser >opened and timed out going to www.manhole.com . Hmmm. Yeah this is >looking bad I thought. Still, whoever was having fun at my expense was >not going to spoil the movie I'd started to watch (Grand Prix) so I >shut everything down and sat down to enjoy it. I even shut down ICQ to >see whether my intruder could return without it running. At this point >I was still holding out the hope that what seemed to be happening was >not really. Shit I didn't want to have to start backing up multi megs >of files. >Fast forward through some spectacular racing scenes and I'm sitting >still watching the movie when my CD tray opens and shuts two times. >You can bet that got my attention. So I look at the Desktop and can >just make out a new message. It says "ur ***ed," At which point my >system shuts down - freezing at the Win95 shutdown screen. Oh yeah, I >thought, someone has been calling on me. >I reset and held my breath. Thankfully it rebooted. Now I am really >getting concerned. I call my friend in Vancouver and he says he read >something about Back Orifice. It is a program that installs itself >(somehow) on your system so that others with not much of a life can >get their jollies annoying people like myself. Well it's long distance >and, besides, my friend is watching the movie too. So I sit down again >to do the same whilst comtemplating just how I am going to figure this >one out. >Another fif*** or thirty minutes passes and another message appears >on my Desktop. This one criticizes my choice of wallpaper... the fact >that I've cropped it and it isn't full screen like it should be. He >called me at lamer!? Amusing. Critics are everywhere. >The movie finishes and I decide to check my drives. Since I have five >one gig partitions I don't really expect to find anything but, low and >behold, right in the root of C (where I never save anything) are two >BMPs and three other new files. The two BMPs are before and after >screenshots of my desktop. How he took them without me noticing him >opening Paint Shop Pro is beyond me. The other three files are named >333; NULL and "um u know u really should be doing stuff on the net >istead of sitting idle" - or words to that effect. His spelling was >worse than I can remember. He's cool isn't he? >The movie finishes and it's time to call my Videotron Tech guy. I've >always gotten courteous, professional help from them but didn't really >expect much with this problem. Dave really sounded informed and had >read about Back Orifice too. He said that it doesn't infiltrate files >but is a program itself and could be anywhere on my system; under any >name. Since it is a new problem he couldn't really help much but he >did put me onto the site: [link lost in import] >a Search for "Back Orifice," produced the following: >[link lost in import] >Read that. It was bang on. In the Windows\System dir I did indeed find >a file exactly of 124,928 bytes. The really weird thing is that, while >Explorer's Size column showed the approximate size, the name was >invisible. The only reason I noticed it so quickly was because a blank >line appeared in the long list of filenames. But checking its >properties revealed that it did have a name. EXE~1. That was all. >Anyway I've deleted it and the Registry entry. Take THAT you scumbag. >Oh and to delete the EXE~1 I had to drop to DOS. I couldn't overcome >its protection in Win95. >Hopefully my visitor has been shut out. Still, he may have left a >calling card. I just ran AntiVirus Toolkit Pro in Deep Scan mode and >found three files infected with two variations of the Trojan virus. >The infected files are: > C:\Windows\patch.exe > C:\Windows\System\windll.dll > A zip called mp3compressor.zip > Anyone know if I just just delete the above .exe and .dll ? > AVP could not disinfect them. What can? Anyone? >The virus names are: > Trojan.Win32.Netbus.160 > Trojan.Win32.BO >Two corrupted files are also listed: > C:\Windows\Temporary Internet Files\...\ww980912.zip > E:\Download\TinyWeb.zip >Summary: >It seems the net has become even more dangerous. From what I think I >know, not only could this... uh... person (let's give him the benefit >of the doubt) have deleted files; but he could also have done >things... illegal things... on the net whilst passing himself off as >me. Hopefully he's just a kid getting his jollies. Nothing seems to be >missing. >Oh and I forgot to mention what I thought might have been his way into >my system... A cute little animated greeting card.exe (supposedly from >Hallmark) that a friend had passed along to me. Now I don't think it >was that because after taking the above measures I ran the card again >and the EXE~1 didn't re-install. Besides I got that weeks ago. Still, >I deleted it. >Well? What do you all make of it? Wish you hadn't read this? I >certainly intend to bone up on this subject and find out what measures >I can take to prevent it happening again. WinNT is supposed to be a >lot more secure then Win95/98. Would it protect against this? >You can bet every now and then I'll check for the reappearance of that >EXE~1 file. >To paraphrase Dorothy in The Wizard of Oz: >"I don't think we're in Kansas anymore Toto," >JB >Shaken a bit in Edmonton, AB,Yikes......sounds like one helluva nightmare. Here's a site you may be
interested in after your experience.
http://eok.net
This site is called "Electronically OK". You can find all kinds of
information/patches for all sorts of different security risks, including
Back Orifice. In fact, if you go to
http://eok.net/hacking.bo.html
you can find 2 programs that will detect and remove Back Orifice from your
computer. One of them is called "Toilet Paper v1.0" :-) I got a kick out
of the name myself.
