View Full Version : Hacked by Nimda


Capstone
Wed, 24th Oct '01, 2:24am
DSL is awesome in many ways. However, nasty things can happen too...

In the very first hour I had it up, I noticed an incredible amount of activity on it (24MB received in one hour, without a browser open). My telephone company (who is my ISP) told me that was normal. Sounded fishy to me...

Within the next day, .eml files began appearing on my desktop and in every folder. Alarmed, I deleted all of them and shut down my connection.

The next day, they were back. I downloaded and installed ZoneAlarm. I then talked to my telephone company, who informed me I had Nimda. To my surprise, Norton AV is no longer available for free download. Purchased at a nearby store and installed, cleaning the virus from the computer.

After reading about the Nimda virus, it suddenly clicked. I hadn't even had a browser open for more than a minute; the only site I visited was my telephone company's startup page. I hadn't just contracted Nimda; someone hacked in and gave it to me.

ZoneAlarm is happily logging all attempts to get into my computer now. I'm trying to peruse the file and figure out who exactly the perpetrator could be. There are a few suspects; one from France and one from Buenos Aires. Arrrrgh; good luck visiting any retribution on them.

If only this were my own personal computer with the most vital thing on it being Baldur's Gate 2.... but no, this is my work PC with all our medical files and everything else... GRRRR...

Blackthorne TA
Wed, 24th Oct '01, 3:33am
Heh, yeah, both times I've got a new broadband IP address (when I got DSL and then when I got cable internet), I've seen people probing my computer withing a few days. The little light on the modem for incoming/outgoing traffic would flicker constantly for a few days, and I'd check the log files on my Linux machine (which acts as firewall and router for my Windows PC) and see all the rejections of the systematic probes from various places. But after a few days of getting nowhere, the traffic goes away and the light on the modem stops flickering when I'm not using the internet.

So, if you think getting a firewall for your brand spankin' new always-on broadband internet connection is a waste of time and/or money, think again :)

Capstone
Wed, 24th Oct '01, 3:37am
Nice thing about Zone Alarm is it's free. :D
Only thirty dollars should I decide to upgrade to Pro, which is a consideration.

Still pondering whether it's worth it to try and track down these people.

Kitiara
Wed, 24th Oct '01, 3:42am
hmm there is an add on program for zone alarm that gives you the email address of their isp so you can report them. It is an illegal action they are performing. The program is called ClearZone Report Utility. It is of course a trial version but you can download and try it here :grin:
http://download.cnet.com/downloads/0-3356727-100-5727333.html?tag=st.dl.10001-103-1.lst-7-3.5727333

Headbanger
Thu, 25th Oct '01, 4:49pm
Capstone, it's not worth to try to track down these people. Nimda virus installs a script on the computer. This script automatically sends emails to people in the adressbook, without that the sender knows the mails are sent. And when you just send an email, the script can add and attachment that causes the virus. So tracking down these people is no solution.

A time-trial-version of Norton Antivirus can still be downloaded and used to remove viruses.

More info about Nimda and links to other sites can be found here: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/nimda.asp

Capstone
Fri, 26th Oct '01, 2:55am
Heh. Nimda *would* have e-mailed itself had I been using Outlook Express. But I'm no such fool. ;)

Okay, so I did leave my computer unprotected for a couple days. *sigh* Maybe I am such a fool after all.