computer attacked :(

[cmotherofpirl]

my desktop was eaten by spy sheriff

[Aloysius]

I think people are afraid to post on this thread cause they think it's contagious...

lol

[cmotherofpirl]

lol
is there a way to trace an address that keeps attacking you?

[Dudette]

hmm...I think you can block IP addresses, though I'm not sure how.

[MC Just]

[quote name='cmotherofpirl' date='Aug 24 2005, 10:51 PM']my desktop was eaten by spy sheriff    
[right][snapback]697938[/snapback][/right]
[/quote]


that happened to my wifes pc, we had a lot of trouble fixing it..

[Theologian in Training]

[quote name='cmotherofpirl' date='Aug 25 2005, 03:01 PM']lol
is there a way to trace an address that keeps attacking you?
[right][snapback]698501[/snapback][/right]
[/quote]

Are you sure it is one specific IP that it is originating from? Also, if you think you may have spyware, a virus, etc. I highly recommend downloading fport from Foundstone. [url="http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/fport.htm"]http://www.foundstone.com/index.htm?subnav...ddesc/fport.htm[/url] It will not only tell you which ports are open but which services have opened those ports. It is a helpful utility, especially to indicate which ports you should close with your firewall. However, if it turn out to be a trojan, then you have a whole other problem on your hands, because trojans are backdoors, and they can get beyond the firewall...usually.

Need any help, drop me a PM.

God Bless

[cmotherofpirl]

[quote name='MC Just' date='Aug 25 2005, 02:34 PM']that happened to my wifes pc, we had a lot of trouble fixing it..
[right][snapback]698537[/snapback][/right]
[/quote]
We couldn't seem to delete it, so my neighbor changed its name from an exe file to an xyz file so the computer couldn't run it, then he changed its name again and deleted it. This process to find all the little pieces took hours to accomplish. We also removed all the prefetch files of the day.
Whew! nastiest attack we ever had.

Theo it always seems to be the same addy.

[scardella]

1. Keep virus scanner up to date; run full scan weekly or so. Use its on-access scan.
2. Download Ad-Aware, Spybot, or both. Keep those up to date and scan weekly or so.
3. If you're using XP, install Service Pack 2 (if not installed already), and turn on its firewall
3.5. If you're using Mac OS X, get Virex or ClamXav and use it. Turn on the firewall too.
4. If you're not using XP or Mac OS X, purchase a firewall and use it.
5. Windows 2000, XP: Boot into safe mode (F8 at beginning). Log in.
Go to c:\documents and settings\<username>\Local settings.
clear out .\temp and .\Temporary Internet Files\
6. If you're using 98 or earlier, you should really upgrade. Those are horrible security-wise.
7. Keep your Operating System up to date.
8. If the above fails, bring it to a professional.

That should help.

PS.
I'd recommend using Firefox or non-IE browser.
If you must use IE, set up the following in Internet preferences:

General Tab:
Cache < 50 MB; clear cache; clear cookies
history 0 days; clear history

Content Tab:
turn off autocomplete

Advanced Tab:
check empty temporary internet files on close
check do not save secure sites to disk.

Edited August 25, 2005 by scardella

[cmotherofpirl]

I run Cookiewall and Bugnosis continuously, Adaware and Spybot weekly, and had PC Trend Micro running when this infiltrated my system.
My computer does not like Service Pack 2, and refused to let me install it.

[Theologian in Training]

[quote name='scardella' date='Aug 25 2005, 03:46 PM']1. Keep virus scanner up to date; run full scan weekly or so.  Use its on-access scan.
2. Download Ad-Aware, Spybot, or both.  Keep those up to date and scan weekly or so.
3. If you're using XP, install Service Pack 2 (if not installed already), and turn on its firewall
3.5. If you're using Mac OS X, get Virex or ClamXav and use it. Turn on the firewall too.
4. If you're not using XP or Mac OS X, purchase a firewall and use it.
5. Windows 2000, XP: Boot into safe mode (F8 at beginning). Log in. 
  Go to c:\documents and settings\<username>\Local settings.
  clear out .\temp and .\Temporary Internet Files\
6. If you're using 98 or earlier, you should really upgrade.  Those are horrible security-wise.
7. Keep your Operating System up to date.
8. If the above fails, bring it to a professional.

That should help.
[right][snapback]698550[/snapback][/right]
[/quote]

I had no idea that both firewalls and avp existed for Mac.

Good to know

[scardella]

[quote name='Theologian in Training' date='Aug 25 2005, 01:51 PM']I had no idea that both firewalls and avp existed for Mac.

