Ok, now Switrd is not one to make shit up. I am simply stating what happened to Switrd....like yesterday, and letting you guys know. Switird is very careful when it comes to his privacy online but yesterday when he went to shut down his puter, he got a message that said somethin like "if you shut down now you will be disconnecting the other user" Switrd is the only user, so he thought! After careful examination he found a program that was loaded VIA-someone else that was called netobserve. I can give you details on where I found it later, if you need it. Anyway, contained in what seemed like dozens of folders was history of switrd's whereabouts while sufin the net. I mean they knew passwords and shit. Anyway, Switred did a little spring cleaning just to be safe. He ZERO'd his hard drive, reset windows, changed passwords, and is logged on under a diffrent account. That took care of it. Switrd tried to delete the foul program but found it to be locked. Sorry guys...I know this is not what we want to hear but I just wanted you guys to be careful too

were tell us where you found it at . or just email me . adress is in the profile

i would like to know also where you found this!

thanks nymph

Ta dude, post the info, POST THE INFO..

Been wondering for a while 'bout something, does SWIM protect the user, the site, or both?

I mean, if everyting is just a theoretical discussion & just pursued for interests sake, would this 'net-observe' be a problem anyway?

you fuckin right its a problem it means someone had remote access to your PC. heres the addy where that spyware can be found: http://www.spy-software-directory.com/net_observe.asp

here is what it can do:

Surveillance and Logging Features

Internet Conversation Logging - Log both sides of all chat conversations for AOL/ICQ/MSN/AIM Instant Messengers, and view them in real time.



Window Activity Logging - Capture information concerning all windows that were viewed and interacted with.



Application Activity Logging - Track every application executable that was executed and interacted with.



Clipboard Activity Logging - Capture and store all text and image items that were copied to the clipboard while the user was using the PC.



Printed Documents Logging - Log specific information on all documents that were sent to the printer spool.



Keystroke Monitoring - Track all keystrokes pressed and which windows they were pressed in. Keystrokes can also be passed through a formatter for easy viewing/exporting.



Websites Activity Logging - Log all website titles and addresses that were visited on the PC. Supported browsers include Internet Explorer, Netscape, and Opera.



Screen Shot Capturing - Automatically capture screen shots of the desktop at set intervals - perfect for visually seeing what is going on.



Web cam Picture Capturing - Automatically capture pictures from the web cam connected to the PC - perfect for seeing what is going on around the PC and not just what is going on inside the PC.

Remote Administration Features

File Sharing - Browse directories/files in real time, as well as transfer files, rename files, and delete files.



Startup Moderating - Remotely configure Windows startup applications by editing existing startup application data, or by deleting applications from starting up on the machine running NET Observe.



Image Cache Browsing - Browse the remote machines Internet Explorer image cache. Statistics for each image is included in the cache report - such as last view, total views, and more.



Favorite Places - Browse, launch, edit, delete, and manage Internet Explorer bookmarks on the remote machine.



Internet Connection/Port Viewing -View all open internet connections and open ports on the machine running NET Observe. An integrated Whois Lookup is also included for instantly retrieving information on any remote host. Perfect for spotting Trojans [malicious viruses], or any possible open areas on your network that could lead to a dangerous situation.



Process Management - Remotely view open windows and processes on the machine running NET Observe. You can freely terminate or close a window with a single click.



System Control - Quickly shutdown/reboot/logoff the remote machine, as well as put the machine into Lockdown Mode. Lockdown Mode will bar the PC of any usage, and the only way to regain control of it is if you [the administrator] unlocks it.

Security Features

Stealth Mode - Run NET Observe in total stealth - the user will not know that it is running!



Web Content Filtering - Filter out websites and protocol from being used, and automatically track attempts made to view the banned material.

Windows Startup - Configure NET Observe to startup for a single user, or to start up as a service for all users on the system.



Automatic Active Startup - Configure NET Observe to start in "Active" mode when it is executed.



Password Protection - NET Observe requires a password for starting/stopping the monitoring process, and as well as when connecting to the NET Observe Web Control Panel.



128-Bit Encryption - NET Observe utilizes the MD5 Message Digest Algorithm [as defined in RFC 1321]. The MD5 Message Digest Algorithm is a one-way hash algorithm, which takes any length of data and produces a 128 bit "fingerprint" or "message digest". This ensures all data can not be snooped or viewed while it is being viewed remotely.



IP Banning - Filter out IP Addresses/Host Names from connecting to the NET Observe Web Control Panel.

Special Features

Log Exporting - Export NET Observe logs to 4 different formats: Microsoft Excel, HTML, CSV, and Plain Text.

Precise User Tracking - NET Observe will ALWAYS logs the current Windows user and the time and date an action if performed. This will allow you to precisely track activity down to the exact user, at the exact time it happened.



Inactivity Monitoring - Automatically suspend NET Observe from monitoring if the system is inactive for a specified amount of time.

