The DMZ

Little Child

19:01

hello !

I am new here !

^_^

and I need some help !

Griffin

No really what you need?

Little Child

0

Q: How to check if your computer has a backdoor installed on it?

I am new here. This is my first question. Just some time ago I had this unusual popup from MBAM: I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking svchost.exe from this same IP. I am wondering why is vmware-hostd.exe` connecting to th...

some help with regards to that will be appreciated !

:-)

ManishEarth

:10121452 Watch out, such language can get you chatbanned. It's pretty obvious that you were joking here, to me, but try not to do that to newbies.

Little Child

@ManishEarth you are the moderator ? :)

ManishEarth

a moderator. On chat.

@LittleChild I doubt that's on topic here. Try Super User

Actually wait, don't try SU

Little Child

19:06

but can you help me out , still ? :)

ManishEarth

@LittleChild it's hard to tell, it could be anything

Little Child

err.. like ?

ManishEarth

Best to go into safe mode, and uninstall-reinstall torrents and vmware

Little Child

but that ip ?

ManishEarth

no clue

Little Child

19:08

I tried a whoisbut got no answer

Griffin

@ManishEarth But they know I <3 them and want them badly like Ben Franklin.

Little Child

@Griffin no offense taken :)

ManishEarth

@Griffin :P It's OK to use such language with the regulars. But avoid using it with newbies. You got flagged in this case, and flags can lead to a quick chatban.

Griffin

dnsbl.inps.de/…

@ManishEarth Okay :)

ManishEarth

@Griffin np

Little Child

19:10

@ManishEarth so what general things do I need to do to check that I am not hacked into ?

Griffin

check the link?

Little Child

@Griffin there is no record of the IP :)

Griffin

Got the who is dnsbl.inps.de/query.cgi

ManishEarth

@LittleChild there is. It's in china

Little Child

Where does it say that ?? :/

ManishEarth

19:11

@LittleChild There's a button on the first link for WHOIS

Griffin

And it says "Asia Pacific Network Information Centre"

Lmao

ManishEarth

@Griffin Obviously, APNIC does the IP allocation

Griffin

CHINANET JIANGSU

Little Child

er.... so some Chinese dude is tryna get in ?

:p

Griffin

All I can think of is it being like PRISM but for China!

ManishEarth

19:13

@LittleChild It's probably a botnet operator. You may have to clean your system (reinstall the OS or something). And you may want to avoid using torrents too much

Griffin

86-10-58501724

ManishEarth

@LittleChild He probably already got in.

Little Child

so a reinstall is imminent ?

Griffin

Call him

There is the phone number

ManishEarth

@Griffin no that's not

chinanet jiangsu is an ISP

Griffin

19:14

That's what I go :p

Little Child

@ManishEarth er.... I am getting confused here ..

what do I do ?

Griffin

@LittleChild Reinstall everything!

ManishEarth

@LittleChild Call a professional.

@Griffin ??

Little Child

reinstall the OS, then ? :)

ManishEarth

@Griffin learn to grok your WHOISs :P

Griffin

19:15

@ManishEarth You said reinstall your OS

ManishEarth

@LittleChild depends. call a professional, they will know what to do

Lucas Kauffman

OT: security.stackexchange.com/questions/38151/…

@ManishEarth I think it's a scanner

Griffin

WE ARE BUSY HERE!

Little Child

what can I do to get this out of botnet ?

Lucas Kauffman

which was blocked

ManishEarth

19:16

@LucasKauffman yeah, but why would vmware try to access it?

Lucas Kauffman

@LittleChild is your machine directly connected to the internet or are some of the ports forwarded

@ManishEarth vmware didn't access it, vmware is the running service

ManishEarth

@LittleChild you my not be in one. We probably don't have enough info here

@LucasKauffman as in?

Lucas Kauffman

vmware-hostd is used for virtual machine sharing

Little Child

@LucasKauffman I have a CAT 6 cable right into my RJ45

Lucas Kauffman

so I think since it was an incoming connection it might have been a scanner

Griffin

19:17

I am still tempted to call them

Little Child

so someone was trying to get in but failed ?

Lucas Kauffman

@LittleChild yes that's physical, but what IPs do you have assigned on your network cards?

Little Child

@LucasKauffman ???

Lucas Kauffman

and do forward certain ports from your router

Little Child

yes, the very basics

Lucas Kauffman

19:18

@LittleChild press windows button + R, then type cmd.exe and then type ipconfig

Little Child

Takes a packet, changes the IP

Griffin

@LittleChild A scanner simply implies that it's asking you if you exist.

Little Child

then forwards

ManishEarth

@LucasKauffman Ah, I see. But what about the torrent notification? Looks like something malicious was downloaded via torrent

Little Child

No porn, I can guarantee that ! :-D kidding !

Lucas Kauffman

19:18

@ManishEarth yea but MBAM is notorious for reporting torrents as malicious

ManishEarth

@LucasKauffman ah

Little Child

Well, if I tell what is my IP on a chat, will I not be compromising my security ?

Lucas Kauffman

@LittleChild give me the first 2 numbers

normally there are 4 numbers seperated by a .

give the first 2

Little Child

I know that

:)

Is that safe ??

Yes, I am still a kid.. well in a way

Lucas Kauffman

@LittleChild not really

Little Child

19:21

so .. first two numbers ... safe ?

Lucas Kauffman

yea

Little Child

115.69

Lucas Kauffman

right that's a public IP

ManishEarth

oh, outside network

Little Child

hmm ... ?

ManishEarth

19:22

@LucasKauffman I actually could have checked the IP myself :P

Griffin

@LittleChild Also sorry if it sounds like we have no clue what the fuck we're doing. For the most part they all do. I don't however I know they could do this alot better if they were physically there.

Lucas Kauffman

@LittleChild your computer is directly connected to the internet

Griffin

He is the internet

Lucas Kauffman

@ManishEarth not really because it could have been NATed, which would have meant something was compromised

or she

ManishEarth

@ton.yeung yeah I got that,

Griffin

19:23

@LittleChild Don't worry I don't know what the hell they're saying either

ManishEarth

oops :P

Little Child

NAT is Network Address Translation

thats what a router does

ManishEarth

@LucasKauffman And someone's trying to access the vmware-host port from the outside, right

Little Child

allows IP reuse

Lucas Kauffman

@Griffin you are a kid too, finally someone younger than @terrychia :P

Griffin

19:24

@LucasKauffman How young is he?

Little Child

so the ISP assigns an IP to the router

ManishEarth

@LucasKauffman i'm younger than @terrychia :P

Lucas Kauffman

@ManishEarth yea since 443 is a typical port which gets scanned

ManishEarth

@LucasKauffman yep

Little Child

the IP which is visible is that of the router

Lucas Kauffman

19:24

@ManishEarth but you are a mod so we can't pick on you due to banhammer fear :P

Griffin

@ManishEarth How old are you?

ManishEarth

@Griffin 19

Griffin

@ManishEarth Them asians .....

ManishEarth

@LucasKauffman swings banhammer and hits self in head

Lucas Kauffman

@ton.yeung it's the same in the US, Harvard and MIT have workstations and printers with public IP addresses

Griffin

19:25

@ManishEarth How did you learn so much so fast? :/

@ton.yeung Welcome to the internet

Little Child

Prodigy @Griffin

Lucas Kauffman

@LittleChild you aren't being hacked, you just get random people trying to find exploits in various machines on the internet. It's completely random and not targetted

Griffin

@LittleChild I know. Not as good as John Lettman but still.

So can I actually call them?

Or will I get some bullshit

Little Child

WAIIIITT everyone !

Griffin

@LittleChild There is no waiting in Security.

Little Child

19:27

►

I am gonna do this !

Lucas Kauffman

@ton.yeung yea I used to maintain servers in a full duplex gigabit range, we would get scanned constantly

Griffin

If you do you loose an arm. Look at the description of the channel.

ManishEarth

@Griffin So much == ? I'm still a beginner in infosec. I play with computers though (a lot), and love learning physics, so most of what I know is from there

Little Child

I am a programmer

Griffin

@ManishEarth I play with them too but I don't know much when it comes to protocals

Simon

19:29

What the hell is going on here?

Little Child

The video is so apt for this situation

@Simon scroll back up to where I posted the question

Griffin

@ManishEarth That's why I'm going to this bk.psu.edu/CE/34005.htm

Little Child

@ton.yeung favor a language ?

Simon

Do I look like someone who has time to scroll up?

Scrolls up

Griffin

@ton.yeung Everyone is already on that list -.-

@Simon If you're on here you have time.

Little Child

19:30

Java :) bets language ever ! :)

Griffin

@ton.yeung C++ !

@LittleChild No

Simon

@Griffin Nah, I'm working at the same time.

ManishEarth

@Griffin nice. My main focus is physics, so I'll continue infosec on the side like by participating in CTFs, etc

Griffin

@Simon Dual screen?

Lucas Kauffman

0

Q: How to check if your computer has a backdoor installed on it?

I am new here. This is my first question. Just some time ago I had this unusual popup from MBAM: I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking svchost.exe from this same IP. I am wondering why is vmware-hostd.exe` connecting to th...

malware exploit antivirus antimalware backdoor

answered!

