Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ran a full virus/spyware scan on my computer last night for the first time in a while and it found and deleted three items that have only been registered on the Malware Protection Directory since July 3rd (today is July 8th):

  1. TrojanDownloader:Java/OpenConnection.BA

  2. Exploit:Java/CVE-2008-5353.EM

  3. Exploit:Java/CVE-2008-5353.DN

What should I do now?

Should I change all of my passwords to my financial accounts and e-mail accounts? My Firefox password list?

Could it be that some of the personal files on my computer (MS Word documents, etc) were sent out to an external entity?

How do I know what these Trojans were doing while they were existing undetected on my machine?

Do I have any way to know?

I'm quite freaked out by this because I have no idea what the possibilities are here and don't know if there are any steps I should be taking right now to prevent any additional problems.

share|improve this question
up vote 5 down vote accepted

I'd suggest you start with

I have enough assets I care about, so I did change passwords, invent a new mother's-maiden-name, cancel cards, put passwords on bank accounts... if I valued it and it wasn't guaranteed against fraud, I set fire to everything old a la Sherman's March: I left nothing behind of value. The tradeoff is going to hinge on what you have, and whether it is worth paranoia and your time, vs. worrying.

Yes, especially stored passwords or things you've used in the last 2 yrs (age of the exploit).

Yes, trojans and rootkits could allow file transfers. Odds are you were pwned and your computer's access credential data was bundled and sold and nothing more, but the odds of worse happening increases if you somehow caught their interest.

You won't know. If someone better than I was to spend a lengthy amount of forensic effort, we might get clues what happened. The odds are damn slim, though.

The way to know would be to spend far more than paranoidly resetting account data will cost on a forensics evaluation, with scant likelihood of finding anything out.

Don't freak out. So far, systems for botnets seem to be worth more than the personal financial data on these systems, but that's changing fast. I'd wager that you're not going to lose your fortune if you don't act, but I sure wouldn't take chances considering the alternative is a few days of phone calls and hassle. Just stop surfin' porn, use MalwareBytes antimalware (no, I'm not a shill -- it's free, I like it, I don't stand to gain by recommending it) or some other scanner regularly and take measures against anything you consider valuable enough to need keys reset and passwords / accounts changed.

My credentials: CISSP, SANS GPEN certs, 30 years of coding, security and admin experience. I'm merely a so-so hacker, but work with people that are world-class.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .