Outlook Express

totonho03 · #1 08-10-2003, 05:42 PM

Hello all:
Something very weird happened yesterday morning. I was checking my e-mails, via Outlook Express, and then after rebooting the system, I noticed that a large portion of my input file -all of 2003 aqnd portion of 2002-, was missing. I tried scanreg /restore, but id did not help. To the best of my recollection, I did not do anything out of the ordinary...........
Has this happened to any of you?

Thaks and regards

Totonho03

P.S.- The virus scanner is telling me that I do not have viruses in the computer? But I will do a scan again soon.

kwag · #2 08-10-2003, 05:52 PM

Hi totonho03,

I don't use Norton or McAffee. I use AVG Anti Virus, which has caught some viruses on my machine, that neither Norton nor McAfee were able to detect. You can get a free "Personal" version here: http://www.grisoft.com/

-kwag

vhelp · #3 08-10-2003, 06:02 PM

Hi totonho,

I know how you feel.. pfew!!

Anyways, I had a rathre strange experience yesterday. But, that was be
cause I was surfing places I could not seem to get out of

you know..
all those explosive windows that pop up - - you know what I mean, anyways..
While I was surfing around, I noticed a message popped up, (cause I wasn't
looking, too busy w/ CQM and stuff in the background) and I was this strange
message saying that it was

INSTALLING

something w/out my giving
it permission to. Hmmm... wonder how it took control of my PC anyways ??

I thought nothing of it, till my system crashed some time afterwards.

Well, after reloging on, and surfing around for another 1/2 hour, I decided
to take a nap. Came back after about an hour later. Well, guess what I
saw

something sifting through my pc, cause my modem light was blinking
and my hd light was going on for a while.. and kept doing so for a while,
and would not stop. I figure something or someone was sifing info from
my system.. yeah, I know.. at 56k modem, these people could care less
how fast or slow you setup is. If they want something or want to snoop,
they'll do it very faceciasly (spelling) Anyways..

So, I close down all my browsers and even email. Well, my modem light
and my hd light were still at it. What the hell attached itself to me ?? I asked
myself.. anyways, I finally shut down the whole pc.

I then proceded to ad-ware and went through my system, and yes, it found
a bunch of apps and giblets attahced to my hd, grrr. So, I made sure that
they were all wiped.

I now feel better, and haven't yet to see any wierd or strange activities from
any of my devices. So, my guess is that ad-ware did it's thing this time
around

-vhelp

jorel · #4 08-10-2003, 06:15 PM

@ Kwag
thanks for the avg link friend,i don't knew it!

@ vhelp
sometimes my modem lights blink like a "ufo"
without any reason!

just the same here my friend.
it's Micro$oft?

@ Otto
do like me my friend:
i create in each 3 days one "ghost image" of my system
in one external hd....if the system crash or "something strange"
happen, i back the system again!
i wrote a simple command line in portuguese forum to use it.
works for me from 2 years!
take a read there,you read and write very clear portuguese!

totonho03 · #5 08-10-2003, 07:53 PM

Thank you guys:

Kwag: I will give your antivirus a try. I am using sophos.......and it tells me that I am clean.

vhelp: I do have adware and use regularly. It cleans a lot of cookies. I have not seen what you are talking about, no modem running like crazy, howeverit will be difficult for me to see, I have one of those cabler modems, and the ligths at the cable modem are constantly on and off. Come to think of it, I do vaguely remember that when I was trying to open outlook, it was telling me that there was a version of outlook express running. However, I did not see any lights, not that I rememeber or checked.

jorel:
I will open up the portuguesse forum and check for it. I have never created ghosts backups, Is this what you have? I should become familiar doing it...........How much hardrive capacity do you need? I have a 120 Giga external drive that I can perhaps use it for it...