Simon

19:31

@Griffin Indeed

Lucas Kauffman

@LittleChild I think you misspelled python

Griffin

@ManishEarth I want to learn I just don't have enough to learn. Like people talk about all these connections but I want to do them but I has no lab :(

Lucas Kauffman

@Griffin you don't need a lab

Little Child

in which other language do people recite at a play and play at a recital ?

Lucas Kauffman

all you need is a computer

Griffin

19:31

@ManishEarth Where do you go to school?

Lucas Kauffman

and GNS3

Little Child

@LucasKauffman No I meant Java ..

Griffin

@LucasKauffman For a lot of the networking I find I need more than I think.

ManishEarth

@Griffin Connections? O_0

Lucas Kauffman

@Griffin nah you can use GNS3

ManishEarth

19:32

@Griffin Indian Institute of Technology, Bombay

Lucas Kauffman

it's a lab environment which supports Cisco routers and emulating Cisco routers

Little Child

should I get a router ?

Lucas Kauffman

@Griffin gns3.net

Little Child

will it make me any safer ?

Griffin

@ManishEarth Awww I was hoping you went to UD. My dad teaches Physics there :P

Lucas Kauffman

19:33

@LittleChild well configuring NAT wouldn't be a bad thing, you'd be less vulnerable to random scans

ManishEarth

@Griffin UD? O_0

Griffin

@ManishEarth University of Deleware

Little Child

There are scans going on constantly I guess

ManishEarth

@Griffin oic

Lucas Kauffman

@Griffin start with this: amazon.com/Computer-Networking-Top-Down-Approach-Edition/dp/…

amazon.com/Computer-Networking-Top-Down-Approach-Edition/dp/…

then I'd suggest doing some CCNA or ICND

Little Child

19:34

I had MBAM block another one from 222.186.30.244 on port 135 for process svchost.exe

Simon

@LittleChild Could you stop leaking my IP? Jeeze.

Little Child

@Simon ????

Griffin

@LucasKauffman People recommend all these things to read and I'm like great. So when are we taking this cross country road trop for me to have time for all this.

@LittleChild Who do you think was just trying to connect to you?

Little Child

random scan ?

Lucas Kauffman

@Griffin you need to start with some background before you randomly start plugging cables :p

Griffin

19:36

@LittleChild Simon was trying to do the same thing the other guy did in order to emulate the effects.

@LucasKauffman I know :p

Little Child

stop targetting me .. go find @Griffin 's IP

Lucas Kauffman

I accidently took down our college once by randomly plugging in cables

Griffin

@LittleChild We're trying to find out why thus happend!

Lucas Kauffman

someone forgot to configure spanning tree apparantly

Griffin

@LucasKauffman They've done that at out school too

Little Child

19:37

By trying to get into my PC ? how nice !

Griffin

@LittleChild They aren't trying to get in -.- If they were you wouldn't have control of anything right now.

Simon

@LucasKauffman When a friend of mine was 5, he went to visit where his mom works and he unplugged a cable. He shut down the company's network all around Canada.

Little Child

@Simon where are you from

Simon

@LittleChild Take a quick guess.

Griffin

@LittleChild They were trying to figure out what's happening and how sensitive it is.

@Simon Was the child killed?

Little Child

19:38

so why is his IP of China ? -_-

Lucas Kauffman

@Simon we had that as well once, a compromised server on the university network was accidently put online without changing the root password from test to something more secure

was compromised after about 45 minutes

Simon

@Griffin Nah, his mom is one of the boss of the company.

Lucas Kauffman

sending out a DDoS attack against 125 MB/s

Griffin

@LittleChild The one that just happened was Simon. The one from before was China

Simon

@LucasKauffman Hahaha

@Griffin I didn't do anything, I was kidding, haha.

Lucas Kauffman

19:39

the core router couldn't keep up and the whole university was set without network for 4 hours because they needed to restart the router

Little Child

@ton.yeung so can he do that ??

Griffin

@Simon Stop confusing me

Simon

LOL

Griffin

@LittleChild VPN MOFO

Little Child

@Simon yeah me 2

@Griffin not sure if a VPN would allow you to target PCs

Lucas Kauffman

19:40

@Simon worst stunt someone pulled on me was rebooting a firewall in a DC in the netherlands where we did not have remote hands, I needed to drive 3 hours to go into the DC, hook up a keyboard, press enter and then I could leave again.

Griffin

bangs head against desk

I was explaining why the IP could be coming from China / Russia

Little Child

ok

ok chill

Simon

@LucasKauffman Are you serious? Haha, that's awesome. Sounds like me calling my parents to tell them to reboot my server because SSH somehow failed.

Lucas Kauffman

@ton.yeung I've invested in KVM over IP ;)

Griffin

@ton.yeung Greenland is boss they get so much clean energy from using the volcanp

Lucas Kauffman

19:42

the worst part was that a mate of mine was driving a 1976 Mercedes and it was the hottest day of the year

Griffin

@ton.yeung Like they use 100% renewable resources . WHY THE FUCK CAN'T I THINK

Lucas Kauffman

53 degrees inside

Little Child

@ton.yeung only that your child will have two heads and 4 hands

Griffin

@ton.yeung 'o.o Nuclear runoff from what?

@LittleChild Actually maybe not. what-if.xkcd.com/29

Okay I'm gonna stay in channel but not talk anymore. My head hurts cuz I got that funny moment right now where I think I'm thinking but I'm not thinking and the conclusions I'm making are confusing as fuck.

Sleep deprivation FTW

Lucas Kauffman

@Griffin maybe you should take your meds

Griffin

19:45

@LucasKauffman Funny this is I do take meds I already did

@LucasKauffman Actually you just reminded me I need my mood stablizer ....

Lucas Kauffman

@Griffin are you serious?

I thought mood swings were part of puberty

Simon

Or part of the other gender.

Griffin

@LucasKauffman That's not the one that messes with my head and yes I'm serious and it's for my depression.

My mom has bipolar depression. It seems I did her one up and went all in.

Lucas Kauffman

@Griffin ah dang that sucks

Griffin

@LucasKauffman That's only 1 that I have.

Lucas Kauffman

19:49

@Griffin how many you have?

Griffin

@LucasKauffman A few months ago if I were to cross the border it'd look like I was a mobile pharmacy.

My mental illnesses I have -
ADHD
Depression
Anxiety
ODD
Something with anger

I feel like I'm playing Pokemon with mental illnesses

Currently I'm only on 1 uber controlled medication 1 semi and 1 non

Simon

Don't ever do drugs.

I mean the illegal ones.

Lucas Kauffman

@Griffin which one is the super controlled one?

Griffin

ADHD is super controlled the mood stablizer is semi and sleep medicine is no fucks given.

Lucas Kauffman

@Griffin ah Concerta or something similar?

Griffin

19:51

@LucasKauffman They are fucking crazy about that shit. They like well you can't have a supply larger than 1 month

@LucasKauffman Vyvance.

@LucasKauffman Then I have like an Aderal knock off for quick bursts

20 min till active 4 hour effect

Don't use those like ever.

I like my 2 hour till active 8-12 our effect.

Lucas Kauffman

@Griffin yea that's about the same as Concerta (vyance)

I know it was a popular drug in uni

same with ritaline and all other amfetanies

Griffin

@LucasKauffman I was on Concerta at one point.

Lucas Kauffman

@Griffin vyance is a bit heavier no?

Griffin

@LucasKauffman I don't know but I think the dosages go higher.

I got to go to a mental hospital for 2 weeks :)

So long as you out patient it's not that bad.

Lucas Kauffman

@Griffin yea but actually the anxiety and depression can be results from the amphetamine meds

side effects

Griffin

19:55

@LucasKauffman Yes I just googled it. While Vyvance is addictive it doesn't give the same mood changing shit as concerta

"As a teenager with ADHD, the psychiatrist has opted to transist to the new amphetamine based stimulant known as Vyvanse. While the drug is habit forming, it is believed to be a better option in treating teenagers with ADHD as it should not affect social affect or mood."

Lucas Kauffman

@Griffin I did concerta once to try out, it really made me feel sad

Simon

It's always like this: "You gotta take this one but don't forget to take this one too to negate the negative effects..."

Griffin

@Simon You gotta weight the options.

@Simon Most of the time the outcome sucks either way

Simon

Like I said @Griffin, don't ever do drugs. Ever, ever, ever. They might trigger something like schizophrenia.

Griffin

@Simon Legal or illegal?

Simon

19:57

@Griffin Illegal.

Griffin

@Simon I can't do almost any illegal drug seeing as the major heart rate increase can kill me

Lucas Kauffman

@Griffin don't do illegal, avoid legal when possible ;)

Simon

@LucasKauffman Damn right.

Griffin

@LucasKauffman Yea

Lucas Kauffman

@Griffin I wonder what the effect of THC would be on you

Simon

19:58

Time to drive home, BRB.

Griffin

@LucasKauffman Imagine my heart exploding.

Lucas Kauffman

@Griffin why? THC is canabis, so you'd get pretty relaxed and lame

problem is that it enhances your mood, so considering you've got anxiety it could trigger a serious bad trip

Griffin

@LucasKauffman Wait let me see something

Transcript for