now msn messenger is being took over

curiouskitten · Post by **curiouskitten** » 28 Feb 2006, 07:35

Hi, its me again...I hate to keep bugging you guys but something is definitely wrong here. Now my daughters msn messenger is being took over by someone. I have gone to msn networking passport and changed her password twice and whoever it is that is getting on her messenger is changing it back to the old password. Geez, I am lost here...could someone please tell me what is going here with my daughters computer?
Thank, you Belinda

Post by **bad_brain** » 28 Feb 2006, 09:08

hm, could be the aftermath of the worm infection, but when the password has been changed after you erased the worm and now still the passwords seem to be sniffed it points to multiple security flaws on the system.
I just can tell you what I would do:
- safe all important data to a CD
- lowlevel-format the HDD
- setup a fresh XP installation

when you´re done with this you should change some things:
- never use Internet Explorer, it completely sucks, use Firefox
- if you use Outlook switch to Thunderbird and edit the settings so the emails stay on the server until you decide to dl them (no automatic download)
- install Ad-Aware and Spybot, update and scan regularly!
- as far as I know McAfee has no selfprotection (I´m not 100% sure about this), Norton might be a better choice.

sorry I can´t give you a better tip, but when your system has been compromised it´s usually the best to setup a new one to be really safe.

Post by **CommonStray** » 28 Feb 2006, 15:00

just so you know low-level formatting isnt done by windows alone going to my computer and choosing format drive is not a low level format

low level formatting maps the HD's sectors and tracks and writes the control structures for where they are located - basically it physically removes everything, and defines where data is stored

check the manufacturer of your hard drive and goto their website and get their low level formatting utility - every manufacturer should have them on their site...

curiouskitten · Post by **curiouskitten** » 28 Feb 2006, 19:14

Man, I didn't want to hear that....but nontheless, thank you for your expertise....

Post by **Gogeta70** » 28 Feb 2006, 20:40

There' s a less extreme approach to this. Get a firewall. i prefer Sygate personal firewall, look for a free version of it. Then, simply scan for a trojan horse virus, keylogging virus, and such. simply scan all the files, look at any recently downloaded files and such.

However, formatting is a good idea, it "refreshes" your computer, or moreso windows.

Post by **bad_brain** » 01 Mar 2006, 04:08

right, a firewall is a must....in my opinion it´s also important to disable obsolete and potentially dangerous XP-services like ssdpsrv, ntp and NetBT.
and regular scans are inevitable, don´t rely just on one application, my box has been infected too some days ago with Smitfraud.C, and my virus scanner didn´t picked it up, it was found by Spybot...

ios · Post by **ios** » 05 Mar 2006, 22:12

I used to have a lot of problems on windows. Heres something simple to remove anything potentially harmful on the system, as well as speed it up a lot.

Go to Start->Run type in msconfig. Go to the tabs about the startup programs, learn which ones are essential to the pc. What I did was essentially uncheck most (if not all) processes that get started when windows boots up.

When windows once was infected, I noticed that there were odd named programs in the startup list of which I removed after taking them off of startup.The same thing I've noticed with one of my friend's pcs where he would leave it on 24/7. His system had a P4 but it seemed like it was running a PII from all the lag of the malware.

After configuring everything in msconfig scan your system for any malicious ware, Then get this handy utility that removes the unchecked startup entries. http://www.get-in-control.com/msconfig-cleanup/

After all that, if you want things more secure, set up a proper firewall. Then limit the ports. Port limiting is shown here http://www.hackerscenter.com/archive/view.asp?id=23226

Once you're all done the system will seemingly run faster than before you bought it.

Note: while in msconfig, if you're not sure if you should disable a program, just look up the program name on a search engine and look up what it does then you can determine if you should remove it or not.

Post by **Gogeta70** » 05 Mar 2006, 22:56

Good advice. I've done that several times, just to keep my system running like new (it's running like new right now, and it's 4 years old ;P)

PLeXroD · Post by **PLeXroD** » 06 Mar 2006, 04:08

sorry but i really have to say this.....

i dont have any firewall and anti vira programms at all and you know what? in that time when i had FW and AV, the computer caught viruses.... but now strangely i dont get one i try and try and i dont get any virus.... i might get spy - ad ware but not any viruses....
i dont even have windows firewall....

and as if i dont want the spy ware i can easly go in my computers software and remove it.... i have not in my hole life seen that mine has been taken over (msn) i have had control over it my self all the time...
but yes it is possible to take over another msn...

Code: Select all

FW = Firewall , AV = Anti Vira

[/code]

Nerdz · Post by **Nerdz** » 06 Mar 2006, 07:48

PLeXroD wrote:sorry but i really have to say this.....

i dont have any firewall and anti vira programms at all and you know what? in that time when i had FW and AV, the computer caught viruses.... but now strangely i dont get one i try and try and i dont get any virus

It is normal that you don't cough any virus if you don't have any anti-virus scanner?? no?

Post by **Gogeta70** » 06 Mar 2006, 18:33

Yep, i thought that was kinda funny too. You say you don't have any viruses, but how do you check for viruses if you don't have a scanner? Also, GET A FUCKIN' FIREWALL! it monitors connections to your computer, which may prevent the guy from getting your daughters password if he's using a trojan virus of some sort. Also, get adaware and spybot, google those.