Level 1

9 points

Spyware/malware/keylogger? HELP!!!

Hi. I was looking for free dialup servce as a backup. I came across a link in a forum I frequent, and went to the site. Registration was just username and password. I registered, but was suspicious.

So I ran a search and came across complaints that the site (Metconnect.com) was infiltrated by hackers, and they'd installed "urchin.js" trackers. Out of curiosity, I did a find on my computer (my Pismo laptop) and found two instances of this "urchin.js," which apparently comes with Google Analytics? But what was really suspicious was their location: both were found in a folder where I keep copies of credit reports and my financial information, titled "Credit Reports/Money."

I immediately deleted them both, disconnected from the internet and started a spyware/keylogger check that comes with Internet Cleanup/Net Blockade, which I keep running at all times and use the feature which lets me know when anyone tries to connect to my computer (like Little Snitch). I also have my firewall settings turned up to the max/stealth.

However, I am still freaking out and wondering just what information these folks might already have grabbed in those few minutes. The spyware check takes a few hours and isn't close to finished.

Does anyone have any experience with this, and know what I might be up against?

Thanks so much!!

Pismo G4 550; Pismo G3 500; Mac 700; iMac DV500 Graphite; dead iBook SE Graphite, Mac OS X (10.4.11), iPhone 3G; Nano 4G/8GB; Nano 1G/2GB; Shuffle 1G/512MB; Airport Express

Posted on Sep 28, 2009 12:37 PM

38 replies

LaurieNY Author

Level 1

9 points

Sep 28, 2009 5:47 PM in response to BDAqua

I did. I just wanted them gone. I didn't know what kind of evil they were capable of if they remained! Zombie urchins sound even scarier... heh

BDAqua

Level 10

250,259 points

Sep 28, 2009 6:03 PM in response to LaurieNY

The Internet is getting scarier almost daily, and I hope it doesn't happen again, but they can be viewed in Text Edit to read the content.

LaurieNY Author

Level 1

9 points

Sep 28, 2009 6:09 PM in response to BDAqua

Since I just bought a new MBP, I'm now seriously worried about copying anything to it, too. Geez Louise. There's a special place in h*ll for people who do this sort of thing.

But zombie urchins do sound awesome. That would make a heck of a cool movie. ha

BDAqua

Level 10

250,259 points

Sep 28, 2009 7:07 PM in response to LaurieNY

I'm now seriously worried about copying anything to it, too.

Naw, I wouldn't worry, that part is over.

As mentioned, get Little Snitch, stops/alerts outgoing stuff...

http://www.obdev.at/products/littlesnitch/index.html

zombie urchins

Would it be in 3-D?

LaurieNY Author

Level 1

9 points

Sep 28, 2009 7:23 PM in response to BDAqua

Yes, I think I will get Little Snitch as well. I know when someone out there is trying to connect to me, but not when anything leaves my computer when it shouldn't be.

Zombie Urchins in 3D. Friggin' awesome. Imagine all the little waifs from Annie or Oliver Twist. As zombies. In 3D.

LaurieNY Author

Level 1

9 points

Sep 28, 2009 7:24 PM in response to BDAqua

WZZZ

Level 6

13,238 points

Sep 28, 2009 7:38 PM in response to BDAqua

Still following this. Yeah, I thought if they were still in the trash, could do a "get info," or open it, and maybe learn a little more.

BD's the best, but really, bring this up on the NoScript forum. You can be a "guest;" I don't think you need to register Maybe Giorgio has heard something about it, or can figure out how this might have happened. He deals with this evil stuff all the time. He's like a kind of exorcist. NoScript is all about Javascript exorcism. But wait 'till the AM; he's in Italy and probably sleeping now. He, or someone else on the forum, might try replicating it to figure it out. I'd be freaked out too, but a lot of this stuff is aimed at Windows, and might, if it's a genuine exploit, be completely harmless on a Mac.

LaurieNY Author

Level 1

9 points

Sep 28, 2009 7:38 PM in response to WZZZ

Hey W,

Welcome back. As you can see, we've kind of reached silly season here. heh

I'll check out the exorcist, he sounds pretty cool! 🙂

WZZZ

Level 6

13,238 points

Sep 28, 2009 8:39 PM in response to LaurieNY

Please let us know what, if anything, you find out.

BDAqua

Level 10

250,259 points

Sep 28, 2009 9:08 PM in response to WZZZ

BD's the best...

Granted, but what else has BD ever done for us?

PS. Not really, thousands here better than I, I;m just prolifific, but Niel, the #1 i the world has been clicking off a good 100 points a day since I mentioned months ago that my goal was to catch him... now he's going to lap me! (121,125 points!!!)

LaurieNY Author

Level 1

9 points

Sep 29, 2009 6:36 AM in response to WZZZ

Hey W

I tried to register over there a couple of hours ago, still waiting for activation email, even had it re-sent. Yes I checked spam.

Anyway, I was looking at malware info there and it said malware "Will Search “Documents and Settings” for SSNs, credit cards, and saved IE passwords"

Yeah. Which is probably why those files ended up in my financial folder. I've put fraud alerts on my credit reports, but who knows where else this may lead and when. These types don't always use your information right away.

WZZZ

Level 6

13,238 points

Sep 29, 2009 6:47 AM in response to LaurieNY

Did you try just hitting the New Topic button. Make up a user name or leave it blank and enter the scrambled code? Maybe I'm wrong but I don't think you have to register.

LaurieNY Author

Level 1

9 points

Sep 29, 2009 9:22 AM in response to WZZZ

I hit "new topic" and it told me I have to register.

Activation emails just arrived so I'll see where this takes me...

Limnos

Level 10

428,711 points

Sep 29, 2009 9:39 AM in response to LaurieNY

I know when someone out there is trying to connect to me, but not when anything leaves my computer when it shouldn't be.

I run istat menu with the network traffic indicator going. Not the same as Little Snitch but if I were to see a lot of constant outgoing network activity when all I was doing was typing a letter it would probably indicate something was going on when it shouldn't.

WZZZ

Level 6

13,238 points

Sep 29, 2009 9:54 AM in response to LaurieNY

I think that was happening because you were trying to post in NoScript General, which does require registration. Anyway, now your post should probably go in the Support forum. Hope they can help you get to the bottom of this.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Spyware/malware/keylogger? HELP!!!