Good to know
[right][snapback]698560[/snapback][/right]
[/quote]

Firewall is in System Preferences -> Sharing -> Firewall. It uses ipchains (a unix port) w/ an apple front-end, I believe.
You can download more advanced stuff for configuring it or configure it by hand in the old-school way.
You can also purchase other firewalls for Mac, but I'm not familiar w/ anything off hand.

Antivirus:
Virex is made by McAfee. 7.7 is due in Sep. that supports Tiger.
ClamXav is freeware. Supports Tiger already. It's based on clamav, which is popular in linux/unix servers.
I think Norton makes Antivirus for it too, but I'm not sure.

Edited August 25, 2005 by scardella

[Theologian in Training]

Is the address attacking you or is it leftover from the virus, and trying to update itself?

[Theologian in Training]

[quote name='scardella' date='Aug 25 2005, 03:58 PM']Firewall is in System Preferences -> Sharing -> Firewall.  It uses ipchains (a unix port) w/ an apple front-end, I believe.
You can download more advanced stuff for configuring it or configure it by hand in the old-school way.
You can also purchase other firewalls for Mac, but I'm not familiar w/ anything off hand.

Antivirus:
Virex is made by McAfee.  7.7 is due in Sep. that supports Tiger.
ClamXav is freeware. Supports Tiger already.  It's based on clamav, which is popular in linux/unix servers.
I think Norton makes Antivirus for it too, but I'm not sure.
[right][snapback]698572[/snapback][/right]
[/quote]

Yeah, my firewall is on, it was the AV I had no idea about.

Thanks

[scardella]

[quote name='cmotherofpirl' date='Aug 25 2005, 01:50 PM']My computer does not like Service Pack 2, and refused to let me install it.
[right][snapback]698558[/snapback][/right]
[/quote]

There are a few programs that don't like it. More often, though, it's a virus/malware that blocks it.

[the_rev]

before I go to work each day I turn on the virus and adware scanners and scan while I'm gone to work

haven't had many problems that way!

[MC Just]

[quote name='cmotherofpirl' date='Aug 25 2005, 01:50 PM']I run Cookiewall and Bugnosis continuously, Adaware and  Spybot weekly, and had PC Trend Micro running when this infiltrated my system.
My computer does not like Service Pack 2, and refused to let me install it.
[right][snapback]698558[/snapback][/right]
[/quote]


hmmm, my wifes computer doesnt seem to like SP2 either. it wont let her install it..

[cmotherofpirl]

[quote name='Theologian in Training' date='Aug 25 2005, 03:02 PM']Is the address attacking you or is it leftover from the virus, and trying to update itself?
[right][snapback]698579[/snapback][/right]
[/quote]

I haven't a clue, and don't know how to tell.

[Era Might]

[quote]my desktop was eaten by spy sheriff [/quote]

I just spent all day cleaning an entire company's computers from a worm.

I don't care.

:

Seriously, though, I know how you feel. Make sure you sweep the registry. I had a virus once that required a change to the registry, but it was clever. It knew how to reset my changes after I did them. I'm really not sure what I did, but I booted up from a ERD and copied an old version of the registry, closed my eyes, and it worked.

Edited August 26, 2005 by Era Might

[cmotherofpirl]

[quote name='Era Might' date='Aug 25 2005, 08:43 PM']I just spent all day cleaning an entire company's computers from a worm.

I don't care.

  :

Seriously, though, I know how you feel. Make sure you sweep the registry. I had a virus once that required a change to the registry, but it was clever. It knew how to reset my changes after I did them. I'm really not sure what I did, but I booted up from a ERD and copied an old version of the registry, closed my eyes, and it worked.
[right][snapback]699197[/snapback][/right]
[/quote]

My neighbor sat here for hours cleaning the registry.
I hope there is a very low spot in hell for the inventors of such things.

[scardella]

[quote name='Era Might' date='Aug 25 2005, 07:43 PM']I just spent all day cleaning an entire company's computers from a worm.

I don't care.

  :

Seriously, though, I know how you feel. Make sure you sweep the registry. I had a virus once that required a change to the registry, but it was clever. It knew how to reset my changes after I did them. I'm really not sure what I did, but I booted up from a ERD and copied an old version of the registry, closed my eyes, and it worked.
[right][snapback]699197[/snapback][/right]
[/quote]

ERD Commander? It's a handy little tool!

Here, I call it the TERD Commander, since it's Tulane's copy.