TER General Board

Re:This ever happen to anyone?sad_smile
paul-f 2 Reviews 2889 reads
posted

There was a well-known trojan horse zombie a while back that was secretly downloaded when you accessed a nasty website (or one hijacked by the nasties).  You didn't notice the download, because it came from a single pixel frame embedded in a normal looking site.  The effect of the download was to cause a dial-out via your modem, and the transmission of a variety of private information, if I remember correctly.

You could go to the Symantec.com website, and check their anti-virus center for the specifics.  If you're running current anti-virus software, and have a good firewall, you should have been protected against anything that old, so you may have run into a new one.  If you're not running a firewall and anti-virus program that you keep current with updated signatures, then you may have been infected with one of these zombie trojans.

Your best bet to clean up is to run anti-spyware and anti-virus software as soon as possible, to make sure your machine isn't still infected with a zombie program.  As to tracing down the malefactor, the one I remember from a while back was traced to a server in Romania or Russia, and beyond that was a dead-end.  Sorry.

Paul

My phone bill had a $45 charge on it for a 20 minute long distance call to Germany. When I saw this, I knew it was a mistake. I called the long distance company and they said it was a website that was accessed and traced back to my phone number. I was also told that I could go to my temporary internet files and find the website that was accessed. I did, but those files only went back to 2 days after the call. I looked in my cookies and there are several websites I did access that night, but nothing for that exact time or that had the number on my phone bill. This happened on December 17 and I have had no other strange occurrences with credit cards.

Someone at work told me my identity could have been stolen. Someone else said maybe not because there would have been more things ringed up when identities get stolen.

Questions I have are:

If I did access a website, what kind of site has a hidden process to charge my phone?

Is the phone number on the bill one where I can call or not a real number, sort of like an access number?

Does my cookies files have to have the exact time as the time on my bill for me to know the correct cookies file? One thing I noticed was, there was an Index.DAT file that was last modified on the same day as the call about 20 minutes after it ended.

Is there any way I can find out what site was accessed other than the two ways I mentioned?

I do know that you can dispute a charge on your phone bill. Also I would strongly advise that you go to webroot.com downloads page and download the spysweeper demo version (it is full version good for only 30 days) just make sure u download updates after installing before you run the program.
Good luck
Georgia

There was a well-known trojan horse zombie a while back that was secretly downloaded when you accessed a nasty website (or one hijacked by the nasties).  You didn't notice the download, because it came from a single pixel frame embedded in a normal looking site.  The effect of the download was to cause a dial-out via your modem, and the transmission of a variety of private information, if I remember correctly.

You could go to the Symantec.com website, and check their anti-virus center for the specifics.  If you're running current anti-virus software, and have a good firewall, you should have been protected against anything that old, so you may have run into a new one.  If you're not running a firewall and anti-virus program that you keep current with updated signatures, then you may have been infected with one of these zombie trojans.

Your best bet to clean up is to run anti-spyware and anti-virus software as soon as possible, to make sure your machine isn't still infected with a zombie program.  As to tracing down the malefactor, the one I remember from a while back was traced to a server in Romania or Russia, and beyond that was a dead-end.  Sorry.

Paul

WebTerrorist2902 reads

Sounds like what you have is a modem/dialer hijacker.
Basically what it does is hijack your modem, disconnect your from your ISP and dial a long distance (usually overseas) number (foreign ISP) that charges your phone bill.

These are malware.

Generally what happens is you go to a site that has ActiveX controls which download and execute the malware. Though these can also be installed with programs you have intentionally installed, certain pr0n programs and some "cracks" are known to be bundled with malware.

First thing I would suggest is that you go to:
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

and run the free online scanner (it will ask to install spftware...let it...I assure you it's safe.  :)  ;)
When you run the scan check the box for "heuristicscan", and have it scan your computer.