Thanks a lot folks

Otto

kwag · #6 08-10-2003, 08:14 PM

If you see your modem lights blinking, and you are not doing any internet activity, most likely is you are being "Port Scanned" from jack ass crackers trying to get in your machine. Look at my intrusion detection system log

Code:

Log:
Date:
08/10 02:47:15
Name:
MS-SQL Worm propagation attempt
Priority:
2
Type:
Misc Attack
IP info:
202.108.249.21:1047 -> 192.168.1.2:1434
Date:
08/10 12:09:03
Name:
MS-SQL Worm propagation attempt
Priority:
2
Type:
Misc Attack
IP info:
68.45.130.183:1643 -> 192.168.1.2:1434
Date:
08/10 12:42:49
Name:
MS-SQL Worm propagation attempt
Priority:
2
Type:
Misc Attack
IP info:
209.178.172.27:1178 -> 192.168.1.2:1434
Date:
08/10 18:42:36
Name:
MS-SQL Worm propagation attempt
Priority:
2
Type:
Misc Attack
IP info:
202.163.125.59:4812 -> 192.168.1.2:1434

And now look at the "Firewall" Log

Code:

Firewall log. Sorry it doesn't look very straight, because it's a copy&paste from htmp page. But this should give you an idea of what goes on at your public IP side. 

