Hello...Cracking my accounts

Hello everyone..
First I want to thank everyone involved with this site. It's fantastic. I can't believe how much I'm learning here. I'm completely clueless (non-computer professional) and have been camped out here since I found this site three days ago. Absolutely had no idea there was a community like this.
Secondly, as a completely raw newbie I'd like to apologize in advance for any mistakes, ignorance, or other missteps I will unwittingly make. I've got a lot of learning to do and I'm trying to catch up as fast as I can.
Here's the thing...I've been cracked (5-6 days ago) and I'm pretty sure the guy is still after me. I logged into my Hotmail account and my Inbox contents disappeared before my eyes. Then, as I was reviewing a message, the cracker was entering some unsavory, and threatening text into the message. I immediately shut down my system. The guy calls himself MedanHacker.
I implemented some solutions based on suggestions I found on this site while looking around. ZoneAlarm Pro installed (and working, I might add), plus I did a sweep and clean with PestPatrol.
Is there anything else I should do ? Should I try to find out how to trace this guy and then forward that onto authorities or should I just leave him alone and hope he just moves onto somebody easier ?

Thanks again !! :o

If you've been cracked to the point where someone is actively typing text into messages while you are creating them, it's time to reformat, reinstall from scratch, patch everything to the latest patches, and otherwise harden your security. You did much of step 4 (zone alarm and pest patrol) but frankly I wouldn't trust a system that's been cracked as badly as you indicate. I'd do a total rebuild.

Oh, and AFTER you've done that, change every single password on every single online site you use to something very hard to crack (i.e. a password with numbers and symbols in it).

- Qualm

I agree with Qualm, time to reformat. You may want to run a virus scan first though, mabey its a simple trojan... That would save you some work.

Qualm: WTF?!! it's only a trojan...prolly Sub7 or something..it's not some elite hacker...you can't do that **** without a trojan!! wot you need is a good AV...but if you'r only looking to get rid of the trojan the you need The cleaner from www.moosoft.com (I may be wrong, so be prepared to google a bit).

if you want a powerfull password...the best way to go is:

Take a moto or line...like: Don't use cannons to kill mosquitos

then Make it one word: Don'tusecannonstokillmosquitos

Then replace what ever you feel with a number: Don'tusecannon2killmosquitos
you could also do it like "D0n'yusecann0n2ki11mosquit0" but I find that too confusing

The put a capital on the start of every "word": Don'tUseCannon2KillMosquito

and Hey presto, you have a password that is virtualy impossible to crack, easy to remember and well.....acctualy simple, but yet so hard :)

and no...don't bother...that ain't my password :P

- Noia

Yeah, it's probably just some trojan. Run The Cleaner as Noia said even though i believe it hasn't been updated in a long time, or other stuff such as AVG http://www.grisoft.com or NAV http://www.symantec.com if you're looking to spend money and protect against viruses too.

you can get free online scanners..they do a pretty good job of it....I'm going to bed no...goggle if u must...but I'll be a euro it's a trojan...and it's been set to log all your passwords...
as long as you have a firewall, the trojan is useless any how...coz it can't get on the net, and no one can connect to it...but it's good practice to remove such nasty things.

- Noia

Quote:

---

Originally posted here by ts.flatline
Yeah, it's probably just some trojan.

---

Unless you've got some program like PC anywhere installed then yes a trojan is definetly to blame... It doesn't take much programing skill to do things with the keyboard either...

Also if all your mail just appeared to instantly deleted itself then that means this guy probably has screen dump & mouse control... either that or he used a keyloger, loged into hotmail, then deleted and as you refreshed the page you noticed they were gone.

MedanHacker, What kind of name is that? Most self respecting kiddies would come up with a cooler handle and would rather use their time on opening FTP or collecting dDoS zombies rather than crapy pranks. I've found most pranks and things that involve hotmail to come from peaple who might know you (IE) someone who you chat/download with but its still a good idea to tell the peaple in your guestbook whats going on and you might want to tell them to aviod attachments in letters sent by you so this guy can't spread his trojans to other peaple useing your account.