Then go to:
http://www.lavasoftusa.com/
and download the free version of Ad-aware

also go to:
http://www.majorgeeks.com/download2471.html
and get Spybot Search and Destroy
and install both programs.

Now, reboot your computer into safe mode (to get to safe mode you tap the "F8" key right after you hear the post beep, the beep you hear just as you turn your computer on.  You will get a screen where you choose your boot options, choose "safe mode"  and hit enter)

In safe mode, run each of the two programs one after the other, and let them fix anything they find.

Reboot your computer as normal, and the go to either:
http://www.sygate.com/firewall/
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp
and get one of the firewalls, this should help prevent a program from dialing out without your knowledge or consent.

As for the kind of sites that would install such a program, usually they would be entertainment sites (pr0n), pirate or "crack" sites, but can also come from game sites, music sites.

To prevent this in the futer you might consider either using Firefox as your browser, from:
http://www.mozilla.org/products/firefox/

or at least turning off ActiveX controls in IE:
Tools
Internet Options
Security tab
Custom Level button
set the options for ActiveX Controls and Plug-ins to "disable"  or "prompt"

As for the time, it most likely wouldn't have been at the time you accessed the site.  
If you can find out what dialer you have it may be somewhat traceable.  
Think of anything you knowingly installed around that time, and sites that asked you install any plug-ins.  
Also, it is possible that the program was installed the day or so before the call was made, as many programs require you restart your computer to work...so you may check your history for the day before the charge.

Sorry I couldn't be of more assistance.

http://icefortress.com/
It will take a bit of work on your part, as you actually have to hack into the site a bit on your own to go to downloads section.  But you can access the forums for help on anti spy ware programs and more.  Additionally, programs to help you identify who is actually looking at you from Cyberspace are available.  Have been a member for some time now, so cannot give you more info.
Also, try:
http://www.google.co.in/search?hl=en&ie=UTF-8&oe=UTF-8&q=firewall+comparisons&btnG=Google+Search&meta=
Good link to find firewall protection if you need it...

take a look at the Mozilla browser.  Using Mozilla helps reduce your exposure to all the worms, virus, pop ups, spyware, etc..  since all those types of things are built around Internet Explorer vulnerabilities.

Mozilla has many features that I like more than IE, and a few that I don't like. It took a couple days to get used to the new navigation and look/feel (Mozilla resembles the Netscape UI) but it has been worth the effort many times over.

Best of all it's free!

The phone company counts on you to give up after they answer you.

Ask for a supervisor, and since it's the first time, and you didn't make the call, nor did you authorize your computer to make the call, demand that they take the charge off your bill.

If they decline to do so, make a quick call to the Public Utilities Commission.  The phone number is listed right on the phone bill.

It may take a few minutes, but the nice person at the PUC will hear your dispute, then they will put you on hold while they contact a supervisor from the company that bills your phone.  You'll most likely be happily surprised that THIS supervisor will, having been apprised of your complaint, now be telling you what your adjusted total phone bill is.

If you don't come to an agreement with the phone company, you can write to the Public Utility Commission and have it resolved that way, Which the phone company really doesn't want you to do... that's a mark against their record.

Good Luck and NEVER ROLL OVER!!!

xoxo
Elise

One browser that was not mentioned was the Opera web browser.  There are many choices besides IE out there, Netscape, Firefox (similar to Netscape) plus others I cannot recall right now.  I only use IE to download Microsoft patches, otherwise, I am a Netscape user.  

Linux anyone?

Also don't leave your computer on overnight, and be sure to disconnect the phone line nightly.  Check your credit reports closely and put a 'hold' with the credit bureaus.  TRW, Equifax, and Experian.  

Those of you out there with Cable or DSL, turn off the power to the modem when not in use, hackers can remotely access and turn on your computer, thanks to new technologies.  

As other posters have posted, have an up to date virus program, a firewall to go along with it is even better.  Go and buy a copy of Trend Micro's PC-cillin when you get a chance.  

Neutrogena.

Register Now!