Beware of hacker bothering CD users

[Ken Leung]

Had an interesting experience tonight. Someone with screen name "LiLWsTsiDeOuTLaW" IMed me out of no where in the middle of the night, saying How r u I need hlp with outlook u from that robot thing right from that forum right ken?

As I try to figure out what he (I assume he's a he) needed help with, he kept changing the topic, something about an error with command prompt, and then something about a problem on his computer. He kept pretending he doesn't know anything about computers. Then he started trying to send me files over AIM, he claimed they are screen shots of errors on his desktop. I immediately got suspicious and rejected the files. He kept trying to send files to me and gave up after a few times, and I stopped talking to him.

Then I checked his AIM profile and it say the following things:

Downloading Virus...

58%

Date: 4/12/2006
Time: 1:17:22 AM
Name: *edited*
Ip: *edited*
Status: Deleting C Drive...


Buying a computer: $1,500
Getting The Internet: $50
Seeing your face after noticing
I was hacking into your computer: Priceless

Pinging... Success
Hacking In... Success
Deleting C Drive...


All I can say is... Becareful about random people IMing you trying to send you files... I am only bringing this up because he got my AIM screen name on Chief Delphi, and if he can get mine he can get anyone else's. He may or may not be related to the recent attacks on this forum.

Just thought I should bring it up...

[Koko Ed]

Originally Posted by Ken Leung

Had an interesting experience tonight. Someone with screen name "LiLWsTsiDeOuTLaW" IMed me out of no where in the middle of the night, saying How r u I need hlp with outlook u from that robot thing right from that forum right ken?

As I try to figure out what he (I assume he's a he) needed help with, he kept changing the topic, something about an error with command prompt, and then something about a problem on his computer. He kept pretending he doesn't know anything about computers. Then he started trying to send me files over AIM. I immediately got suspicious got rejected the files. He kept trying to send files to me and gave up after a few times, and I stopped talking to him.

Then I checked his AIM profile and it say the following things:

Downloading Virus...

58%

Date: 4/12/2006
Time: 1:17:22 AM
Name: *edited*
Ip: *edited*
Status: Deleting C Drive...


Buying a computer: $1,500
Getting The Internet: $50
Seeing your face after noticing
I was hacking into your computer: Priceless

Pinging... Success
Hacking In... Success
Deleting C Drive...


All I can say is... Becareful about random people IMing you trying to send you files... I am only bringing this up because he got my AIM screen name on Chief Delphi, and if he can get mine he can get anyone else's. He may or may not be related to the recent attacks on this forum.

Just thought I should bring it up...

I wonder if it was those clowns who invaded last weekend? They talked openly about causing mayhem here and some of them seemed to know their way around a computer.

[Jay H 237]

Originally Posted by Koko Ed

I wonder if it was those clowns who invaded last weekend? They talked openly about causing mayhem here and some of them seemed to know their way around a computer.

Last weekend was the first time I've seen this place come under an attack like that. Although Ken's incident could be unrelated, with the number of attacks last weekend I wouldn't be surprised if they were to try something else.

Ken, could we make this a sticky for a few weeks so others on here have a good chance of seeing this. I'd hate to hear about one of our members on here getting attacked.

[Jack Jones]

We don't need to fret the profile stuff. It's just a twit acting his age, or shoe size, whichever is lowest.

As long as the file transfers are rejected, he's impotent, which is most likely the case rejected or not. I bet he gets rejected a lot - it would explain all that time on his hands.

[Adam Shapiro]

Originally Posted by Jack Jones

We don't need to fret the profile stuff. It's just a twit acting his age, or shoe size, whichever is lowest.

As long as the file transfers are rejected, he's impotent, which is most likely the case rejected or not. I bet he gets rejected a lot - it would explain all that time on his hands.

Precisely. While it is possible that someone may be able to gain access to your computer, the chances of it are extremely slim, even if they are speaking directly to you through IM. Most likely you have a firewall (or two) protecting your computer without requiring any input or setup from you. Without you running a "backdoor" program, like the ones he tried to send you, he'd have very little chance of getting in, especially in the short timeframe you noted. It sounds more like some jerk trying to look "cool" and cause a disturbance in our community.