Non-moron trojan users keylog you, rather than just wait for you to be online so they can mess with your head. Messing with your head is actually the last thing any non-moron trojan user does to your system. After they've keylogged as many password inputs as they think they will get, and snooped and downloaded anything that looks interesting.

Smart trojan users will install redundant trojans, keyloggers, etc. Then they'll keylog your passwords and steal your files, and then they'll mess with your head.

Now, are you all seriously willing to assume CarefulEugene is being messed with by a moron trojan user? I'm not.

It really depends on your comfort level. I'm not at all comfortable with NOT rebuilding a hacked system, and I have a pretty good grasp of what's available to detect and remove and protect and harden your system short of that step.

- Qualm

Run a netstat and try to get his IP....

Jeez,
I wish I'd have known about you guys before all this. I really appreciate all the great advice ! I'll try your suggestions and let you know what I find (if in fact I can figure it out). Oddly enough, my firewall alarm has been going off like crazy the last three hours or so. I've been selecting the "whois" option but ain't smart enough yet to really understand everything it's telling me. I write down the IPA's just for reference.
Just for clarification on the e-mail thing...
This guy only seems to be able to access my working messages when I use Hotmail. If I use my regular e-mail account he appears to be blocked out (or maybe he just hasn't found that yet).
Also, I've never been in chat forums, and I don't do any file sharing whatsoever. I probably have opened some suspect e-mails which may have provided an entry point. Actually, I'm usually spending most of my box time just cruising various sites. I have used EBay & Paypal, which from what I hear from some of you, sound like a magnet for undesirables just dying for fresh fish like me.

Quote:

---

Originally posted here by Qualm
Smart trojan users will install redundant trojans, keyloggers, etc. Then they'll keylog your passwords and steal your files, and then they'll mess with your head.

---

A smart trojan user would never let you know they were there so that they could continue to gain information, if there is such a thing. And even if they have many tojans installed most of them can still be removed, many AV programs have heuristics that will even find small programs that were written by the cracker themselves and not just downloaded of some geocities webpage. As for keyloggers it can be a little harder if they don't send information out, I could be wrong but I don't think that simple checking of what is typed is something that sets off alarms in most AV heuristics as many word processors do this for spell checking albeit in a slightly different way. You already installed a firewall so if you see odd connection attempts from programs that don't make sense then look into it as it could be a keylogger trying to email it's daily capture if it's set up to do that, other then that look for folders with growing text files then start looking through running processes for something out of the ordinary. I know what every process on my machine is so when something shows up I know someone's been messing with my computer.

Quote:

---

Originally posted here by CarefulEugene
I have used EBay & Paypal

---

I would suggest logging in to your eBay and Paypal accounts from a computer you are reasonably sure is clean, and changing your passwords ASAP. You can set eBay to not automatically log you on when you connect, which is what you should set until you are sure there are no keyloggers left running on your machine.

There are four principal areas where, on an average system (meaning not one that has anything special like an Intrusion Detection System loaded on it), you will find traces of trojans and other active security breaches:

1. Your firewall logs - as you've already mentioned, your firewall will log a lot of nasty activity such as programs and people trying to connect to ports which are blocked.

2. Open ports and the programs connected to them - a good port scanner/port monitor like Active Ports will tell you what ports are open, what IP's are connected to them, and what programs are listening on them. Do google searches on specific open port numbers and listed programs, you will learn a lot that way.

3. Suspicious registry entries - specifically, programs set to automatically run at startup which you don't recognize or are otherwise suspicious. Again, google searches will tell you a lot about what's legitimate and what isn't normal.

4. Running processes (task manager, process window). This is where you'll find the harder to detect (and nastier) stuff. For example (just an example, this is rare and advanced hacking), if you see a .txt file listed as a running process, that's a major alarm bell because you've likely been hacked by someone who is sophisticated enough to exploit a specific "feature" of certain Microsoft OS's. Google anything odd you see (most of the processes there are cryptically named but perfectly normal).

What I'm trying to say is, don't rely on AV and anti-trojan scanners exclusively, particularly NOT on an already-cracked system. Really vicious trojan users will crack a system, install a backdoor or three with detectable signatures, and then customize and recompile from downloadable sourcecode an undetectable (by commercial scanners that is) backdoor. You can still find that one though if you know where to look for traces (see above) and do your homework.

