up vote -1 down vote favorite
share [g+] share [fb]

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Hi,

I'm a product creator, and in attempt to track and stem my losses from piracy, I occasionally visit a bulletin board dedicated to piracy and piracy-for-profit; my products are regularly pirated and sold there.

When visiting, I often get intrusion alerts from Kaspersky, and I received one such today.

After I left the site and browsed elsewhere with the new FireFox 4 beta, a window popped up to indicate that a Thunderbird add-on for the beta was available, and offered to install it.

I accepted the installation.

A few minutes later, Thunderbird opened without my doing, and displayed an outbound email with the administrator of the bulletin board named as recipient. (I know the guy's email address, and he explicitly boasts of hiring hackers to penetrate sites so as to copy and sell the products he finds.)

So, have I been hacked, and if so, what should be the next step, security-wise?

(Note: Kaspersky regularly alerts me of intrusion attempts when visiting that guy's site, but never displays a record of them afterward.)

Thanks in advance for any suggestions.

link|improve this question
4  
The answer is the same here as it was on Server Fault - back up your data and nuke the machine. – ChrisF Jan 26 '11 at 22:57
1  
You said yes to an unknown pop up? – Moab Jan 26 '11 at 23:00
Instead of running into their traps, increase the security of your software. Without making it too hard on yourself, make your application less easy to hack by protecting it by packing techniques and make your serials are less easy to hack, in this way you can release a new version with extra features and just invalidate the keygen for that version as the keygen is unaware of the extra serial algorithms. Furthermore, cracked software is free advertisement, you can't do more than them, they will crack it anyway sooner or later... – Tom Wijsman Jan 26 '11 at 23:15
feedback

closed as exact duplicate by ChrisF, studiohack♦, KronoS, Tom Wijsman, Ivo Flipse♦ Jan 27 '11 at 0:32

This question covers exactly the same ground as earlier questions on this topic; its answers may be merged with another identical question. See the FAQ for guidance on how to improve it.

3 Answers

up vote 5 down vote

My thoughts are this:

DONT EVER DOWNLOAD AND INSTALL SOMETHING THAT POPS UP!!!!!!

With that said, the answer is yes I think you've been hacked. You need to re-install (in my opinion) your OS and start all over. This is make sure that anything and everything that may have been embedded into the system has been taken care of. I would also change and passwords that you may have stored on the PC as well. This is a pretty scary sounding scenario.

Also might I suggest that you NEVER visit sites like that again. If they're pirating your software, going to their sites isn't going to help. Find a better way to encrypt your code.

link|improve this answer
And tim, asking elsewhere won't get you a better answer... sorry. This is what they suggested on ServerFault, also. – Josh Jan 26 '11 at 23:00
Thanks for the answer; I asked here because the question was apparently deemed off-topic on ServerFault. – tim Jan 27 '11 at 0:50
feedback
up vote 0 down vote

Best practice - to be sure you must nuke and reinstall. However, it sounds to me the other action that would cause Thunderbird to appear like that is you accidentally clicking on his email address, with TBird set to be the default email app.

link|improve this answer
Actually, I realized later that I might well have begun a complaint letter to the guy and then never sent it, such that what I saw today was actually just that old draft, which just popped when Thunderbird opened-- which, in turn, followed from my either accepting or rejecting the "add-on". (I'm not fully certain that I accepted the pop-up; I may have just killed it.) That said, I haven't been able to find any Thunderbird plug-ins or extensions within my FireFox install, and I haven't seen any draft letters, either. – tim Jan 27 '11 at 0:47
feedback
up vote 0 down vote

Follow the order given below to disinfect your PC

1.) On a PC that is Not infected, Make a boot AV disc then boot from the disc on the Infected PC and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet at the time of scan and is suggested to update before the scan.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

,

2.)Boot into Window Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

.

3.) When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects. http://www.superantispyware.com/download.html

These last 2 are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

.

link|improve this answer
This is just repeating information from the reference answer. – ChrisF Jan 26 '11 at 23:08
1  
Important to note that the boot disk should be made from a known-clean system, not the suspect-infected one. – Iszi Rory or Isznti Jan 26 '11 at 23:21
Both the reference answer and the "use a clean system" note are helpful; thank you. – tim Jan 27 '11 at 0:48
@Chris F, this is my standard answer here at Super User when a PC is infected, it gives specific instructions and links to software, sorry I don't meet your standards for answers...@ Iszi, thanks, I will edit this to include your additional advice. in the future. – Moab Jan 27 '11 at 15:26
it's just that the reference answer should have this information (if it doesn't please add it), while duplicate questions are OK (as they improve the Google juice) it hurts the site to have the answers split across multiple questions. – ChrisF Jan 27 '11 at 15:31
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.