my pc was hacked

[Infinite]

woke up this morning and when i log in it just says "sp0rkeh 0wNs y0u" fucking gay

[Dan@CompetitionClutch]

hahah... that sucks. but its funny. on a serious note, did it fuck anything up? you can fix it, your smart! lolol

[JDM Steve]

lol damn, weird thing just happend too.. my fathers friend just came into the office and said he needs his comp fixed because of virus

[TheWhiteEwok]

Hey,

if any of you need help with your PC's in ANY fashion (hardware/software/developing), drop me a line. I am a contract IT guy.

[TheWhiteEwok]

woke up this morning and when i log in it just says "sp0rkeh 0wNs y0u" fucking gay

that = gayness. However that could be a system msg and wouldnt neccessarily mean you've been "hacked" but just a strong cmd line user. Were you able to log on @ all? or did it re-prompt you for username?

1st - got anti-virus?
2nd - anti-virus upto-date & scanning properly?
3rd - Windows firewall, exceptions tab
4th - (XP NON-home) Right Click My COmputer - Manage - Users & Groups ... any unknowns?
5th - know your Router password? is it the standard/default? if so ... change that shiat nowz.

hell there are tons of routes to go through ... hope your PC is shooting straight now ... if not ... respond back with more details

[flip]

that = gayness. However that could be a system msg and wouldnt neccessarily mean you've been "hacked" but just a strong cmd line user. Were you able to log on @ all? or did it re-prompt you for username?

1st - got anti-virus?
2nd - anti-virus upto-date & scanning properly?
3rd - Windows firewall, exceptions tab
4th - (XP NON-home) Right Click My COmputer - Manage - Users & Groups ... any unknowns?
5th - know your Router password? is it the standard/default? if so ... change that shiat nowz.

hell there are tons of routes to go through ... hope your PC is shooting straight now ... if not ... respond back with more details

Lizten to this man. He knows what he says.

[TheWhiteEwok]

Thanks Flip!

Im just watching ChloBot beat the fuck out of some old school castle and listening to Da tunes ... doing laundry ... ive been out sick 2 days ... laid out ... i think a dutchy is about to die ... but not certain.

im bored.

[~The_Duke~]

Will you should know better than to let your shit get hacked...lol

I didnt know about the user group thing though...

[Infinite]

heh, he went through the registry and changed all of my buttons to display that gay message. screen size was limited to 800x600, couldnt run programs except for windows media and the cd burner (thank god, saved solidworks)

the mouse would flip flop and the keyobard worked on and off... it sounded like a mosucker based attack IMO. i ahd to hardwire my comp because my router took a shiit, thats when the problems started.
but i re-formatted it but i broke my drivers disc so i cant get my internet connection working. im on my moms laptop atm

[TheWhiteEwok]

heh, he went through the registry and changed all of my buttons to display that gay message. screen size was limited to 800x600, couldnt run programs except for windows media and the cd burner (thank god, saved solidworks)

the mouse would flip flop and the keyobard worked on and off... it sounded like a mosucker based attack IMO. i ahd to hardwire my comp because my router took a shiit, thats when the problems started.
but i re-formatted it but i broke my drivers disc so i cant get my internet connection working. im on my moms laptop atm

mosucker can be stopped and stomped easily ... mainly through windows firewall/router ... but you can even do it by some registry stuff ... it all depends really

here is a small easy hack to disable basically ANY trojan. Go into your local_system registry and find your RPC key ... change it from NETWORK_AUTHRORITY to LocalSystem. RPC = Remote Procedure Call ... one of the nastiest of nastiest app's out there. Its a BASIC function to servers/PC's ... on a server ... if RPC is messed up ... ur server is fucked ... and its time for a OS reinstall. Lots of trojans however use RPC or wrap RPC commands in HTTP (outlook has an option) to get their shit done.

I however recommend fuckin with your registry if A - you have a complete backup, B - its on a VM, C - you actually know what your doing ... otherwise you will flip switches that cant be switched back as easily.

start - run - cmd - "netstat - a" is the beginnining command to figuring out WHO used Mosucker on u.

Let me know if you need any help with drivers or anything ... ill be glad to look/help.

[Infinite]

heh, i already reformatted but id love to know how did.