Time
In
Out
Proto
Source
Src Port
Destination
Dst Port
05:38:24
eth1
-
TCP

66.50.65.96
1221

192.168.1.2
445
06:01:58
eth1
-
UDP

211.215.114.95
1027

192.168.1.2
137(NETBIOS-NS)
06:12:29
eth1
-
TCP

66.50.158.21
19591

192.168.1.2
445
06:20:38
eth1
-
UDP

200.45.141.100
1026

192.168.1.2
137(NETBIOS-NS)
06:46:26
eth1
-
TCP

66.50.16.161
21776

192.168.1.2
27374
06:46:29
eth1
-
TCP

66.50.16.161
21776

192.168.1.2
27374
07:00:51
eth1
-
TCP

211.104.181.242
4793

192.168.1.2
21(FTP)
07:00:54
eth1
-
TCP

211.104.181.242
4793

192.168.1.2
21(FTP)
07:10:25
eth1
-
UDP

218.63.102.234
1028

192.168.1.2
137(NETBIOS-NS)
07:27:38
eth1
-
TCP

66.50.229.106
50488

192.168.1.2
445
08:01:03
eth1
-
TCP

216.47.138.41
3143

192.168.1.2
6667
08:05:32
eth1
-
UDP

66.81.188.114
1028

192.168.1.2
137(NETBIOS-NS)
08:12:56
eth1
-
TCP

61.138.113.2
4851

192.168.1.2
111(SUNRPC)
08:33:38
eth1
-
TCP

218.150.166.123
52029

192.168.1.2
443(HTTPS)
08:33:41
eth1
-
TCP

218.150.166.123
52029

192.168.1.2
443(HTTPS)
08:33:47
eth1
-
TCP

218.150.166.123
52029

192.168.1.2
443(HTTPS)
08:36:50
eth1
-
UDP

66.50.89.80
5881

192.168.1.2
5882
08:56:14
eth1
-
TCP

148.223.114.98
12579

192.168.1.2
1433
08:56:17
eth1
-
TCP

148.223.114.98
12579

192.168.1.2
1433
09:06:00
eth1
-
TCP

66.50.174.82
2342

192.168.1.2
27374
09:30:51
eth1
-
UDP

61.220.40.7
1028

192.168.1.2
137(NETBIOS-NS)
09:47:08
eth1
-
TCP

66.50.65.6
3046

192.168.1.2
445
09:47:11
eth1
-
TCP

66.50.65.6
3046

192.168.1.2
445
10:09:58
eth1
-
TCP

66.50.65.6
4038

192.168.1.2
445
10:10:01
eth1
-
TCP

66.50.65.6
4038

192.168.1.2
445
10:17:04
eth1
-
TCP

68.113.120.33
1367

192.168.1.2
27374
10:19:38
eth1
-
TCP

66.50.92.109
3701

192.168.1.2
27374
10:19:41
eth1
-
TCP

66.50.92.109
3701

192.168.1.2
27374
10:38:22
eth1
-
UDP

218.104.41.126
52286

192.168.1.2
137(NETBIOS-NS)
10:48:47
eth1
-
TCP

66.50.56.103
4554

192.168.1.2
445
10:48:50
eth1
-
TCP

66.50.56.103
4554

192.168.1.2
445
10:50:23
eth1
-
UDP

218.70.52.196
1030

192.168.1.2
137(NETBIOS-NS)
11:00:33
eth1
-
TCP

66.41.30.73
4258

192.168.1.2
135
11:00:36
eth1
-
TCP

66.41.30.73
4258

192.168.1.2
135
11:00:42
eth1
-
TCP

66.41.30.73
4258

192.168.1.2
135
11:06:47
eth1
-
TCP

210.21.115.70
37894

192.168.1.2
21(FTP)
11:06:50
eth1
-
TCP

210.21.115.70
37894

192.168.1.2
21(FTP)
11:06:56
eth1
-
TCP

210.21.115.70
37894

192.168.1.2
21(FTP)
11:07:08
eth1
-
TCP

210.21.115.70
37894

192.168.1.2
21(FTP)
11:36:10
eth1
-
TCP

195.67.69.142
1377

192.168.1.2
80(WWW)
11:55:53
eth1
-
TCP

218.233.88.18
2484

192.168.1.2
139(NETBIOS-SSN)
11:55:56
eth1
-
TCP

218.233.88.18
2484

192.168.1.2
139(NETBIOS-SSN)
11:56:02
eth1
-
TCP

218.233.88.18
2484

192.168.1.2
139(NETBIOS-SSN)
11:59:32
eth1
-
UDP

66.156.210.94
1026

192.168.1.2
137(NETBIOS-NS)
12:06:26
eth1
-
UDP

210.202.224.35
1027

192.168.1.2
137(NETBIOS-NS)
12:09:03
eth1
-
UDP

68.45.130.183
1643

192.168.1.2
1434
12:19:00
eth1
-
TCP

65.100.231.34
80(WWW)

192.168.1.2
1000
12:42:49
eth1
-
UDP

209.178.172.27
1178

192.168.1.2
1434
13:05:26
eth1
-
UDP

195.174.69.225
1025

192.168.1.2
137(NETBIOS-NS)
13:09:34
eth1
-
UDP

199.222.160.66
1028

192.168.1.2
137(NETBIOS-NS)
13:28:14
eth1
-
UDP

61.1.186.227
1030

192.168.1.2
137(NETBIOS-NS)
13:49:54
eth1
-
UDP

213.123.200.88
34524

192.168.1.2
137(NETBIOS-NS)
13:50:35
eth1
-
TCP

65.100.231.34
80(WWW)

192.168.1.2
1000
14:13:05
eth1
-
UDP

68.73.68.140
43973

192.168.1.2
137(NETBIOS-NS)
14:31:35
eth1
-
TCP

66.50.21.97
4747

192.168.1.2
445
14:31:38
eth1
-
TCP

66.50.21.97
4747

192.168.1.2
445
14:37:27
eth1
-
UDP

66.14.178.161
1037

192.168.1.2
137(NETBIOS-NS)
14:48:45
eth1
-
TCP

65.100.231.32
53(DOMAIN)

192.168.1.2
1984
14:48:49
eth1
-
TCP

65.100.231.32
53(DOMAIN)

192.168.1.2
1984
14:48:56
eth1
-
TCP

65.100.231.32
53(DOMAIN)

192.168.1.2
1984
14:49:08
eth1
-
TCP

65.100.231.32
53(DOMAIN)

192.168.1.2
1984
14:49:33
eth1
-
TCP

65.100.231.32
53(DOMAIN)

192.168.1.2
1984
14:51:39
eth1
-
TCP

219.141.60.130
3391

192.168.1.2
111(SUNRPC)
14:51:42
eth1
-
TCP

219.141.60.130
3391

192.168.1.2
111(SUNRPC)
14:53:32
eth1
-
UDP

217.161.65.46
1031

192.168.1.2
137(NETBIOS-NS)
15:29:54
eth1
-
TCP

202.26.248.69
1784

192.168.1.2
21(FTP)
15:29:57
eth1
-
TCP

202.26.248.69
1784

192.168.1.2
21(FTP)
15:51:16
eth1
-
TCP

80.181.240.113
33372

192.168.1.2
21(FTP)
16:04:05
eth1
-
TCP

67.125.134.74
4484

192.168.1.2
17300
16:47:00
eth1
-
TCP

68.37.79.117
4723

192.168.1.2
135
16:47:03
eth1
-
TCP

68.37.79.117
4723

192.168.1.2
135
16:47:09
eth1
-
TCP

68.37.79.117
4723

192.168.1.2
135
16:51:52
eth1
-
UDP

200.175.197.32
1025

192.168.1.2
137(NETBIOS-NS)
16:55:17
eth1
-
TCP

65.30.187.45
4981

192.168.1.2
31320
16:55:20
eth1
-
TCP

65.30.187.45
4981

192.168.1.2
31320
16:55:26
eth1
-
TCP

65.30.187.45
4981

192.168.1.2
31320
16:55:42
eth1
-
TCP

65.30.187.45
4981

192.168.1.2
31320
17:25:17
eth1
-
UDP

210.144.187.175
1025

192.168.1.2
137(NETBIOS-NS)
17:54:46
eth1
-
TCP

66.50.234.56
50765

192.168.1.2
445
17:54:49
eth1
-
TCP

66.50.234.56
50765

192.168.1.2
445
18:23:01
eth1
-
UDP

145.254.222.57
1026

192.168.1.2
137(NETBIOS-NS)
18:24:05
eth1
-
TCP

199.89.199.36
80(WWW)

192.168.1.2
13936
18:33:03
eth1
-
TCP

66.50.234.56
50657

192.168.1.2
445
18:33:06
eth1
-
TCP

66.50.234.56
50657

192.168.1.2
445
19:13:30
eth1
-
TCP

66.50.56.84
3667

192.168.1.2
445
19:13:33
eth1
-
TCP

66.50.56.84
3667

192.168.1.2
445
19:16:27
eth1
-
UDP

81.192.152.78
1032

192.168.1.2
137(NETBIOS-NS)
20:09:31
eth1
-
TCP

66.50.21.92
4049

192.168.1.2
445
20:09:34
eth1
-
TCP

66.50.21.92
4049

192.168.1.2
445
20:30:58
eth1
-
UDP

211.161.172.52
5188

192.168.1.2
135
20:32:57
eth1
-
UDP

207.30.163.234
26722

192.168.1.2
137(NETBIOS-NS)
20:53:45
eth1
-
TCP

66.50.115.74
2286

192.168.1.2
445
20:53:48
eth1
-
TCP

66.50.115.74
2286

192.168.1.2
445
20:54:05
eth1
-
TCP

66.50.56.22
1754

192.168.1.2
80(WWW)
20:54:08
eth1
-
TCP

66.50.56.22
1754

192.168.1.2
80(WWW)
20:56:57
eth1
-
TCP

66.50.115.74
3015

192.168.1.2
445
20:57:00
eth1
-
TCP

66.50.115.74
3015

192.168.1.2
445
21:11:02
eth1
-
UDP

212.55.188.66
1026

192.168.1.2
137(NETBIOS-NS)
21:42:06
eth1
-
TCP

209.79.177.171
80(WWW)

192.168.1.2
14425
21:42:09
eth1
-
TCP

209.79.177.171
80(WWW)