- Qualm

I don't want to underestimate the guy, but this may give a clue as to how smart he is (or how confident he can bust me---take your pick) He had actually sent me an e-mail telling me he was going to be cracking my accounts. Pretty poor English was used (Please to cry-I am to be cracking all your accounts, etc..)
After doing the scan on my system this thing came up as an exploit: PRegScheduler. I dumped it since I didn't know what the hell it was.
One last thing...This is the IPA that just keeps on coming up on my firewall alert..63.141.176.130.
What do you guys recommend I do with it ?

I got this off that IP but I think I might have done the wrong search but you never know... this might actually be the right admins, address, and (ect) :confused:

63.140.0.0 - 63.143.255.255
WINSTAR
1577 SPRINGHILL ROAD
VIENNA, VA, 22182
US

--------------------------------------------------------------------------------

Winstar
[email protected]
+1-888-466-3662

--------------------------------------------------------------------------------


63.141.176.128 - 63.141.176.159
BOSS INTERNATIONAL
1701 E WOODFIELD
ROSEMONT, IL, 60173
US

--------------------------------------------------------------------------------

ROSENGARD, ROBIN
[email protected]
+1-847-413-1000
--------------------------------------------------------------------------------

And thanks to |The|Specialist I was able to DL his port scanner and I picked up these ports: 21, 25, 110, 135, 139, 389, 515, 1002, 1028, 1031, 1720 & probably others.

Qualm's got the 4 major points there for getting rid of a serious cracker. I mean we are talking about a home computer and the fact that he's sending emails to CarefulEugene shows that he's probably doing this more for shits and giggles than for any personal gain because if he continues now that he's known about he has a 500% better chance of getting in serious trouble if he decides to take over any serious accounts like paypal, so long as CarefulEugene logs his ip and reports it. Authorities may not think much of people stealing home users email accounts but when they start taking money they'll listen a little better, though how much depends on the authority.

As for the ip, where are you from? Does this ip show up when the attacker does things to your computer? Because if you're on dial-up it could just be one of your ISP's computers checking to see if you're still online. Granted it could also be the attacker, I'm just saying to check all ip's running through that firewall and check their domain against your own to help narrow it down. A good way to check would be to close all programs like msn messenger/icq or anything that sends data out to the internet and then see what ip's are still trying to connect to your pc, if one shows up out of nowhere and attempts to connect to a high port (1000's and up) then it's a good bet that that's the ip you're after.

One last thing as was already mentioned, any online passwords, go to a different computer and change your passwords asap. If the cracker doesn't get to them before you change the passwords then it will save you a lot of trouble. But don't do it from your computer as any keyoggers/trojans still there may catch the passwords anyways. Not to mention if you change the passwords then he'll be back to try and find them again and you'll have a better chance at getting his ip and reporting him to his ISP.

I also just checked out the web addresses that Amanda gave, winstar does not have a website on winstar.net, but bossintl.com does and it seems to be a forum for engineers. Meaning someone's using one of their servers to bounce off of, one of their admins/employees is decidely being a moron, or someone's little kid is having some fun off daddy's computer which happens to be part of that network. I'd recommend sending an email to their tech support address [email protected] and tell them what has happened and that you keep seeing that ip popping up on your firewall. Chances are they'll check the server if that's what it is and the cracker will lose his ability to bounce off it or they'll get fired if it's someone who works there actually doing it.

PRegScheduler is unlikely to be the entry point, although it can certainly be safely removed. See this discussion: http://www.annoyances.org/exec/forum/win98/n1009837867. It's possible the "legitimate" registration reminder program was replaced by a trojan, but given the level of intelligence this guy is exhibiting, that's unlikely.

As Pecosian recommended, send an e-mail to [email protected] with the details of what has been happening (i.e. that IP is showing up in your firewall log and you suspect it's a compromised machine being used to attack you).

I'd also send an e-mail to [email protected] - Winstar is Boss International's domain registrar and/or ISP, and that *should* be a working e-mail address if they follow accepted norms.

