Spyware/malware/keylogger? HELP!!!

Question

Level 1

9 points

Spyware/malware/keylogger? HELP!!!

Hi. I was looking for free dialup servce as a backup. I came across a link in a forum I frequent, and went to the site. Registration was just username and password. I registered, but was suspicious.

So I ran a search and came across complaints that the site (Metconnect.com) was infiltrated by hackers, and they'd installed "urchin.js" trackers. Out of curiosity, I did a find on my computer (my Pismo laptop) and found two instances of this "urchin.js," which apparently comes with Google Analytics? But what was really suspicious was their location: both were found in a folder where I keep copies of credit reports and my financial information, titled "Credit Reports/Money."

I immediately deleted them both, disconnected from the internet and started a spyware/keylogger check that comes with Internet Cleanup/Net Blockade, which I keep running at all times and use the feature which lets me know when anyone tries to connect to my computer (like Little Snitch). I also have my firewall settings turned up to the max/stealth.

However, I am still freaking out and wondering just what information these folks might already have grabbed in those few minutes. The spyware check takes a few hours and isn't close to finished.

Does anyone have any experience with this, and know what I might be up against?

Thanks so much!!

Pismo G4 550; Pismo G3 500; Mac 700; iMac DV500 Graphite; dead iBook SE Graphite, Mac OS X (10.4.11), iPhone 3G; Nano 4G/8GB; Nano 1G/2GB; Shuffle 1G/512MB; Airport Express

Posted on Sep 28, 2009 12:37 PM

Reply

Answer 1

WZZZ

Level 6

13,238 points

Sep 28, 2009 1:25 PM in response to LaurieNY

Hi,
Google Analytics gathers statistics about website visits and the urchin.js is related. I found this:
http://answers.yahoo.com/question/index?qid=20071104122712AAAbKwi

But I, too, don't like it being in those folders. Don't know what that means and don't understand why those files ended up anywhere on your computer.

Google Analytics is something I always block with the NoScript addon--indispensable these days--on Firefox. I wouldn't use anything else as my main browser, since none have this kind of protection.
http://noscript.net/

Little Snitch checks for outgoing connections. You can also scan for malware with the demo version of Macscan. 30 days free.
http://macscan.securemac.com/

Maybe someone else will have something more to say.

Reply

Answer 2

LaurieNY Author

Level 1

9 points

Sep 28, 2009 1:27 PM in response to WZZZ

Hi,

Net Blockade monitors all incoming connections and asks if you want to accept them.

Yes, it's where I found those urchin.js files that worries me the most. Now I don't know WTH to do, like if the tracker copied and sent back all information that was in that folder.

Reply

Answer 3

WZZZ

Level 6

13,238 points

Sep 28, 2009 1:35 PM in response to LaurieNY

Have a look at this.

How this works: Google Analytics downloads a small javascript urchin.js (Google Analytics Urchin Module) on >the client's computer which reports the all the tracking and analyzing data about the visitor back to Google. >By adding the above line, we have effectively blocked our browser from downloading the urchin.js file.

http://labnol.blogspot.com/2005/11/prevent-google-analytics-from-tracking.html

That sounds like a cookie, but that's not what you ended up with, as it downloaded in a folder.

But, as mentioned, Firefox with NoScript will keep this crap out, along with a lot of other stuff.

Now I don't know WTH to do, like if the tracker copied and sent back all information that was in that folder.

Doesn't seem likely, but maybe someone else can help out on this.

Reply

Answer 4

LaurieNY Author

Level 1

9 points

Sep 28, 2009 1:43 PM in response to WZZZ

Yeah, and what a folder it decided to download itself to... TWICE. Convenient, huh? Thanks for the input. Still waiting for spyware etc. scan to finish, but of course that won't help if the damage is already done. I suppose I should freeze my credit reports. Geez, pdfs of my tax returns are also in that folder, investment account information, electronic copies of paystubs and credit card statements... holy crap.

Reply

Answer 5

BDAqua

Level 10

250,259 points

Sep 28, 2009 1:51 PM in response to WZZZ

Maybe someone else will have something more to say.

