I need desperate help... please?

I'm not really a newbie, in fact, i think i know quite a bit about computer security, but this one incident just isn't making sense...

Yesterday I was talking to a friend on aim to try to help him get rid of a trojan that was in his computer when all of a sudden a strange screename that I had never seen before started talking to me and saying some of the stuff I was sending to the other person.

I tried the most obvious things, used a spyware scanner, ran antivirus(both which i have multiple programs I use), went into the command prompt and typed "netstat -n" to look for suspicious ports. All of this stuff did nothing.

How is this person able to see what i am typing? Any help would be greatly appreciated.

OMG.... are you serious??

Let's look at the facts.

Your friend has a trojan. You are talking to your friend. Someone else knows what you are typing. Your computer checks out. Seems pretty obvious to me. It was someone using the trojan on your friends computer...

Did you have your friend run netstat on his computer?
What trojan was it?
Is it possible your friend was playing a joke on you? (him having another aim screenname)

It sounds like they were intercepting the data somewhere in the network which means they could be tapped in anywhere. Your friend didn't have any of this happen at their end did they? Or maybe the worm/virus/trojan on your friends computer was sending the data.

Well it isn't just with that one person, it happens to EVERYONE i ever talk to using aim. No matter which screename i instant message, he always knows exactly what im saying.

Go with HTRegz's idea. Its extremely unlikely that somewhere along the way someone is intercepting your traffic so don`t worry about that. Get your friend to run a virus scanner, do a netstat etc... and see what is happening on their computer (they should espcecially do this if the same things happens again - do it while its happening).

Although, reading your last post again, are you sure you don`t have the trojan? Do you have a personal firewall? try blocking all out bound traffic except your aim chat.

I'll have to default to those with more knowledge about those messaging systems, but in less than one month, I have taken my son's hd and cleansed it of all kinds of virii, trojans etc. , because he loves chatting with his pals on the instant msg programs. I have one of his drives just sitting on the shelf because I want to check out all the crud and see what it has done. We now have his AV always on and it intercepts them. (2 this week!) The next time it happens, I'll make note of the critters and pass it on. He visits anema (spelling?) sites as well, so that may be a source also.


You didn't say it, but is this your computer at home, or is it a computer at work? The reason I ask, as stated earlier, the odds of someone sniffing your packets is really slim unless they are on the same network as you. If it's a work, that opens other possibilities.

No matter how much people tell you that there is no way; there are ways to monitor AIM convos. The person may be using a trojan, or something similar, like remote anything. But there are otehr programs, I have seen them in action...gotta test the new merchandise and such. It depends on who's messing with you, but he could be a developer, or just some script-kiddie messing with some new-found prog. The programs are very under-developed at this time, but all you do is enter a screenname, and an IP if you have it, and it searches for the user online. After a few moments, assuming the person is online and logged on, it, one way or another, intercepts and filters packets. They are reassembled to a quite readable HTML file. Sometimes there are parts of the conversation missing, and sometimes, there is useless crap that was filtered incorrectly. I'm not sure where I found the one I tested some 6 months ago, but they are out there, just still "underwraps", or so to speak.

Could he try switching to something like Trillian? Trillian isn't AIM but sends AIM messages. Or would it share the same security holes? Just a shot in the dark...

It might be a spy software. Either someone has installed it on your buddy's PC or your PC, and they're getting all your convos. Not likely but it could be. Most likely it could be a trojan in both your computer and your friends computer. To clean that up use thecleaner, instead of just using your AV software. Using spybot s&D and adaware wouldn't hurt neither.

(*ponders*) AngelicKnight brought up an interesting points. There are many other AIM clients out there. I'm not quite sure if the security hole is Windows, AIM network, or AIM client. Might be interesting to try some of the others. If it is, indeed, the client, definitely go for an open source client, now. They have the lowest amount of security risks, because everyone sees them. Google AIM +client. A good one I know of is gAIM.

I think that Cybr1d may have a point with the spyware............not the marketing kind but the professional eavesdropping sort.

There was one being spammed a while back called "LoverSpy" which claimed to forward P2P conversations and e-mails. I believe that there are similar applications available on the market.

Unfortunately AdAware and SpyBot do not detect these, at least not when I ran a test on LoverSpy. I reported it to McAfee, who say that their product now does. If they still do an online scan you might both try that, or get a trial of the full product.

You also need a firewall that is blocking unauthorised outgoing connection attempts?

