Help & FAQs    Search BCF    Members    Groups    Events Calendar
Resend my activation email : Register : Log in 
BCF: Bike Chat Forums


WTF was this?

 Reply to topic
Bike Chat Forums Index -> The Geek Zone Goto page 1, 2  Next
View previous topic : View next topic  
Author Message

SlimRick
World Chat Champion



Joined: 29 Sep 2008
Karma :
PostPosted: 11:55 - 05 Aug 2010    Post subject: WTF was this? Reply with quote
Chap at work was sat typing an email - odd characters and letters started appearing on his screen as he was typing. He took his hands off the keyboard and the following appeared:

Quote:
As I couldn’t OT in the assisted in ending a known in the usual event of a Ainè Inouye windows. When a woman who This ain’t a visiting is betting millions” as the rise in any event as either images then the end of the zoo’s there’s only limited and then as vice foreigncities and states by Valere of Yankees is invalid and and cheeses and yet it is given Dole’s the man then moving with no soon both Molen HEUVEL event is planning his van In the period have this escapes plays it shows although the latest move uses of the series of the benefit of things his high in the in the bay area a half an hour hang ankle Galeanoder made an enhanced vision is James Keighley with visa who wouldn’t use ofstudying this business of this is taking and the million women moment cheeses was losing issue since the two-She plays it is some zones of those whose lives delete from and to oh oh is that it owes a visit was going though he’s amazing is which is to the investor who is visiting the defense was that he then his Cisco’s who’s losing his visit his hehe basis is who’s using his visits his he basis his own using visits that can happen in the have a new message to the OSAA said a survey Elvan Elvan Elvan going to give a long way that Cheney’s James vitamin a is lawyers Gemma is a Zulu high a village is delivered yet loses in the young these those thing is Benzi may be out of aluminium legion of thing he won by this is live from an end and I’ve got a summit is a zero Z. But I think you his home town and she is the civilians sensitivities of the season and delete of some of the businesses in the is relevant to the human genome time Elissa Hannele is and was lying to defeat leading to some of this can Ruan he’s a visit from one done on a television is a senior the account trying to highly of other things that then begin mobilizing existence Vito is headed things think of a sign of the U.S.


It came up one letter at a time, as if it was being typed. Spelling mistakes got deleted then corrected, it was exactly as if someone else was typing this.
No strange processes running on his machine. Trend AV running and up to date, did a full system scan and came up with nothing. Ran Malwarebytes anti-malware and it's come up with nothing.

Any suggestions?
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

Paxovasa
World Chat Champion



Joined: 25 Apr 2010
Karma :
PostPosted: 11:58 - 05 Aug 2010    Post subject: Reply with quote
Someone gained remote access to his station Thumbs Up
____________________
Suzuki GSF600 K3 (in the fastest colour, black).
 Back to top
View user's profile Send private message You must be logged in to rate posts

The Shaggy D.A.
Super Spammer



Joined: 12 Sep 2008
Karma :
PostPosted: 12:15 - 05 Aug 2010    Post subject: Reply with quote
https://www.mediabistro.com/fishbowlLA/original/poltergeist.gif
____________________
Chances are quite high you are not in my Monkeysphere, and I don't care about you. Don't take it personally.
Currently : Royal Enfield 350 Meteor
Previously : CB100N > CB250RS > XJ900F > GT550 > GPZ750R/1000RX > AJS M16 > R100RT > Bullet 500 > CB500 > LS650P > Bullet Electra X & YBR125 > Bullet 350 "Superstar" & YBR125 Custom > Royal Enfield Classic 500 Despatch Limited Edition (28 of 200) & CB Two-Fifty Nighthawk > ER5
 Back to top
View user's profile Send private message You must be logged in to rate posts

SlimRick
World Chat Champion



Joined: 29 Sep 2008
Karma :
PostPosted: 12:17 - 05 Aug 2010    Post subject: Reply with quote
Paxovasa wrote:
Someone gained remote access to his station Thumbs Up


That was my first thought, but there were no visible processes running that would indicate that. It would also mean they would've got to it through our corporate firewall, and windows firewall on the laptop.
I've a feeling it's more likely to be some sort of malware on the machine itself as the people's names are familiar to the user and may have been text trawled from Outlook.
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

SlimRick
World Chat Champion



Joined: 29 Sep 2008
Karma :
PostPosted: 12:18 - 05 Aug 2010    Post subject: Reply with quote
The Shaggy D.A. wrote:
https://www.mediabistro.com/fishbowlLA/original/poltergeist.gif



Confirmed my suspicions - I'll let him know and escort him and his "associates" off-site.
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

TQ
Trackday Trickster



Joined: 17 Dec 2009
Karma :
PostPosted: 12:20 - 05 Aug 2010    Post subject: Reply with quote
If it happens again pull the network connection.

If it keeps going you know it's on the machine itself.
____________________
First Bike :Gilera DNA 50 | Second: Imported 1989 NSR125
Third: 1998 Yamaha XJ600N | Currently: 1999 Yamaha FZS600
 Back to top
View user's profile Send private message You must be logged in to rate posts

WishayKillie
World Chat Champion



Joined: 15 Mar 2005
Karma :
PostPosted: 12:22 - 05 Aug 2010    Post subject: Reply with quote
https://4.bp.blogspot.com/_BjW1avGcuos/S5p86n9R0QI/AAAAAAAAB2U/OA1EPQKAys8/s640/redblue_pill.jpg
____________________
Current; 10' Aprilia Dorsoduro 750.
Previous; 05 Triumph Daytona 600, 08' Ducati 1098s.
"Needs a check-up, fae the neck up!"
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

Paxovasa
World Chat Champion



Joined: 25 Apr 2010
Karma :
PostPosted: 12:23 - 05 Aug 2010    Post subject: Reply with quote
Someone in your IT department can use remote access, all they need is the computer number and through the network they can take control Thumbs Up
____________________
Suzuki GSF600 K3 (in the fastest colour, black).
 Back to top
View user's profile Send private message You must be logged in to rate posts

SlimRick
World Chat Champion



Joined: 29 Sep 2008
Karma :
PostPosted: 12:23 - 05 Aug 2010    Post subject: Reply with quote
Paxovasa wrote:
Someone in your IT department can use remote access, all they need is the computer number and through the network they can take control Thumbs Up


I am the IT department Embarassed
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

Paxovasa
World Chat Champion



Joined: 25 Apr 2010
Karma :
PostPosted: 12:26 - 05 Aug 2010    Post subject: Reply with quote
In that case you are fucked Wink

I suggest you unplug everything and get the hell out of there Very Happy
____________________
Suzuki GSF600 K3 (in the fastest colour, black).
 Back to top
View user's profile Send private message You must be logged in to rate posts

bazza
World Chat Champion



Joined: 27 Aug 2004
Karma :
PostPosted: 12:33 - 05 Aug 2010    Post subject: Reply with quote
SlimRick wrote:
I am the IT department Embarassed


In which case, check with the local council planning department to see if your workplace is built on top of:

a. An ancient indian burial ground.

b. A cemetery.

c. A mass grave.

d. Some or more of the above.
____________________
"That's it. You people have stood in my way long enough. I'm going to clown college."
'98 Ducati 750SS, '08 Suzuki GSX650F ©2004-2014, Bazza's Harmless Banter
 Back to top
View user's profile Send private message You must be logged in to rate posts

SlimRick
World Chat Champion



Joined: 29 Sep 2008
Karma :
PostPosted: 12:46 - 05 Aug 2010    Post subject: Reply with quote
The Shaggy D.A. wrote:
https://www.mediabistro.com/fishbowlLA/original/poltergeist.gif


That will now be his background wallpaper next time he reboots. Very Happy
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

ws4936
World Chat Champion



Joined: 10 Sep 2009
Karma :
PostPosted: 00:45 - 06 Aug 2010    Post subject: Reply with quote
"Have you tried switching it off and back on again"?
____________________
If everything seems under control, you're just not going fast enough.
 Back to top
View user's profile Send private message You must be logged in to rate posts

Howling TerrorOutOfOffice
Super Spammer



Joined: 05 Dec 2008
Karma :
PostPosted: 01:01 - 06 Aug 2010    Post subject: Reply with quote
Hi

Check the head bearings for any excessive play.

All the best

KeithPat
____________________
Diabolical homemade music Bandcamp and Soundcloud
Singer songwriter, Artist and allround good bloke Listen to Andrew Susan Johnston here
The Harry Turner Project

Last edited by Howling TerrorOutOfOffice on 01:11 - 06 Aug 2010; edited 1 time in total
 Back to top
View user's profile Send private message Visit poster's website You must be logged in to rate posts
FURBAR This post is not being displayed because the poster is banned. Unhide this post / all posts.

Ste
Not Work Safe



Joined: 01 Sep 2002
Karma :
PostPosted: 01:09 - 06 Aug 2010    Post subject: Re: WTF was this? Reply with quote
SlimRick wrote:
Any suggestions?

Their bank account is now empty. Thumbs Up
 Back to top
View user's profile Send private message Visit poster's website You must be logged in to rate posts
FURBAR This post is not being displayed because the poster is banned. Unhide this post / all posts.

killa
Won't Shut Up



Joined: 18 Oct 2004
Karma :
PostPosted: 08:49 - 06 Aug 2010    Post subject: Reply with quote
If it’s a set virus that got in at some point then paste some if not all of that writing in google. If it is the same every time, it will come up with a page about it.
____________________
Cleverly disguised as a responsible adult.
Bike:- Yamaha TRX850 | Killas Biking History | Killas Gaming History | Killas autmotive history
 Back to top
View user's profile Send private message Send e-mail Visit poster's website You must be logged in to rate posts

TQ
Trackday Trickster



Joined: 17 Dec 2009
Karma :
PostPosted: 13:33 - 06 Aug 2010    Post subject: Reply with quote
killa wrote:
If it’s a set virus that got in at some point then paste some if not all of that writing in google. If it is the same every time, it will come up with a page about it.


That was the first thing I tried.

Only thing that comes up is this thread!

Did you try what I suggested or has it not happened again?
____________________
First Bike :Gilera DNA 50 | Second: Imported 1989 NSR125
Third: 1998 Yamaha XJ600N | Currently: 1999 Yamaha FZS600
 Back to top
View user's profile Send private message You must be logged in to rate posts

Sparks!
Sir Tart-a-lot



Joined: 30 Aug 2003
Karma :
PostPosted: 14:23 - 06 Aug 2010    Post subject: Reply with quote
SlimRick wrote:
Paxovasa wrote:
Someone in your IT department can use remote access, all they need is the computer number and through the network they can take control Thumbs Up


I am the IT department Embarassed


Have you turned it off then on again? Laughing
____________________
Current Toys: 06 Yamaha WR250F | Nissan 350Z GT | Tech 4 Homes
 Back to top
View user's profile Send private message Visit poster's website You must be logged in to rate posts

bEN_
World Chat Champion



Joined: 17 Dec 2005
Karma :
PostPosted: 14:26 - 06 Aug 2010    Post subject: Reply with quote
I've heard of this before, there is a chap who made a video about it and has a solution but it doesn't always work

https://www.youtube.com/watch?v=aDHPCr5m4ko
____________________
2010 Ducati 848 Dark

Lamp Post Enthusiast
 Back to top
View user's profile Send private message You must be logged in to rate posts

SlimRick
World Chat Champion



Joined: 29 Sep 2008
Karma :
PostPosted: 22:12 - 06 Aug 2010    Post subject: Reply with quote
TQ wrote:


Did you try what I suggested or has it not happened again?


Pulled the network and it stopped right away. Not happened since, and the text seems completely random.
 Back to top
View user's profile Send private message Send e-mail You must be logged in to rate posts

iooi
Super Spammer



Joined: 14 Jan 2007
Karma :
PostPosted: 08:01 - 07 Aug 2010    Post subject: Reply with quote
SlimRick wrote:
Paxovasa wrote:
Someone in your IT department can use remote access, all they need is the computer number and through the network they can take control Thumbs Up


I am the IT department Embarassed


Then you have someone in the building who thinks THEY should be the IT department, as they know more than you do Laughing
____________________
Just because my bike was A DIVVY, does not mean i am......
 Back to top
View user's profile Send private message You must be logged in to rate posts

Robby
Dirty Old Man



Joined: 16 May 2002
Karma :
PostPosted: 12:44 - 07 Aug 2010    Post subject: Reply with quote
You have a vulnerability. Fix it.

If you can't fix it, you shouldn't be the IT guy.

If you don't run individual firewalls on the machine along with the corporate one and a web content filtering service, get them on there.

I assume access to the C drive is locked down and all that jazz.
 Back to top
View user's profile Send private message You must be logged in to rate posts

TQ
Trackday Trickster



Joined: 17 Dec 2009
Karma :
PostPosted: 14:31 - 07 Aug 2010    Post subject: Reply with quote
Get Wireshark on the PC and monitor the network traffic while it's happening to determine which port is being used. Then run netstat -abnv to work out what process is listening on that port.
____________________
First Bike :Gilera DNA 50 | Second: Imported 1989 NSR125
Third: 1998 Yamaha XJ600N | Currently: 1999 Yamaha FZS600
 Back to top
View user's profile Send private message You must be logged in to rate posts
Old Thread Alert!

The last post was made 16 years, 29 days ago. Instead of replying here, would creating a new thread be more useful?
  Display posts from previous:   
This page may contain affiliate links, which means we may earn a small commission if a visitor clicks through and makes a purchase. By clicking on an affiliate link, you accept that third-party cookies will be set.

Post new topic   Reply to topic    Bike Chat Forums Index -> The Geek Zone All times are GMT + 1 Hour
Goto page 1, 2  Next
Page 1 of 2

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum

Read the Terms of Use! - Powered by phpBB © phpBB Group
 
Debug Mode: ON - Server: birks (www) - Page Generation Time: 0.13 Sec - Server Load: 0.67 - MySQL Queries: 13 - Page Size: 130.12 Kb