You're doing a fantastic job! 🙂

Reply

Answer 6

WZZZ

Level 6

13,238 points

Sep 28, 2009 3:08 PM in response to BDAqua

Thanks BD,

Laurie, I just checked three internet ratings sites for metconnect.com and nothing bad shows up. Check for yourself.

http://www.mywot.com/

http://www.siteadvisor.com/

https://safeweb.norton.com/

I don't know what to say. Maybe metconnect.com was hacked. I don't understand how a hack like this would have worked. Were there any ads on the site? The ads could have been hacked. This is becoming more and more a malware vector. Did the site have any Flash? Another malware vector. You could try contacting metconnect to ask them what they know. Look it up on whois.

http://whois.org/

If no one can say what might have happened here, there are a few knowledgable security people who hang out in the Safari forum. You might try asking over there, whether or not you were running Safari. (What I would say is this exploit, if it really is one, and I doubt it, isn't very subtle. You found it right away. Data theft, I would think, would be much less conspicuous. Leads me to think it wasn't really an exploit. Maybe something else happened.)

http://discussions.apple.com/forum.jspa?forumID=876

Another idea: ask over at the NoScript forum. Even if you're not using NoScript, Giorgio, the developer, is very helpful and extremely knowledgeable on this subject.

http://forums.informaction.com/viewforum.php?f=7&sid=ef0

Message was edited by: WZZZ

Reply

Answer 7

LaurieNY Author

Level 1

9 points

Sep 28, 2009 3:19 PM in response to WZZZ

Hey W,

I was using Firefox, FWIW.

I guess all I can do is hope. I've run everything I have, and I have tons of security features running all the time. Just can't seem to shake finding those urchin.js files in my financial folder, y'know?

Thanks for all your help.

Reply

Answer 8

WZZZ

Level 6

13,238 points

Sep 28, 2009 3:34 PM in response to LaurieNY

Just can't seem to shake finding those urchin.js files in my financial folder, y'know?

Sure. Myself, I wouldn't rest until I knew how that happened. Maybe something completely harmless, but you don't know 'til you know.

Reply

Answer 9

BDAqua

Level 10

250,259 points

Sep 28, 2009 4:19 PM in response to LaurieNY

If you wish to block google down loading urchin.js & tracking you across sites, you can add 127.0.0.1 www.google-analytics.com to your Hosts file, Hostal makes it easy, but can be done other ways...

http://www.apple.com/downloads/macosx/internet_utilities/hostal.html

At least if one shows up again you'll know it's not real! 🙂

Message was edited by: BDAqua

Reply

Answer 10

LaurieNY Author

Level 1

9 points

Sep 28, 2009 4:21 PM in response to BDAqua

Hey BD,

Do you have any idea how these urchin files might have ended up in my financial information folder? And WTH they might have done while they were in there?

This is going to give me nightmares. 😟

Reply

Answer 11

BDAqua

Level 10

250,259 points

Sep 28, 2009 4:45 PM in response to LaurieNY

We'd have to have one to look at, tough to tell if they were "legit", (LOL), or not otherwise.

https sites track you too...

http://www.webmasterworld.com/analytics/3018352.htm

I really don't know why people do any financial things online at all, I'd guesstimate a thousand a day get hacked... it's where the Money is!

Reply

Answer 12

LaurieNY Author

Level 1

9 points

Sep 28, 2009 4:50 PM in response to BDAqua

This was a folder on my hard drive that contains pdfs of credit reports, tax returns, investment statements, credit card statements, paystubs etc. That's where the little b*stards SOMEHOW found their way to, out of all the folders on my hard drive. Interesting, no?

Reply

Answer 13

BDAqua

Level 10

250,259 points

Sep 28, 2009 5:23 PM in response to LaurieNY

There aren't any still in the Trash are there?

Did you access that folder when you were on a financial site, like to upload something, or any connection you can think of?

Reply

Answer 14

LaurieNY Author

Level 1

9 points

Sep 28, 2009 5:27 PM in response to BDAqua

Both urchins were deleted and trashed when I found them.

As for what's in the folder being accessed... stuff has been downloaded directly to the folder, and also opened while I've been online. Not today, though. Not by me, anyway. sigh

Reply

Answer 15

BDAqua

Level 10

250,259 points

Sep 28, 2009 5:42 PM in response to LaurieNY

Both urchins were deleted and trashed when I found them.

You mean you emptied the trash too?

Reply