- Qualm

i agree that u should install everything over, i have personally used the cleaner, its verygood but a trial, it should work though, but to prevent this, try to scan anything before u download it. dont use a p2p or anything else like it.

oh for the love of mike!
Get an AV like McAfee, keep it up to date every day
Get a firewall, may I recomend Outpost (www.agnitum.com It's free and very very good)

Then you can use The Cleaner to get rid of that pesky trojan, even though, with a fire wall in place, it's harmless (More or less).

Then, do as I said above, and change your passwords to something hard...NOT 123password or some crap like that...

Now..if I see one more post about formating coz of a bloody trojan I'll beat you all with a stick! :P

- Noia

So who's this mike fella and why's he so great? And why did everyone give up on pete??

I'd agree with Noia about not formatting, I fight with local pc shops when they tell me to format a friends pc coz of something simple like that, then i just go and remove it and they're amazed half the time. I think there should be some kind of course you have to take or some test to prove you're not just some guy who knows how to install windows so you think you can solve any problem with it. I could install windows 3 days after I got it for the first time, and I was 13 at the time.. ah well, I suppose it's why people come to me before they let some of the local stores touch their pc's :D

what you said that your hotmail account was cracked so he could have used that recent flaw in hotmail so he might not even have a trojan but you should still scan you hardrive nonetheless

1. What OS are you running, and did you install it by using the default method.
2. Did you use a logon password before getting hacked.
The reason i asked is it could be as simple as a remote desktop, or file share intrution. Im not saying everyone else is wrong, or that you should not format and reinstall. But consider this, if you do reinstall and fail to secure your system you may end up wit the same problem. :confused:

I take it Ill get a "you will be banned warning" for pointing this out, too.

if he tries to log onto you again you should go to the command prompt and type netstat -n, look at the last ip and that should be his, and by the way if you find out it is netbus(an older trojan) it would be fun if you installed netbuster so you screw with him(even though netbuster is in the windows trojan section of this site it is NOT a trojan and netbuster actually unistalls netbus from the memory)

You may want to contact your isp, they have logs of traffic travelling on their network. They should be able to determine any connections to or from your machine and on what ports. This can be very powerful evidence should this incident ever go to a court room. This measure should only be taken if you continue to be harassed even after following the posted suggestions.


--PuRe

Quote:

---

Originally posted here by CarefulEugene
Hello everyone..
First I want to thank everyone involved with this site. It's fantastic. I can't believe how much I'm learning here. I'm completely clueless (non-computer professional) and have been camped out here since I found this site three days ago. Absolutely had no idea there was a community like this.
Secondly, as a completely raw newbie I'd like to apologize in advance for any mistakes, ignorance, or other missteps I will unwittingly make. I've got a lot of learning to do and I'm trying to catch up as fast as I can.
Here's the thing...I've been cracked (5-6 days ago) and I'm pretty sure the guy is still after me. I logged into my Hotmail account and my Inbox contents disappeared before my eyes. Then, as I was reviewing a message, the cracker was entering some unsavory, and threatening text into the message. I immediately shut down my system. The guy calls himself MedanHacker.
I implemented some solutions based on suggestions I found on this site while looking around. ZoneAlarm Pro installed (and working, I might add), plus I did a sweep and clean with PestPatrol.
Is there anything else I should do ? Should I try to find out how to trace this guy and then forward that onto authorities or should I just leave him alone and hope he just moves onto somebody easier ?

Thanks again !! :o

---

Hey you just talk about MedanHacking,rite? that group located in Indonesia which I heard pretty tough hacker group also the fuc* many website in Australia for any reasons *REVENGE* I red that on the internet said afetr they fuc* a website they sill say *WAR HACKER,REVENGE FROM MEDANHACKING* or someting like dat.

I'm a newbie in computing and will anyone will teach me about creating firewall,plz? I really want to noe about *Defence my self before attack someone else ^-^ .If u can reply me in private message.thanx b4

d4rK_1c3

a netstat? how does it work and how I gonna use it if someone put trojan in my kompie? does any way(s) to trace ppl ?

LOL , MedanHacker. That's A good one.You Are probably infercted with some sort of lame trojan.Run netstat -a , and if port 27374 or 31337 is listening , then you might be in trouble. But reset all e-mail passwords and download a free trial of trojan remover from www.simplysup.com.Good Luck.