Help! I Got Hijacked

[Tomzhere]

My wife and I came home from a nice weekend to find our PC had a nasty "overlay screen" on the desktop warning me that my files were exposed and I needed to click the link provided on the overlay to save my files.

I knew immediately something was wrong. (I did not click the link provided, but we are pretty sure the surfer did).

We soon learned that that our PC had been used without our permission and at 1AM Sunday morning and the unathorized surfer had managed to get us a virus (a trojan) and a lot of data miners and a new "overlay" for lack of a better word. I could see and use my normal desktop but there was also a screen telling me to click to remove. I suspected it wanted me to open a conection so that the virus might send out the data it was supposed to get from our PC.

Well to make this short. I looked at my AVG and saw that it had recorded a virus at 1:35PM and a lot of attemted hijackings.

I also ran ADAWARE6 and removed over 100 data miners.

I finally was able to remove the "overlay" from my desktop and got all the nasties quarantined.

Now for my question.. I can't get IE to connect automatically using the dialer. I can go to the start menu, and use the "connect to" button that opens a dialer, make the connection to my provider and then open IE.

That works, but how do I get IE to dial automatically?

Thanks for any help.

There was not telling what the data miners sent out. So we have been to the bank this morning changing all our accounts. Start on credit cards next.

But that won't help us with ID theft if anyone got our Soc Sec and Drivers Lic.

Tom

[jfsmith]

Tom,
Download Spyware Blaster from www.download.com. This will help with the data miners.
I am not sure of which service that you are using, but getting the dialer and IE to work may require that you call tech support.

Good Luck.

Jerry

[Evan]

You don't want IE or anything else to dial automatically. The setting for that is in the Internet Option on the IE tools menu. DO NOT set it to automatically dial a connection or you could end up on the hook for a BIG phone bill. One of the latest scams is known as "Modem Hijacking". A dialer program is stealth installed that dials a 900 number in Africa and charges your phone at the rate of $10 per minute. The phone company is obligated by international agreements to pay the overseas company the amount charged. Because of that they are very hard to convince to forgive the charge regardless of how it was incurred.

[This message has been edited by Evan (edited 06-21-2004).]

[wierdscience]

Reset your ISP password and change it first of all,if you leave your machine running(I never do)anybody can hack a password and do whatever they want remotely.

As far as the automatic dialing thing,I have that happen about three times a year,I jsut redo the settings and the e-mail settings so when I click an icon or tool button a dial window opens and I manually type in the ISP password,don't check the "remeber password"box,just write the password on the face of your monitor in pencil,a bit of a pita I'll admit,but for some unknow reason it cuts down on the bs.

[J Tiers]

It is a good plan not to use your internet computer for your finances. I know, you are probably hooked in with the bank with internet bill paying etc, etc.

Cancel it.

The ONLY sure way not to get your finance info looted over the net is not to have the finance computer connected to the outside world.

That is how the spooks do it, same with the nuclear bomb labs etc. No connections, no problem except physical security.

You can get a cheap used computer to connect to the net with.

[Tomzhere]

Thanks to all for your help and advice. When I said connect automatically I meant just what weirdscience said. I finally figured it out.

Yep, we have 5 computers I guess we should keep one for finances only. My wife like the online bill pay though.

[Tomzhere]

One last thing though. I cleaned out the virus and the data miners etc. I got my home page back. Everything looks good except that I continue to get a message saying that a trojan virus is in my computer. The message says run AVG(?) to remove.

When I run AVG it turns up nothing. I think there is one final file I need to eliminate because on my task bar I get a blank tab.

If i right click to close it it does nothing. I checked my startup to see if it was in there. I don't think it is.

Task manager does not show anything unusual open.

How can I eliminate the blank tab from my task bar?

Tom

[Evan]

If you are running Win ME you probably have a viral file in the restore files. AVG can't touch those as they are proteced by the OS. You must disable system restore, reboot, enable system restore, reboot. That will get rid of it.

Right clik My Computer. Click Properties>Performance>File system>Troubleshooting>Disable system restore.

Reboot, re-enable, reboot. Run AVG.

If you have Win98 there is a bug in the OS that will cause a blank item to show up on the task bar after the screen saver has activated and then been dismissed. There is a fix for it but it doesn't work on all machines, incuding one of mine. It may also affect ME. Don't worry about it, it has no bad effect.

[Tomzhere]

Thanks Evan. I'm running XP, I'll try as you suggest for ME.

Also I'm thinking of getting either another browser, I think you recommended Mozilla. Right?

I beleive Ibewgypsie likes Thunderbird for mail. I'm thinking of trying these two.

Tom

[This message has been edited by Tomzhere (edited 06-22-2004).]

[Crazy Ed]

Get Linux!!