Question on Trojan Horses

[Jorge22]

Hi. I searched for virus forums on the net but I haven't found anything acceptable, so I thought: why not go to the Eidos forums where a bunch of people seem to know about these matters? And here I am...
I have the AVG free edition on my computer and I updated it today. I update it often but that doesn't mean I run it as often since it checks the computer as it starts and it's also programmed to check the internet and the email I get. After having done so, I ran the anti-virus just to make sure everything was alright. And was it? No. I got a message telling me it had fixed a trojan horse, called Dialer, which was a file named C:\WINDOWS\TEMP\NSIDD.EXE. So, I went to check what the hell that trojan was and I found out it was something that made connections to 900 numbers via my computer. I also noticed it's not a very recent trojan, which makes me think it should already be in my AVG, so how come it let it pass? I also read fortunes had been lost like this, people had commited suicide, etc, etc.!

Now, from what I read, I assume 900 numbers are porn sites or something that charge you for acceding to them. Does the trojan make you pay something like a monthly fee or does it make you pay per minute. To cut it short, what exactly is a 900 number?
Well, maybe I have found it just in time, anyway, because up to now I haven't received any bill related to anything like that! I sincerely hope so! Still, computer experts, is there any way of tracking the trojan to where it first came from? Cause I haven't got a clue and I'd really like to know... Thank you.

[Munin the Raven]

A trojan is any malicious program that's disguised as something else and like the name implies, trojans tend to manipulate your PC into installing more hostile programs or operating in a non-beneficial way.

"Dialers" in terms of software are programs that do just as their name implies; they dial numbers. They take many forms and can be introduced to your system by trojans (which in turn can be disguised as almost anything else), hostile scripts, spyware, etc.

900 numbers are pay per call numbers, so you can imagine how a program that dials them without your knowledge can rack up enormous bills.

It's going to be extremely difficult, if not impossible to track where it came from. Nasty software is so common that your best defense is to become more educated on the matter and learn to better protect your computer.

For starters, don't open email from strangers and be extremely careful with attachments, even if they're from known contacts. Stay away from suspicious websites (usually porn sites or warez sites), as they employ all sorts of nasty scripts, spyware, and even full-blown viruses. Also be careful of downloading and installing free programs, as they often have nasty spyware attached.

[dhama]

I can add that a firewall is the best protection. I use Zone alarm which is free for home use. You can get it from here (http://www.zonelabs.com/store/content/home.jsp)

[Jorge22]

Thanks to both of you. In fact I haven't been to porn sites, the attachments I get from my brother are already checked out for viruses and others that I get, well, shouldn't my AVG work? Also, I haven't installed any free software from the net except for TR custom levels, the AVG updates, that kind of thing. I wonder how I got that stupid trojan... Anyway, I'm still hoping I won't have to pay a dime. And I don't intend to. Hopefully I won't be cut out of the internet... In fact, hopefully nothing else will happen.

Btw, what exactly is warez?

I'd also like to add I've already downloaded. Thanks!

[Munin the Raven]

Warez is a slang term for pirated software that's available on the net (often through an FTP server). It's illegal to distribute and use warez, and discussion of warez (illegal versions of games, where to get them, etc.) is not allowed in these forums.

You generally want to stay away from any site that use "warez" for a major term in its description/meta tag for search engines, as they tend to employ all sorts of sleazy advertising, spyware, etc. and are often integrated with porn sites. It's also usually a bad idea to hang out at sites where warez is distributed because you can be exposed to all sorts of potentially dangerous types (hackers, feds ready to bust the site, etc.).

And dhama is right. If you have an always-on internet connection you should get some kind of firewall.

[Lucky]

VARNING: Nor Dakota Computir Virus. Ve haf just sent you da "NORVEGIAN
VIRUS".
Since ve do not haf any programming experience and do not know how to
actually damage your computer, dis Virus verks on da honor system.
Please forward dis Virus to eferyvone on your mailing list and den
manually delete all of da files on your hard drive. Tank you for your
cooperation. Sven and Ole :p

[Solange]

Can these "dialers" do anything if I have broadband and don't use a modem? Can they somehow track me down and bill me, or is it just the connection they target?

Sorry if this is a stupid question, I don't know so much... So much to learn, so little time! :D

[Jorge22]

Sorry if I'm being silly, but how can you be on the net without a modem? I have broadband too - with a modem. I think they'll use your telephone number (when you're on the net, I assume) to make calls. And I wonder how these people aren't very severely punished...

[Solange]

I didn't explain that to well...

I have a modem, but I don't use the telephone line, I'm always connected, but I only pay a prearranged amount every month. There is a name for that, but I don't know it in English... :)

So, I don't get billed from the telephone company, it's from my TV-company, through my cable.

[ragsy]

Solange in your situation you should be fine

as you are always connected the same way as i am (through a TV Company) therefore your interent connection is always negotiated through servers rather than a standard modem bank..

You probably would not even have it configured or even connected to a dialup capable line

Also these dialers are designed to attach to an installed modem that would appear in your modem list... where as most broadband modems i have seen don't work this way... normally they have a more complex network adapter process that varies from modem to modem

Dial up 56k modems all adhere to a common standard that these trojans are normally designed for

[Xcom]

Originally posted by Solange
but I don't use the telephone line


what good is telephone call if you are unable to speak?

- Agent Smith (The Matrix)

:D

assume that Neo is an evil Dialer in this case ;)

++edit++

(and of course ragsy needed to butt in and spoil my mysterious reply :D )

[Solange]

Originally posted by Xcom
what good is telephone call if you are unable to speak?

- Agent Smith (The Matrix)

:D

assume that Neo is an evil Dialer in this case ;)

Probably true, I saw him not too long ago on cable, same cable as my broadband... :D

Thank you ragsy for reassuring me! I didn't think I was in danger, but I wasn't sure! Thru Ad-aware & PestPatrol I see that I get a few "dialers" every now and then, it's good to know they aren't as harmful to me as they look! :)

[Munin the Raven]

Right, you're safe from traditional dialer programs if you've got a broadband connection because you're not dealing with the dialup system.

There are plenty of other nasty creatures out there though, so be careful.;)

[ragsy]

Yeah the equivalent Trojan for a Broadband user

will attempt to directly communicate with one or several computers on the internet (often things like private IRC rooms)

where it can get instructions or commands which are used by your computer to participate in distributed Denial Of Service attacks and the like

Thats where a product like Active Ports is handy as it will tell you exactly what port/IP your computer is listening for

Zone alarm blocks 99% of these types of trojan as well

[Jorge22]

Solange, in fact I hadn't thought you'd have a cable connection. I too, thought of having that before choosing the ADSL which is a dedicated line in your telephone connection. So, the speed is now much faster (not 56 K) but I guess I still may be subject to the action of mean hackers planting mean trojans as dialers in my computer!