[TheWhiteEwok]

ha ... 1st thing ... who ever used Mosucker on you is a fucking script kiddie and should be fucking shot/torn apart for his/her lack of creativity.

If you want to hack ... do it the real way ... not download some bullshit app to do the "fun" stuff on its own ... F'in pussies.

Mosucker is a Remote access application. It uses the RPC, RA (remote administrator) as its main "kernel" from there ... ill be honest i dont know exactly because im not a script kiddie. I would hypothetically say it probaly war dialed your admin account for the password. Most litely it used your router/firewall to gain access to your LAN and then just did whatever he/she wanted.

However ... honestly ... in times where i have completely gained access to a PC ... i dont just fuck with the keys or what not ... i make fucking pudding out of yoru system ... so you were "lucky" and which also makes me think this wasnt a TRUE hack ... but person X just made it look like it.

1st recommendation - have your router/firewall password NOT the default ... plz god
2nd - have windows firewall turned on (unles your an advanced user) ... and have NOTHING as an exception ... each time something tries to leave yoru lan it will prompt you for "allow or not" ... from THERE you decide.
3rd - are you @ spsu? in their LAN? there are some tricks for SPSU
4th - YOU the USEr do NOT download or install ANYTHING that you DONT know how it works ... MOST times script kiddies will post those BULLSHIT apps as "hacking" tools when in reality those tools make YOUR PC the ghost client for whatever distributed network the REAL hacker has created .... FYI ... there was an article YESTERDAY about the strongest hacker in the world having a network of 116 MILLION PC's under his arsenal as ghost PC's. THIS IS REAL, fuckers like him DO exist ... and the country he/she/it lives in ... MOST DEFINETLY doesnt care about the US hacking laws ... so tread VERY INTELLIGENTLY.

[~The_Duke~]

His router broke which is why he got hacked...

He also mentioned that his computer will be used a someone's hard drive...

[TheWhiteEwok]

someones hard drive?

your C drives in a server environment are automatically shared, but in a peer to peer they are most definetly not.

lol what are you guys setting up over there?

[Infinite]

Someone was storing porn on my pc... everytime i would check my c drive it was smaller by a few gigs.

[~The_Duke~]

someones hard drive?

your C drives in a server environment are automatically shared, but in a peer to peer they are most definetly not.

lol what are you guys setting up over there?

What I think someone did is set up a VPN with his computer using the built in windows software for it. Which then makes your computer like a part of a LAN over a WAN. Therefore the person that hacked him could use something like remote desktop to go in and change registry stuff and what not. Which would explain why his keyboard wouldnt work and what not. The hacker also could go in and turn on drive sharing. There is also a gliche in Win XP where someone can go into someone's hard drive over a network and take 'ownership' of a folder or file which then locks all other users from being able to access or delete said file.

Windows sucks...

[TheWhiteEwok]

i know of no gliche in XP that allows a random user to take control of the %System Root% folder or of the C: drive. In a server environment ... ur C: drives are shared by Group Policies.

Oh well its said and done ... u got your PC back up and runnign yet Infinite?

[Infinite]

eh sorta. my drivers cd magically broke so i cant find sound card drivers. but other than that i guess its ok.. im moving onto the spsu campus here soon... what tricks? :D

[TheWhiteEwok]

HA ... SPSU!!! ... years ago when i was there, there was some large loop holes in the network topology that allowed you to take control of certain switches ... which are all managed with SNMP ... so you could literally highjack yoru bandwidth ... it really really pissed off the IT peeps. But thats probably fixed by now ... ill have to double check with my buddy up there now ... he just got a teaching job ...

Beyond that ... man ... i would love to see how the network is and give it a good 8 hour session ... im sure there are still holes.

[flip]

HA ... SPSU!!! ... years ago when i was there, there was some large loop holes in the network topology that allowed you to take control of certain switches ... which are all managed with SNMP ... so you could literally highjack yoru bandwidth ... it really really pissed off the IT peeps. But thats probably fixed by now ... ill have to double check with my buddy up there now ... he just got a teaching job ...

Beyond that ... man ... i would love to see how the network is and give it a good 8 hour session ... im sure there are still holes.

Haha i remember that. I wonder if my old IP still has 80% of the whole dorms bandwidth. :ninja: They made it soooo easy...