[Matt Krass]

Just as a precaution everyone might want to run a good antiviral and firewall program, as well as a malware scanner. I recommend the following:

Ad-Aware Personal - Malware Scanner - www.lavasoft.com
Spybot S&D - Malware Scanner - www.safer-networking.org
AVG Anti-Virus -Anti-viral - http://free.grisoft.com
ZoneAlarm Basic - Simple Firewall Package - http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=dbtop nav_zass


That's a nice little software package right there that pretty much stops 99.95% of all trouble, and makes handling the rest pretty easy. It's all freely available software (at least it was last I checked ) Also keep your operating system patched and updated with all the latest fixes and such. If anyone suspects they're compromised send me a PM with your reasoning (why you think you're compromised) and I'll see what I have on hand to help you.

Also, a tip from Joseph Matt:

Originally Posted by Joe Matt

(12:42:53 PM) Joe Matt: you forgot to mention "JUST GET A MAC"
(12:42:58 PM) Joe Matt: but i forgive you for that slight oversight

[sanddrag]

I'm no computer genious like Matt but I would not recommend Zone Alarm. Causes more trouble than it's worth if you ask me. I've also heard stories of it destroying the Windows XP TCP/IP stack if it is uninstalled improperly.

[Matt Krass]

Originally Posted by sanddrag

I'm no computer genious like Matt but I would not recommend Zone Alarm. Causes more trouble than it's worth if you ask me. I've also heard stories of it destroying the Windows XP TCP/IP stack if it is uninstalled improperly.

I've never had a problem like that, but I haven't uninstalled it in a while. My friends also use it without trouble. I'll look in to this and update my post if I find a better solution.

Also, I should note that the builtin Windows Firewall has a not so hot track record, I wouldn't recommend using it alone, or at all. Plus if you have a router, your behind a hardware firewall as well, but (at least in the case of Linksys) it's a friendly helpful one and may unblock ports if it thinks you wanted it to So I would still have a software firewall.

[Jeff Rodriguez]

A combination of a router, windows firewall and free zonealarm will work fine. I use them on both my PCs an haven't had any trouble.

The free Zonealarm does not have uninstall issues like the full version. I uninstalled both.

[Ken Leung]

I use a combination of spyware doctor, spybot search & destroy, and Norton Antivirus, so I wasn't worried... On the other hand, it's just a good idea not to accept any files from a stranger. Who knows what they have on that file? (What are the chances that he is sending something especially "choice", knowing that it will do more damage than more benign virus/spyware.)

Anyway, I just thought I would like to give you guys a heads up. Especially since the attack on CD forum shortly ago. I would hate it if someone actually downloaded something from random people claiming to be from this forum, got their computer damaged, and never come back because of that.

[KenWittlief]

There is a way hackers can cause you grief without gaining control of your computer.

Dont use the same password on any of your internet accounts. A hacker can monitor the raw traffic from your IP address. As you log into different websites the encryption is all different, BUT if you use use same password for different accounts there are programs that will analize the encrypted 'hash' and figure out your password.

The prevention is easy - use a different password for every website account you have.

[Bill Moore]

Originally Posted by Matt Krass

Also, a tip from Joseph Matt . . .

The Mac public has had to deal with fewer of these malicious attacks than folks running Windows OS's, but with the new Boot Camp from Apple that won't hold true anymore for folks wanting to run Windows on their Mac. Those who have been diligent about computer security prior to Boot Camp will continue to be diligent, but those who have ignored security will learn a lesson quickly if they choose to run WinXP unprotected.

[Tomasz Bania]

This same person sent me the same message and I figured it out and blocked him immediately. He probably just made a random account to hack. At the time he tryed this with me (last week), his profile (assuming it's a he) only listed "I have computer trouble" so I was leinient at First. Than I got a funny message while trying to send him a picture of our robot (last thing he asked for before I realized) that said "You are currently recieving a -Virus- Would You Like To Continue?" so I just blocked him from any access to me (no IP access, no open port access,etc.) so I than checked and my Laptop(Click Here to view CD post about my laptop) and it's fine. I payed I think 4 or 5 grand at the time.

Just be alert and everyone should be fine.

Tomasz Bania

[Adam Shapiro]

Originally Posted by Tomasz Bania

I payed I think 4 or 5 grand at the time.

I'm glad he wasn't able to do anything. What do you mean you paid? Did the encounter cost you money in some way (repairs, losses, etc)?

EDIT: Heh, just figured it out..you paid for the computer... Nevermind. Glad to hear he wasn't able to do any damage. It's most likely just a prank.

[Tytus Gerrish]

i haven't had any damage to any of my computers but i have encountered strange random people that say they got my screen name from CD asking me to connect with them so they could either get or send a file.