Skip to main content
gamedev.net
🔒 Locked

Hacking problem

Started by IFooBar 9 replies 300+ views
Original Post
IFooBar
IFooBar
Hi. I got sent this picture from a friend and I opened it but I didnt notice the .pif extension and it ran something. Next thing I know he could read what I was reading, and he can send me these message boxes, and close my msn messenger. And i deleted the .pif file cause i thought it would stop but it didnt. Is there anyway to stop this. I got this prog called Hack Tracer but I dunno what to do. I dont really know much about this kinda stuff. Anybody know what to do? thanks
:::Al:::
[Triple Buffer V2.0] - Resource leak imminent. Memory status: Fragile
[size=2]aliak.net
niyaw
niyaw
quote:
Original post by alfmga
he can send me these message boxes

disable the messenger service? (not msn messenger)
quote:

and close my msn messenger

if he knows your password and signs in, you'll be signed out. try changing your msn password.

also check to see if there are any suspicious services around in the service control manager, and if anything funny is being loaded on startup through start menu or run registry keys.

i assume you already tried rebooting in safe mode and running a virus scanner?

and you can try getting a freeware firewall like zonealarm that tells you when programs try to use internet.

also, if you're on dynamic ip, try getting a new one (reconnect to internet, restart cable/dsl box, etc.)

[edited by - niyaw on December 14, 2002 3:13:22 AM]
GdWiki
owl
owl
sad thing you deleted the .pif. Now we''ll never know what he did...
[size="2"]I like the Walrus best.
IFooBar
IFooBar
I know. after deleting it i realized i shouldnt have
quote:
disable the messenger service?

How do u disable the messenger service?

. He dosnt sign me out. He just closes my msn messenger (Exits it) and I thought maybe changinf passwords might help but it didnt. He can even make my start button dissapear. it just goes. I can still press the Windows key to make the start menu popup, but the button just vanishes.

no i didnt try running a scanner in safe mode, I didnt know running in safe mode or normal mode would be much of a difference, so ill try that now.

I am on a dynamic IP. but hes done this quite a few times ive connected. so i assume that the program has something to do with it. Adn i dont even know the name of the program that was sent so i have no idea what to delete or what to look for.

Ill get a firewall i suppose. Does having a firewall stop u from using p2p apps?

:::Al:::
[Triple Buffer V2.0] - Resource leak imminent. Memory status: Fragile
[size=2]aliak.net
CodeJunkie
CodeJunkie
You can download the free version of ZoneAlarm.

Any program that connect to the internet will need premission from ZoneAlarm to get internet access. So you can still use the P2Ps if you want.

Please keep us updated.
IFooBar
IFooBar
Ive been messing around with the hack tracer and here

  
Date/Time            Source IP       Host name                                SPort  DPort
2002/12/14 09:34:10  65.40.141.134   user134.net456.oh.sprint-hsd.net         18075  1453  
2002/12/14 09:33:41  12.254.212.205  12-254-212-205.client.attbi.com          1168   1453  
2002/12/14 09:33:22  24.55.218.14    ca-brea-cuda1-c9a-14.anhmca.adelphia.net 4620   1453  
2002/12/13 23:31:46  202.133.39.150                                           4722   12345 
2002/12/13 20:50:22  24.184.19.131   ool-18b81383.dyn.optonline.net           2227   1453  
2002/12/13 20:30:55  63.206.136.112  adsl-63-206-136-112.dsl.lsan03.pacbell.net 3297   1453  
2002/12/13 20:32:28  24.154.57.43    acs-24-154-57-43.zoominternet.net        4109   1453  
2002/12/13 20:32:44  24.154.157.186  acs-24-154-157-186.zoominternet.net      3124   1453  
2002/12/13 20:33:12  172.140.11.215  AC8C0BD7.ipt.aol.com                     4588   1453  
2002/12/13 20:34:15  24.222.187.74   u187n74.hfx.eastlink.ca                  1155   1453  
2002/12/13 20:34:27  146.151.125.29  witt125-029.resnet.wisc.edu              2785   1453  
2002/12/13 20:34:48  66.75.177.255   cpe-66-75-177-255.socal.rr.com           2825   1453  
2002/12/13 20:34:50  12.229.68.56    12-229-68-56.client.attbi.com            65074  1453  
2002/12/13 20:36:28  12.18.90.119    vic-2-24.tisd.net                        4452   1453  
2002/12/13 20:37:27  141.149.250.228 pool-141-149-250-228.buff.east.verizon.net 4626   1453  
2002/12/13 20:39:03  24.92.253.32    syr-24-92-253-32.twcny.rr.com            3359   1453  
2002/12/13 20:40:06  63.228.85.105   dnvrdslgw14poolB105.dnvr.uswest.net      62908  1453  
2002/12/13 20:40:46  12.159.190.5                                             17407  1453  
2002/12/13 20:40:53  66.214.13.135   66-214-13-135.lb-cres.charterpipeline.net 1027   1453  
2002/12/13 20:41:17  66.72.105.222   adsl-66-72-105-222.dsl.chcgil.ameritech.net 20136  1453  
2002/12/13 20:41:31  65.188.248.241  dsl-65-188-248-241.telocity.com          7752   1453  
2002/12/13 20:41:50  80.74.205.178   dsl-XIII-178.kotikaista.weppi.fi         50373  1453  
2002/12/13 20:42:25  207.173.255.199 207-173-255-199.bras01.elk.ca.frontiernet.net 4457   1453  
2002/12/13 20:43:27  24.154.46.247   acs-24-154-46-247.zoominternet.net       4672   1453  
2002/12/13 20:45:13  158.104.73.35   amerten.resnet.willamette.edu            1061   1453  
2002/12/13 20:45:37  24.101.240.20   CPE014150001970.cpe.net.cable.rogers.com 64985  1453  
2002/12/13 20:45:56  62.248.238.73                                            1783   1453  
2002/12/13 20:46:02  12.209.131.137  12-209-131-137.client.attbi.com          2899   1453  
2002/12/13 20:46:20  80.177.4.94     timbish.demon.co.uk                      32785  1453  
2002/12/13 20:46:39  62.109.73.231                                            1712   1453


