How is it possible...

I have a probelm, and i know all you intelligent people would love to help me out(please!). So heres my problem, theres this person who is somehow getting there hands on all my aim conversations. My first thought was that it was a trojan, so i used Norton ANtivirus(with all the updates) and all the other free virus scanners I could find on the internet and they found nothing. And my firewall (also norton) didn't see anything either. I thought this was pretty strange. So i did "netstat" and i didn't see any connections that seemed out of the ordinary. Later I talked to this person and they said that they are getting my aim conversations without connecting to my computer at all. I guess I want you to tell me how this is possible, and if this is possible, why bother having a firewall or antivirus?

which messenger u use...

Aol Instant Messenger, latest version

Two possibilities I can come up with...

1. You have a web cam pointing directly to your screen and they have access to the output.

2. AIM (I believe) has logging features, right? They may have your password and are looking at the logs that way.

AJ

Erm.....Keylogger maybe?

ctrl+alt+delete see if anything looks strange{process that should`t be running}.

Keyloggers have stealth downloads,run stealthy,and email the results of what you type.To whomever, when the text file reaches a certain size(512kb) it then emails the results.
To : [email protected] <---not real, apple peal.

Yes, AIM has logging features but not passive logging. In other words, you have to save the session in order to keep a log of the chat.

A more likely explanation is that this person has a keylogger running on your machine. After a user defined size, the keylogger will then send an e-mail to an address of the attacker's choice.

EDIT. Looks like I hit the "submit" button about 2 minutes too late! :p

heres yoru answers :):
1) I don't own a webcame, now will i ever own a webcam or have one in my house.
2) They are saying my conversations like as i am typing them(below is a true example, although some of the words may have been worded differently and i forgot his screename.


me: hey buddy, have that copy of warcraft 2 alpha for me
him: yeah, i'm sending it to you now... might take awhile... you have 56k right?
me: right
<i accepted the file transfer request here>
me: thanks
me: hey i want to try something on your alright?
him: i'm afraid lol... what?
me: this person says they can see what i type on my aim conversations, so i am going to say something that makes no sense.
him: alright
me : cheese grows on pineapples
------end this conversation------
------5 seconds later i get this------
spy: cheese grows on pineapples, what does that mean exactly?

Opening direct connections is a NO nO.....don`t accept files from whom you don`t know.
They do a netstat and grab your IP.

Do a Trojan scan for Bo2k(back orifice) or sub7. starting to sound that way.
Damn butt trumpet.

That may very well be, however it is unlikely because i just got a brand new computer and havn't installed any software from her or anyone she knows yet. Andis there a "keylogger scanner" or something along those lines i can use?

I know they can do netstat and grab your ip, but this had been going on for like 3 months, before i even met this person.

http://www.agnitum.com/

Thanks, i'll let you know if anything comes up.

You running Windows XP? I know this may sound crazy, but they myay have access to your system using the Remote Desktop Connection... That would allow them to watch (and interact with) everything you do. I know I played a few pranks in high school using similar remote access applications (for instance, I would be chatting with someone on AIM, and respond to questions before they hit enter to send the message, or I would respond to things that they typed but deleted). You should do some research (online for programs that have the capability and on your local machine to look for clients to such programs) to ensure that someone isn't accessing your system through such a program.

AJ

That could be it, can you point me to a place where i could find useful information on this?

But, i don't think that this is it, because they are somehow getting my conversations without being connected to my computer.

The person might be using AIMsniff, or another packet sniffer. They'd technically not be "on" your PC, if that's what the guy/girl is claiming. I'd post links, but I have to make this quick, when I get back home, I'll put up some links that might help.

but wouldn't you kinda need to connect to my computer to view the packets?

No. He/she would just have to be somewhere on your network. Sniffers intercept packets in transit, so the person would not have to be inside of your machine at all to get this kind of info. If you have no experience with them, at all, you may want to experiment with Ethereal, or Iris, to get an idea of how they work. Iris is probably the most user-friendly, but after the trial period, it's $1000. Sorry about the lack of links, I'll post active links if i get time. (playing in a 9-ball tourney at a bar nearby :))

Corn

a_person.........Hi,

There has been some very positive response to your question, and I must admit that AIM is not my strongpoint............I do not like AOL period. I suggest that you might try a simple elimination process? You may well have tried a lot of these, so please forgive me, I just want to confirm that you have :)

1. Download and update AdAware6.0 from lavasoft.........run it
2. Download and run SpyBot Search & Destroy, update and run it
3. Update (again!) your AV and run it with everything "on" like heuristics, scan compressed files etc.................you have time for a beer whilst this is happening ;)

This is to establish that you do not have any "standard" scumware on your machine.............boring, but you have to do it!

Try going to http://www.bitdefender.com where they have a number of specialist (free) tools that protect instant messaging systems. Not sure if any will work for you........sorry, I do not use IM much.

AOL/TIME/WARNER...................a true "marriage made in hell"..........If you are paying them, make them sort it............report the problem, and see what happens..................I said that I do not like AOL....maybe the leopard has changed his spots?............I doubt it....

Now for the "dirty stuff"......I work in the defence industry, where security is of some interest.

Is your machine physically secure? or do you share it/others could have physical access?

Are you running on a wireless network?

Try a google for "TEMPEST" and "nonstop"...................I can say no more

You might also try creating a new user/whatever in AOL......WITH A DIFFERENT PASSWORD!!!! and see if you get the problem.

That will do for a start.........................let me know what happens please..............I am really £$%%^^&& off by people who do this sort of thing...I trusted someone with my box, and just minimised AO, and he went in and flamed/negged people using my ID............not a nice feeling, so you have my complete sympathy!

Good Luck

i did all that but spybot...so i guess i'll give it a try

I have about 50 processes running. I cannot tell which should or shouldn't be running. any suggestions?

So its not possible to see what you are doing on your computer unless there is some software installed on that computer?

Quote:

---

Originally posted here by rednekluvmonkey
I have about 50 processes running. I cannot tell which should or shouldn't be running. any suggestions?

---

Go to Black Viper's service config page and red through it. Very useful for any windows user.

Corn

Quote:

---

I have about 50 processes running. I cannot tell which should or shouldn't be running. any suggestions?

---

Also, if you have xxxx.exe process running then do a google on xxxx.exe and you'll find a more detailed explanation somewhere on the net.
One note is that you'll find maybe 3 or 4 instances of svchost.exe, not really 100% sure why, but most of them are needed for an associated app/prog/process.
Also, its not uncommon to have 20 or so processes during normal running.

And I also thought that if a_person was on dial-up that his IP address would always be different on connecting, thus more difficult to get hacked etc, so there must be a trojan if the he/she haXor can connect to a_persons box.

And I would also try another AV, nod32 comes to mind.

But the answer to my original question... is it possible to find out what people are doing on there computers without having some sort of trojan or sniffer or something like that installed installed on it. It doens't seem possilbe to me.

Going a bit to the extreme, someone can find the current tcp/ip session that you have with the AOL server, actively hijack it, emulate you still sending/receiving messages, and go from there.

There are always extraneous cases, just becuase you have no 'software' installed on your computer from somone else doesn't make you secure. As previosuly mentioned a legitimate application such as remote desktop could be used against you.

As a short answer, yes, it is very possible for someone to do anything to your computer without first putting software on it.