192.168.1.2
14426
21:44:48
eth1
-
UDP

66.50.89.154
5881

192.168.1.2
5882
22:05:59
eth1
-
TCP

210.230.206.211
41947

192.168.1.2
443(HTTPS)
22:06:02
eth1
-
TCP

210.230.206.211
41947

192.168.1.2
443(HTTPS)
22:30:35
eth1
-
UDP

61.129.75.231
1495

192.168.1.2
135
22:50:47
eth1
-
TCP

66.50.102.126
1563

192.168.1.2
445
22:50:50
eth1
-
TCP

66.50.102.126
1563

192.168.1.2
445
23:01:42
eth1
-
UDP

64.163.30.185
3708

192.168.1.2
137(NETBIOS-NS)
23:15:11
eth1
-
UDP

200.165.30.127
1026

192.168.1.2
137(NETBIOS-NS)
23:31:42
eth1
-
UDP

81.135.121.167
1026

192.168.1.2
137(NETBIOS-NS)
23:33:31
eth1
-
TCP

66.50.115.142
1317

192.168.1.2
445
23:33:34
eth1
-
TCP

66.50.115.142
1317

192.168.1.2
445
23:57:37
eth1
-
TCP

66.50.115.142
1696

192.168.1.2
445
16:58:56
eth1
-
TCP

152.2.210.109
53081

192.168.1.2
14918
17:06:26
eth1
-
TCP

217.96.191.78
4084

192.168.1.2
443(HTTPS)
17:06:29
eth1
-
TCP

217.96.191.78
4084

192.168.1.2
443(HTTPS)
17:08:35
eth1
-
TCP

209.11.84.157
80(WWW)

192.168.1.2
15263
17:23:43
eth1
-
TCP

211.22.200.242
3189

192.168.1.2
515(PRINTER)
17:57:28
eth1
-
UDP

148.240.106.8
1027

192.168.1.2
137(NETBIOS-NS)
18:04:18
eth1
-
TCP

66.50.234.56
50332

192.168.1.2
445
18:09:25
eth1
-
TCP

67.30.100.123
2231

192.168.1.2
27374
18:22:58
eth1
-
UDP

24.107.97.1
25187

192.168.1.2
137(NETBIOS-NS)
18:23:06
eth1
-
TCP

203.194.209.177
21(FTP)

192.168.1.2
2056
18:24:55
eth1
-
TCP

203.194.209.177
80(WWW)

192.168.1.2
15065
18:42:36
eth1
-
UDP

202.163.125.59
4812

192.168.1.2
1434
19:05:21
eth1
-
UDP

66.50.94.61
31790

192.168.1.2
31789
19:23:04
eth1
-
UDP

207.61.124.27
2275

192.168.1.2
137(NETBIOS-NS)
19:52:38
eth1
-
TCP

217.170.18.4
80(WWW)

192.168.1.2
15297
19:52:46
eth1
-
TCP

217.170.18.4
80(WWW)

192.168.1.2
15299
19:52:58
eth1
-
UDP

65.54.240.61
7001

192.168.1.2
4849
19:52:59
eth1
-
UDP

65.54.240.61
7001

192.168.1.2
4849
19:53:00
eth1
-
UDP

65.54.240.61
7001

192.168.1.2
4849
19:53:01
eth0
eth1
ICMP

10.0.0.51
7001

65.54.240.61
4849
19:59:02
eth1
-
TCP

67.98.25.16
2465

192.168.1.2
1433
19:59:05
eth1
-
TCP

67.98.25.16
2465

192.168.1.2
1433
20:00:24
eth1
-
TCP

24.58.250.151
2375

192.168.1.2
135
20:00:26
eth1
-
TCP

24.58.250.151
2375

192.168.1.2
135
20:00:32
eth1
-
TCP

24.58.250.151
2375

192.168.1.2
135
20:03:20
eth1
-
TCP

24.242.252.68
4867

192.168.1.2
135
20:18:21
eth1
-
TCP

65.33.140.108
2636

192.168.1.2
135
20:18:38
eth1
-
TCP

65.33.224.152
3084

192.168.1.2
135
20:24:33
eth1
-
TCP

66.78.3.6
52429

192.168.1.2
443(HTTPS)
20:24:39
eth1
-
TCP

66.78.3.6
52429

192.168.1.2
443(HTTPS)
20:32:07
eth1
-
TCP

211.78.51.249
3013

192.168.1.2
443(HTTPS)
20:32:10
eth1
-
TCP

211.78.51.249
3013

192.168.1.2
443(HTTPS)
20:32:15
eth1
-
TCP

211.78.51.249
3013

192.168.1.2
443(HTTPS)
20:54:55
eth1
-
UDP

202.107.202.118
1026

192.168.1.2
137(NETBIOS-NS)
20:58:21
eth1
-
TCP

80.137.255.122
2016

192.168.1.2
80(WWW)
20:58:25
eth1
-
TCP

80.137.255.122
2016

192.168.1.2
80(WWW)
20:58:31
eth1
-
TCP

80.137.255.122
2016

192.168.1.2
80(WWW)
20:58:52
eth1
-
UDP

24.77.102.102
1034

192.168.1.2
137(NETBIOS-NS)

