Security Incidents mailing list archives

Hacked, Trojaned, and Strange Files.


From: MaZeN <mazinhio () INCO COM LB>
Date: Fri, 13 Oct 2000 07:58:31 +0200

Hi guys

Im not a security specialist, and im not sorry about my language cause its the best i can do.

ok, i have a win98 pc at home i installed BlackIce on it for a while, and during that time all the probe's that i 
encounterd was scans, someday i liked to try ZoneAlarm so i uninstalled BlackIce, installed ZoneAlarm, counfigure it 
ran it and this is what i found:

everytime and the minute i log into the internet i get my firewall blocking 216.53.*.* ,  169.132.184.* and 64.4.*.*  
from connecting to my computer on different udp and tcp ports and its not the same ports they try to connect to other 
ports when they get blocked, well i said its ok since they are getting blocked, but the strange thing is that when put 
the security settings LOW for a moment,  Blackice comes into play from nowhere and connect to the internet, then when i 
return my security settings to HIGH i get this message from ZoneAlarm ( Zone Alarm blocked internet access from your 
computer to 216.53.*.* or 64.4.*.*  port **** because of your security level your computer cannot send information to 
these address's  name: netbios program: blackd.exe ) so i assume im trojaned. could it be Blackice infected with some 
kind of trojan?, cause its not an original version.

 and thats not all,  i also found strange file names on my hard disk they are ( ____ ___.doc and ______ ___ _____.jpg) 
but they r not image files nor a document cause i tried to open them but nothing happens, i also tried to attach them 
to this email but i get the error messege " file not found " and i cant copy, rename, move, or delete them.

 I dont know what to do and how to send them to you so u can analyze them, anyway any comments or replys will be 
appreciated.
and 10x a lot on advance.

ps: if someone want blackice or blackd.exe to analyze please email me mazinhio () hotmail com 


Current thread: