Findail
Band of Builders Inc.
Firmus Ixion
   |
Posted - 2006.08.31 20:58:00 -
[1]
Edited by: Findail on 31/08/2006 20:59:43
 Originally by: Kalixa Hihro
Virus scanners only recognize _known_ viruses in their signature subscription. A trojan != virus. Viruses destroy files. A trojan impersonates them.
Neither spyware removal or virus scanners will see this if it's new and unknown to the companies.
What probably happened is the rar file installed a keylogger or eve trojan which sent everything you typed to them, since the password is not stored on your computer.
As this is extremely illegal and dangerous stuff (in real life), I suggest you contact your local police department and report the incident. You should also contact the SANS institute and report it. Send them a copy of the RAR file so they can disseminate it to the spyware companies. They may have also stolen other creds, including credit card numbers, the id/pw to your bank etc. Anything you type on your computer is at risk until whatever this is is identified, to understand the risk, and removed.
You should also go to your folder options and uncheck "hide known extensions". People can take a gif, jpg or anything else and name it something.rar.exe. If you have hide known extensions checked, it shows up as something.rar. Unchecked it shows the real story.
Download and install ethereal (a packet sniffer) or get an IT pro you know to do it, and see if your computer is sending stuff to strange places. Note the IP's and include them in the police report. While sniffing the network, don't do anything. Turn off any internet applications etc, to minimize the noise. Run a trace for a while. Then start eve up and run a trace while that's happening. Save the traces and give them to the police on CD.
-Kal
This is excellent advice (except the bit about installing stuff)
If you want to monitor what a machine is up to, do it from a different box.
What laws apply will depend on the country you're in, but almost all countries now have computer privacy laws in place.
You should also be talking to your service provider. If they are doing data accounting on traffic, there's a very good chance that the netflow data they use will be available. That data tells you what traffic went where, and when, right down to individual packet level.
The correct thing to do with the affected machine is ensure the HDD remains unaltered. i.e. remove the HDD and replace it with a new one. Give the compromised disk to law enforcement officials and let them do their job. It will, in all likelyhood, still contain info on where the stolen data was sent to
|