Jer

I booted up my computer after two weeks holiday all seemed fine. I Re-started it the next day and my MSN Messenger name had changed to "I Suck C***K on first date" and my desktop photo had changed to a picture of a Chinese woman lying in a bath upsidedown having a verry runny poo, a really sick photo. How has this happend? Is there a virus about that can do this? Or has someone hacked into my PC? I have VNC on my pc but it has a password.
All very imbarrassing as my father in law was sitting next to me when I booted the PC up and I did not notice the MSN messanger username till after a few hours with people who I know including my Mother seeing the username.

Any ideas

Jeremy

mike1210

are you sure someone isn't pi**ing about here like a younger brother or the like, does your login account have a password?

jpor

iTrader: (1)

Sounds like someone got drunk and decided to have a laugh, that's back firing.

Jer

Unless my father in law has a very sick sence of humour which I doubt as he's not like that. No other person has had access to my laptop I live with my wife and three year old kid so no one could.
I have just looked through the history of IE and there is a website called www.pillock.net/update.exe with an exe file. After my holiday It went to do Microsoft updates I may have run this by mistake from a massked URL but don't think so. I did a scan on the file but it's not comming up as a virus.

jpor

iTrader: (1)

Do you by chance run you're Internet connection via Wireless router?

mike1210

also i just downloaded that file scanned it and no virus found, im not going to open it but may be a practical joke type thing, or as jpor just said a intruter perhaps? Ill give that file to someone in work tomorrow

Jer

No

jpor

iTrader: (1)

Have you had a look at the 'Event Viewer'? Thats if you're running Win NT,2K or XP.

mike1210

in that case how do you connect to the net? do you use a firewall and anti-virus?

Jer

Running Windows 2000 pro with Norton. I have also done an online scan and had no virus found. Can't see anything in event log.

Frosty The Snowman

Sounds like they have just hacked your MSN account rather than your computer, although it is worrying how they got your login details.

You haven't had any emails asking you to change them recently have you?

mike1210

yeah id change your password as well as a precaution, also when you say desktop background, i assume you mean the msn picture???

Jer

No, the photo on my desktop (background photo).

Frosty The Snowman

Sorry I had misread that, just thought it had affected MSN. I would try a different anti-virus company, try the Mcafee online scan perhaps.

Do you use your admin account to login? Change any passwords asap and check to see if any new user accounts have been created.

Definitely sounds like a virus though so hopefully you haven't got someone logging in.

leonpoole

Sounds like a trojan to me. Programs like netdevil and subseven allow you to do those type of things

mike1210

yes the vnc port may be open for anyone to connect to and maybe someone by chance has found your machine and had a bit of "fun". The fact that the desktop background has changed should mean it was more than just an msn hack

jpor

iTrader: (1)

Is that just Norton Anti virus? If so what do you use as a firewall? Do you keep the Anti virus updated?
If no firewall, and you have VNC, then it would be easy to hack you're PC.

It maybe worth having a look at the sticky on this forum for guidance:

http://bbs.scoobynet.co.uk/showthread.php?t=417111

Kieran_Burns

iTrader: (1)

VNC passwords on the free version only read the first 8 characters so they are not as secure as you would think. Plus VNC is a known port, (5800 & 5900) and running .exe files without knowing what they do is just daft (sorry for being blunt here)

Run msconfig and see what is lurking in your startup anything you are sure about post up here

Oh, I could write a batch file called runme.bat that would have one line in: format c: it would NOT be a virus but it would sure as hell cause you some grief! (a simplistic example, but I hope it makes the point)

Don't think virus any more - think MALWARE.

Someone has either got local or remote access to your p.c. and is playing silly sods (so far)

Check your user accounts and disable EVERY account except your own and your wifes. (including guest)
Check that terminal services / remote support has not been installed / switched on
Change every damn password going
Pray you haven't done online banking and left your passwords cached....