Cheers

Use Zone Alarm. If the scan and all that does not turn anything up. Reformat.

nihil the reason why spybot or adaware wont catch them is because they're often installed physicaly by a user, and generaly the user will have the setup file either on a CD or on the PC (If downloaded). Most of them also run in stealth mode, so chances of you seeing it as a running process is next to none. When using public computers, I have the tendency to hold CTRL, SHIFT, ALT down, while going through all the keys on the keyboard. A program that i've used, you needed to press CTRL ALT SHIFT M to bring up a menu, which was password protected. If you press all those keys, and you see a menu or a password promt come up, then you def have something installed in your PC. Even if you dont see anything, do not disregard the chance of something being installed in there. Try TheCleaner, and run it on your PC. If nothing else works, then reformat your HDD. Would it be possible for you to put a screenshot of your running processes?



ALSO: WHY ARE PEOPLE GETTING NEGGED? GO EVEN YOUR APs SOMEWHERE ELSE. I dont see anything wrong with axesterminated's post, so why the negs? If you have a grudge againts the person, THEN SAVE IT FOR SOME OTHER BLOODY TIME WHEN HE SCREWS UP! sheesh, people cannot even offer their help in this place without getting negged up the ass.

Run a sniffer on your machine while this is occuring and go through the collected data
carefully.

Don't just do a straight netstat, try something like this "netstat -nao 3 > temp.txt".
This will run netstat every 3 seconds and log it to the file temp.txt.

What type of network on you on ?

Do you use Wireless ?

Is it possible the 'intruder' has compromised the AIM main system ?

I have seen similar situations on chat rooms where 'intruders' monitor everyone's chat at the source.

Have you registered a complaint with AIM ?

Compromising the AIM system is a huge feat now. In the olden days, the servers were centralized. Now, however, there are fewer servers and they only create the initial directions of the packets. IMs are sent directly between machines now. (Don't believe me? Send IMs with the Timestamp on, and then correlate that the outgoing packets on your machine. The IPs will match up every time.)

If someone were to succeed in doing this, they would be able to shut down the system or completely screw up accounts, take over whatever they wanted. Someone who got into the system would probably have more interesting things to do than eavesdrop on one person's conversations.

It seems most likely to me that its a keylogger, since it sounded like only one side of the conversation was being reported. The keylogger could easily be running on your system. Try taking a look at your running processes, and then take a look at the start-up processes (msconfig, here we come.)

If that turns up nothing, then I'm not sure I know what's going on or what might work.

Hope that helps...

a_person-

Is your AV updated?

You might want to check these sites out-

Free trojan scan:
http://trojanscan.com/

AIM 5.2+ encryption certificate:
http://www.aimencrypt.com/

Hi,

Cyber1d is correct in that this stuff is stealthy, it is also technically "legitimate" depending on how it is used, so countermeasures providers have to be a bit careful?

Try: http://digilander.libero.it/zancart/winsonar/

That might help you catch anything that kicks off in the background.

Good luck

A long time ago, I once asked some one if they could get me a fire wall. There responce was,"what do you want one of those for". then they said do you use any of the chat clients or do you go to chat rooms. At that time i did frequent both chat rooms and IM. So i answered yes. The reply i got was ok have this. ( Norton Internet Security ).

My point is this. If you use IM, of any flavour there is a direct link from someone to your computer. You may think you are talking to lushes lips from heaven. When in reality you are talking to, hairy assed hacker from hell.

Cybr1d, I believe I know why negative points may be assigned unjustly here, which gives me a chance to bring up one point about this system I really don't agree with. If you assign "too many" positive AntiPoints (as I have), you get a warning saying that you need to assign more negative points in order to achieve balance. I'll bet you that's what's going on. Why is that? Most posts I read are positive, so it's really unfair to try to force me to pick ones to down on.

So this is a really interesting discussion going on here. So, you guys who are the Jedi of AntiOnline -- Is my Trillian idea valid? Would that remedy any possible security holes, or be pointless? I'm just really curious on that (and will be amazed if one of my ideas ACTUALLY works! Ha!).

You can also check out this tool from Merijn - http://www.spywareinfo.com/~merijn/f...tartuplist.zip

It's a lot more thorough than msconfig, and will display the quiet processes, as well as other useful information.

Whilst you are on the site that Norrisk suggests, pick up a copy of "HijackThis" another good free tool, and you can never have enough security tools?

Cheers

Phishphreak...................do you realise that just about every US combat plane since the Korean war has had a British HUD..............and who is building the "stick and throttle" assembly for the JSF? So hacking a webcam is well within our capabilities.

Jinxy.......that was a beta prototype I gave you.....you should not have tried it in combat!

:D :D

Angelic, just dont give APs to everyone for making a post :). Instead, if they respond to someone and they're productive, then they deserve APs. As for evening them out, you have to neg who deserves it and not someone else for no reason. Whats the big deal anyways :D, if you assign too many positive APs, then all that means is that next time you assign APs, it wont give the person as much as it would have if you had an even AP assignment. I dont think that really matters much. Hope this answers your question .

PS. Negging someone for a legit question or post makes us all look like a bunch of asses :).

Cheers,

a_person, is there any update on your status?