That's just today

And note, that my public IP address is not published at all

This is not the KVCD.Net log. This is my home PC ADSL line, which is HIGHLY protected, currently by a Linux based firewall

-kwag

jorel · #7 08-10-2003, 08:17 PM

120 gig external drive Otto?
is too big.

example sizes of my ghost images and systems:
2k - 753mb
XP - 1,19gb
ME - 839mb
98se 556mb
they all have the same programs running,
just little differences for each case(versions,etc)

i did image of 98se a few hours ago and have
1,20gb in drive c: ,the image of this drive have

556mb

was used the command line posted in portuguese forum,
that was adjusted for MAX compression.
is faster,no more than 5 minutes to do the image(athlon xp2000+)
and 3 minutes to restore the system.
and the best:
don't need to format the partition when you restore it.
the c: will be clean automatic before the system is restored!

all details are there, any doubt, ask me!

@ Kwag:

what is this my friend?!?!?
the bigger post in the whole world!

totonho03 · #8 08-10-2003, 08:22 PM

Thanks kwag:

I have a Linksys cable/ dsl ethernet router, that to the best of my limited understanding, is sopposed to give me some sort of a firewall protection. I am going to try to learn a bit more about firewall protection and cable modems...........as well as to sstart encrypting my messages

Otto

kwag · #9 08-10-2003, 08:39 PM

Quote:

Originally Posted by totonho03

Thanks kwag:

I have a Linksys cable/ dsl ethernet router, that to the best of my limited understanding, is sopposed to give me some sort of a firewall protection. I am going to try to learn a bit more about firewall protection and cable modems...........as well as to sstart encrypting my messages

Otto

If you have an old PC laying around, download this

www.smoothwall.org

-kwag

totonho03 · #10 08-10-2003, 10:34 PM

Thanks kwag, I will work on this tomorrow.

Jorel: I have printed "cd de boot com ghost" and will read it later on today or tomorrow.

Thanks compadres

Totonho03

totonho03 · #11 08-11-2003, 04:49 PM

OK, Step #1 was accomplished. After being scared by discjuggler, its installation wizard took over the installation of avg, I finally installed the avg antivirus program. Actually it found 2 virus. One of them was Word related, and it was W97M/Mdma, and the other was an exe file hidden behind a file called Monalisa.jpg. (Both files are now gone, finished, kaput.) Funny, both files were downloaded last year, when I was working in Brazil. (Do not mean anything with that Jorel and my other Brazilian friends, other than to state where I was when I picked up these files, it could have happened in Peru or Argentina, or.....)
Step # 2 is going to be the ghost image.....but I will do that tomorrow, I am tired of hunting viruses and problems. Now I will do what I wanted to do earlier today: burn the test kvcd +RW disc........Wish me luck.

Totonho03

jorel · #12 08-13-2003, 12:45 AM

Quote:

Originally Posted by kwag

Hi totonho03,

I don't use Norton or McAffee. I use AVG Anti Virus, which has caught some viruses on my machine, that neither Norton nor McAfee were able to detect. You can get a free "Personal" version here: http://www.grisoft.com/

-kwag

believe me:
yesterday i download and install the avg antivirus.
i never had used antivirus before cos i have ghost images.

the program search and don't find anything wrong
in mthe whole 60gb hd,in the boot....nothing!
then i think:
great,let stay.

but when i open the start page,the pages in d9 and others pages
that i go everyday.....

the fonts was encrease 4 times the size.....
everything was BIG!
the size of the pages,the fonts....everything giant!

i search and can't find what happen....

then i had to back my ghost image that i did yesterday
before i install the avg antivirus.
everything is ok again.
the only difference in the image back is the antivirus,nothing more.

:vamplaser: