🚀 go-pugleaf

Dear Ana-Julia,

You are a victim of a program called "Back Orifice," or "NetBus," which,
believe it or not, is a legitimate software application that was created to
allow system administrators to manage multiple servers across a Local or
Wide Area Network.  The organization that created this software is called
"The Cult of The Dead Cow," and they state openly that, though the software
was created for system administrators, it is easily abused by hackers all
over the world.  I personally think that the software was created for both
reasons (hacking and adminstrating).

The way NetBus works, once its installed, only a virus protection program
could remove it.  This is because it installs itself into your Windows
system and when you try to delete the program, Windows gives you a message
saying that it cannot delete it because its in use by the operating system.

You could have gotten this software on your computer in any number of ways:

1) Did you ever click "Yes" when a site asked if you wanted to install an
application that would enhance your use of their site?

2) Did you ever receive an email attachment from someone that was an
executable file but did not seem to work as anticipated when you tried to
run the file?

3) Did you ever download and install a free demo from an unknown source or
an unknown software company?

4) Did you ever download and install what someone said was a free version
of a commercial software application?

If you answered yes to any of the above questions, there is the distinct
possibility that this is how you installed the file.

Let me say this clearly; any person who does not have virus protection on
their computer is making a BIG mistake.  Virus protection software is cheap
and you can access all the upgrade files free through the Internet so that
you never have to worry about being caught by new viruses.  I have Norton
Antivirus and they had the upgrade to protect my computer from the Melissa
virus available on the Net just 2 days after it hit.  You need to get a
virus protection software program and you need to update your list of virus
files from that company on a monthly basis.  On the list we were discussing
analogies for the past few days; how about this analogy:

Not having virus protection software on your computer is like buying a
house in a troubled section of town and leaving all your doors and windows
open at night.

Everyone who is interested in protecting themselves from this program, and
others like it, should keep the following linked in your
Bookmarks/Favorites folder:

http://www.antionline.com/index.html

This site will give you all the information you need on how to identify and
 protect yourself from applications like NetBus.  I suggest
that everyone reads their report on how to find out if you already have
this program on your computer.

Hope this helps.

David Flanagan






"Ing. Ana Julia R. de Abad" <ajr@ECUA.NET.ec> on 12/02/99 10:52:05 AM

Please respond to "Ing. Ana Julia R. de Abad" <ajr@ECUA.NET.ec>



 To:      NETTRAIN@LISTSERV.ACSU.BUFFALO.EDU

 cc:      (bcc: David P Flanagan/ISS/HQ/FHLMC)



 Subject: Internet access time stealing







Hi,

I have been recently struck by the fact that my ISP access password
was somehow stolen.  The damage is extensive, to say the least (*12*
times my regular invoice, for the last 2 and a half months); so, no
room for embarrassment !

As an Internet trainer for the last 6 years, and a systems
professional for more years, a simplistic theory about the method used
to compromise my password was inadmissible.

So, I concentrated on looking for some malicious program in the
computer I use most often:  I found a program that was being launched
together with other legitimate programs every time the machine was
turned on; this program gives the computer it resides on, the ability
to "listen on a port" converting it into a server; from there, all
someone needs is a corresponding client program to access it while
being connected to the Internet, and read whatever file (passwords
included).  This is compatible with the fact that during the
compromised period, without knowing what was going on, I changed the
password, and within a few days, they were already utilizing the new
password to get free ISP time.  The system used is W98.  I am still
studying the case (access statistics, W98 patches, control measures
...).

In the meantime:

* Could the culprit have self-installed from downloaded files?
* How to detect it, without going paranoid and manually checking all
around, all the time ?
* Worst, who pays for it ?
* While it is true my ISP has implemented online password protected
Connect Time Statistics for all users, can one argue that their effort
has not been sufficient?.  Should my ISP implement controls such as?:

. Sending us monthly account statements
. Alerting us of accumulated times overexceeding our own levels
. Reporting accumulated time each time users connect

You all of course recognize these controls as "standard" in other
services, like banks, credit cards, mobile phones ... Should we not
expect them from ISPs?

I have presented a claim to my ISP, to have these invoices revised to
my usual connect times.  Is there any hope for me?, Do I have a case?
and ... do I need encouragement !! :-(

Regards,
Ana-Julia.

________________________________________________________________
Ana-Julia Abad, MS Eng                          tel 593-4-850714
INFORMundi, Internet Training & Consulting      fax 593-4-850713
Guayaquil, Ecuador                              mob 593-9-885840
http://ourworld.compuserve.com/homepages/ajra/      ajra@csi.com
________________________________________________________________