Hopefully you never have to experience anything like that again.
Mike
MCM Playground
http://members.xoom.com/Motocrossmad
CPR Playground
http://www.cprplayground.home.ml.org
It really has nothing to do with the type of connection you have, and
Back Orifice doesn't install itself. Just like any other service that
is running on your system (in this case a server that listens on ports
and executes commands) it has to be installed by the user. Some hacker
didn't break into your system and install Back Orifice, you did that
yourself. Bottom line, don't run unknown or untrusted EXE's.
- Eric
Do you have Microsoft Client running on your system? An easy way to tell,
is: do you have a "log off ..." button on your 'start' menu? If so, your
network settings may allow your hard drive to be accessed on the network
(via the cable modem). I have been on cable for 1+1/2 years and have not
run across your problem, but thanks for the info!
--
--Paul
My "reply" e-mail address has been changed to
deter spammers. My real address is:
scanguy "at" home "dot" com
Nope. Just the normal three choices: Shut Down; Restart; and MS-DOS
mode.
I've a friend that's been on cable about that long too. He's had no
trouble either. This Back Orifice is a new hacker trick though I
think.
JB
Edmonton, AB,
Hello from St Albert :)
We are just getting cable here, finally.
My Friend who lives in the Westend started his computer one day and his
startscreen said "You have been Snarked" Snark is a guy we know in Florida.
He said it was quite easy to get into My Friends computer once he knew his
IP and replaced the logo.xx whatever file to change the start screen. I
tried it with another friend after one time to see if we could get in after
that. He has Videotron as well. Northend guy..Need I say more :) Sure enough
we were reading his root drive, ripe for the picking :)
But that was just a test after being snarked so we were exploring the hows
and whys.
I'm not a Network guy but I think the easiest thing to do is make sure all
you drives do not on share at all. Not even read only. Cut them all off.
Then no one can give you an unwanted gift.
As for Firewalls and Proxys, etc.. I do not know much about that stuff yet.
After I get cable and set up my server I will be an expert in a month :)
Uh..yah.. Right Jeff? Paul? :)
Quoted text (141 lines)
>Hello, >This will especially interest those with cable connections (who can be >online all the time) and probably all internet users in general. I >don't know... it might be old news but it wasn't to me. >You see, yesterday something very interesting happened with my system. >I was racing a couple of buddies via the net when I experienced >several major and then one total screen pause. Normally my races are >silky smooth so this was unusual. So I CTRL ALT DELed to bring up the >Task List. There were more programs in it than I expected to see; one >of which said "FTP," I thought this a bit strange but since I'd done a >PowWow File Transfer not twenty minutes earlier I just figured that it >had not shut down. >Upon closing the Task List a message was revealed on my Desktop. It >said "Are you ***ing with me?" Really was unusual that is. Since I'd >heard somewhere about the possibility of another viewing my Win95 >system I wondered whether I had a visitor. The selected default answer >to the query was Yes. I wondered whether selecting the wrong one would >result in something bad happening to my precious system. Like a global >formatting perhaps? I pondered which answer the hacker might really >want - recalling the poisoning scene in The Princess Bride and feeling >very much like the loser of that dilema. In the end I clicked Yes. >Nothing seemed to happen. A little relief there. >At about the same time - maybe after I clicked Yes - my IE4 browser >opened and timed out going to www.manhole.com . Hmmm. Yeah this is >looking bad I thought. Still, whoever was having fun at my expense was >not going to spoil the movie I'd started to watch (Grand Prix) so I >shut everything down and sat down to enjoy it. I even shut down ICQ to >see whether my intruder could return without it running. At this point >I was still holding out the hope that what seemed to be happening was >not really. Shit I didn't want to have to start backing up multi megs >of files. >Fast forward through some spectacular racing scenes and I'm sitting >still watching the movie when my CD tray opens and shuts two times. >You can bet that got my attention. So I look at the Desktop and can >just make out a new message. It says "ur ***ed," At which point my >system shuts down - freezing at the Win95 shutdown screen. Oh yeah, I >thought, someone has been calling on me. >I reset and held my breath. Thankfully it rebooted. Now I am really >getting concerned. I call my friend in Vancouver and he says he read >something about Back Orifice. It is a program that installs itself >(somehow) on your system so that others with not much of a life can >get their jollies annoying people like myself. Well it's long distance >and, besides, my friend is watching the movie too. So I sit down again >to do the same whilst comtemplating just how I am going to figure this >one out. >Another fif*** or thirty minutes passes and another message appears >on my Desktop. This one criticizes my choice of wallpaper... the fact >that I've cropped it and it isn't full screen like it should be. He >called me at lamer!? Amusing. Critics are everywhere. >The movie finishes and I decide to check my drives. Since I have five >one gig partitions I don't really expect to find anything but, low and >behold, right in the root of C (where I never save anything) are two >BMPs and three other new files. The two BMPs are before and after >screenshots of my desktop. How he took them without me noticing him >opening Paint Shop Pro is beyond me. The other three files are named >333; NULL and "um u know u really should be doing stuff on the net >istead of sitting idle" - or words to that effect. His spelling was >worse than I can remember. He's cool isn't he? >The movie finishes and it's time to call my Videotron Tech guy. I've >always gotten courteous, professional help from them but didn't really >expect much with this problem. Dave really sounded informed and had >read about Back Orifice too. He said that it doesn't infiltrate files >but is a program itself and could be anywhere on my system; under any >name. Since it is a new problem he couldn't really help much but he >did put me onto the site: [link lost in import] >a Search for "Back Orifice," produced the following: >[link lost in import] >Read that. It was bang on. In the Windows\System dir I did indeed find >a file exactly of 124,928 bytes. The really weird thing is that, while >Explorer's Size column showed the approximate size, the name was >invisible. The only reason I noticed it so quickly was because a blank >line appeared in the long list of filenames. But checking its >properties revealed that it did have a name. EXE~1. That was all. >Anyway I've deleted it and the Registry entry. Take THAT you scumbag. >Oh and to delete the EXE~1 I had to drop to DOS. I couldn't overcome >its protection in Win95. >Hopefully my visitor has been shut out. Still, he may have left a >calling card. I just ran AntiVirus Toolkit Pro in Deep Scan mode and >found three files infected with two variations of the Trojan virus. >The infected files are: > C:\Windows\patch.exe > C:\Windows\System\windll.dll > A zip called mp3compressor.zip > Anyone know if I just just delete the above .exe and .dll ? > AVP could not disinfect them. What can? Anyone? >The virus names are: > Trojan.Win32.Netbus.160 > Trojan.Win32.BO >Two corrupted files are also listed: > C:\Windows\Temporary Internet Files\...\ww980912.zip > E:\Download\TinyWeb.zip >Summary: >It seems the net has become even more dangerous. From what I think I >know, not only could this... uh... person (let's give him the benefit >of the doubt) have deleted files; but he could also have done >things... illegal things... on the net whilst passing himself off as >me. Hopefully he's just a kid getting his jollies. Nothing seems to be >missing. >Oh and I forgot to mention what I thought might have been his way into >my system... A cute little animated greeting card.exe (supposedly from >Hallmark) that a friend had passed along to me. Now I don't think it >was that because after taking the above measures I ran the card again >and the EXE~1 didn't re-install. Besides I got that weeks ago. Still, >I deleted it. >Well? What do you all make of it? Wish you hadn't read this? I >certainly intend to bone up on this subject and find out what measures >I can take to prevent it happening again. WinNT is supposed to be a >lot more secure then Win95/98. Would it protect against this? >You can bet every now and then I'll check for the reappearance of that >EXE~1 file. >To paraphrase Dorothy in The Wizard of Oz: >"I don't think we're in Kansas anymore Toto," >JB >Shaken a bit in Edmonton, AB,Just a thought -- you might want to pick up a copy of Uninstaller4. It does
not contain an anti-virus component, but will auto-detect setup/install
programs, and ask if you want to monitor it. This should alert you to any
unauthorized installs.
What's more, it keeps a database of ALL changes made to your system by setup
programs (directories, files, and registry entries), allowing you to totally
remove them, move them to different locations on your system, and run them from
compressed archives -- none of which Windows add/remove programs can do.
Bob
Thanks for the tip. I actually already have Norton Uninstaller Deluxe.
BO, as I understand it, doesn't actually have an install routine. I
think it just gets extracted to a dir and an entry is made in the
registry so that it will run on startup.
I have Toilet Paper installed; and Antigen. Hopefully, by at least one
of them, I'll be alerted if BO shows up on my system again.
JB
Edmonton, AB,
> I have Toilet Paper installed; and Antigen. Hopefully, by at least one
> of them, I'll be alerted if BO shows up on my system again.
I understand that installing the BO client on your machine will also
tell you whether you're "infected".
--
Neil Yeatman
Ajax, Ontario, CANADA