That is a list of the places that tried to get to my comp. I assume mosty of them are just passing through. Is there anything I should look for. Also I can block IPs with this, so how do I get the dudes IP address.

thnx for that zonealarm thing. Ill get that too, but if someone can tell me how to get his IP address then I can block him directly. Thanks for replies so far

:::Al:::
[Triple Buffer V2.0] - Resource leak imminent. Memory status: Fragile
[size=2]aliak.net
joanusdmentia
joanusdmentia
I think you''ll find this line

2002/12/13 23:31:46 202.133.39.150 4722 12345

will be him, the port 12345 is just a _little_ suspisious. if he''s got a dynamic IP then you wont be able to block on IP, but possibly on port number (but remember he may be able to change that). if your hack tracer gives the process that''s on that port then you should be able to track down the executable associated with it and delete it.
"Voilà! In view, a humble vaudevillian veteran, cast vicariously as both victim and villain by the vicissitudes of Fate. This visage, no mere veneer of vanity, is a vestige of the vox populi, now vacant, vanished. However, this valorous visitation of a bygone vexation stands vivified, and has vowed to vanquish these venal and virulent vermin vanguarding vice and vouchsafing the violently vicious and voracious violation of volition. The nly verdict is vengeance; a vendett o
Andrew Russell
Andrew Russell
It sounds to me like you have been Sub7ed. It dosn''t seem messenger specific to me. Have you virus scanned. Whatever it is, the likelyhood is that it won''t affect you when you are not on the internet. Virus scan ASAP.

Go start->run->"msconfig" and look through your startup and see what there is there. You don''t need much in there. Basicly unless you know _exactly_ what it is (ie: not a guess from the name - the name can be faked) disable it and then go through and check out what each one starts up, one at a time. (enable an unknowen, reboot, disable/keep depending on what it is, enable an unknowen, reboot, etc..)

Do not meddle in the affairs of moderators, for they are subtle and quick to anger.

ANDREW RUSSELL STUDIOS
Cool Links :: [ GD | TG | MS | NeHe | PA | SA | M&S | TA | LiT | H*R ]
Got Clue? :: [ Start Here! | Google | MSDN | GameDev.net Reference | OGL v D3D | File Formats | Go FAQ yourself ]

IFooBar
IFooBar
i scanned. nothing was found. (PC Cillin incase you want to know) Ill do that thing with msconfig. Thanks for the suggestion. as for this
2002/12/13 23:31:46 202.133.39.150 4722 12345
Is there a way to determine which country the ip is from atleast? The guys using dsl so i think those use fixed IP addresses right? If I can confirm that that IP is from Bahrain (thats where he is) then it''s probably him.

[sigh]
peaople these days
[/sigh]

:::Al:::
[Triple Buffer V2.0] - Resource leak imminent. Memory status: Fragile
[size=2]aliak.net
Andrew Russell
Andrew Russell
try

Start->Run->"command"->"tracert 202.133.39.150"

See what sort of domain names come up. I got nothing and then timed out. There were no domain names. There is more checking on what could be done, but that is as much as I can be bothered.

Do not meddle in the affairs of moderators, for they are subtle and quick to anger.

ANDREW RUSSELL STUDIOS
Cool Links :: [ GD | TG | MS | NeHe | PA | SA | M&S | TA | LiT | H*R ]
Got Clue? :: [ Start Here! | Google | MSDN | GameDev.net Reference | OGL v D3D | File Formats | Go FAQ yourself ]

Fruny
Fruny
A query to ARIN points to APNIC.

whois -h whois.apnic.net 202.133.39.150

The 202.133.32.0 - 202.133.47.255 netblock is registered to Crestar International (Pvt) Limited, with contact information in Karachi, Pakistan.

[ Start Here ! | How To Ask Smart Questions | Recommended C++ Books | C++ FAQ Lite | Function Ptrs | CppTips Archive ]
[ Header Files | File Format Docs | LNK2001 | C++ STL Doc | STLPort | Free C++ IDE | Boost C++ Lib | MSVC6 Lib Fixes ]
"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." — Brian W. Kernighan

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.