Scheduling Agent - Automatically configure NET Observe to start/or stop at specified times and dates, or configure it to do it at the same time everyday.



Automatic Log Clearing - Automatically cleanse old logs from the after a certain amount of data or keystrokes have been logged.

Network Ready!

Automatic IP Detection - NET Observe can automatically detect your External IP Address and your Internal IP Address. This will allow you to quickly setup NET Observe to work outside a network!



Port Configuration - Set/change the default for you wish to use when opening up a connection on your PC to the NET Observe Web Control Panel.

Router/Firewall Configuration Tutorials - The NET Observe documentation includes step by step tutorials for configuring the following routers/firewalls:



Zone Alarm Firewall

Black ICE Defender

Linksys Routers

SMC Routers

D-Link Routers

Netopia Routers

NetGear Routers

(Works on Windows 95, 98, ME, 2000, and XP)

i would not take this intrusion lightly and i would have tried to reverse lookup where this data was going and who was behind it before letting whoever was on the other end know i knew

Ok...guys and gals, hey...did I just steal that line?? Well, anyway here is where I found the program. In your

C:\windows\system\wbem\wbmcore\sysconfg\netobserve \netobserve.exe ...on mine there were several, like back ups in case I found something. If you have a system check program, then run it....it should tell you what programs are currently running. Like if you press ctrl alt del once, then a list of the programs running come up. With the other you can write down the path name and go find that sucker!! While browsing through your files you'll see a bunch of crapp with that little blue hand underneath it. Meaning that file is being shared. Right click on it and turn off the sharing. I hope this helps.

Oh, to answer that question while I'm here...Masa, I'm not sure but there was a collection of stuff that I had copied.... and pasted in a special folder. WELL THEY HAD THEIR OWN special folder( they created ) Then there was like some type in code, C++ or some bullshit, and It said list of banned....fuck I don't remember exactly. Basicly it said banned phrases, or words, something along those lines. You know like trigger words, that get immediate attention. Kill, bomb, or shit like that.

I hate those Freaking hackers!!!

[This message has been edited by AlwaysTired (edited 07-10-2003).]

ok WR that is some bad shit . now how do you see if it has been done to ones pc. puters and me dont get along . i can do alot of things but finding stuff on this box aint one of them.

i am checking into this software and will let you all know what i find. at this point, altho i might be mistaken it seems it has to be initiated on your end. for example a wife trying to see what her husband does online purchases the software and sets it up while he is away to run in stealth mode nad check/track ALL his activities later and i mean ALL activities. once installed on your end can be monitored from another PC as well. at this point i dont think it can be setup via a trojan from another PC. i think the intial action has to be done on your end. short of purchasing it i cant be sure but am looking into it. another idea is to post this in the forum about hacking here on totse and see what those guys say. there are some people there that know this shit same as we know what we know here... get my drift? any more info you get on this will be greatly appreciated so post anything you find out and i will do the same.

Hey that's it rain man!! Well in my case, my wife's computer is networked to mine... she set the share capability and left it on...leaving me like a big ass target with the share deal still on. Perhaps?? I specificly remember turing it off then finding it on again. And as for a name, I did come up with a "Scott Seligman" That and a Scott@scottandmichelle.net BUT!! I went to their site and they may just be the people who wrote the program....not knowing it was being used for evil. I dunno! it's a conspiracy....

[This message has been edited by AlwaysTired (edited 07-10-2003).]

quote:Originally posted by pikk:

ok WR that is some bad shit . now how do you see if it has been done to ones pc. puters and me dont get along . i can do alot of things but finding stuff on this box aint one of them.

pikk... hold down the ctrl and alt button at the same time press delete ONCE a window will open called windows task manager or somethin to that effect the 1st tab will say applications the second tab at top will say processes, click the second tab it will tell you what is currently running on your system. look for NETObserve or netobserve.exe or anything like that.

next thing... push start on lower left of taskbar then select RUN type in msconfig. the last tab will say startup, click that. in that list every box that has a check in it is what starts when you start windows.

what version of windows do you run? 95,98,2000,ME, or XP?

quote:Originally posted by AlwaysTired:

Hey that's it rain man!! Well in my case, my wife's computer is networked to mine... she set the share capability and left it on...leaving me like a big ass target with the share thingy on. Perhaps??

perhaps SWIAT but at least you know its not a malicious scource. whew wipes brow lol shakes finger at SWIAT`s wife tsk tsk tsk bad girl lol

Ok I know she does snoop...But there is no way in hell she could've come up with all that. And she honestly doesn't know anything about it. Except that she turned the share feature on once. Like I said though I turned it off myself at least 2 other times. And the crap in their folders....their C++ programing language, Switrd's tweekin but he knows what he saw...and then deleted. It was far beyond trd's wife's realm. They put some time into this project. Files were write protected, Access denied...it was backed up....AhhhhhKk!!

[This message has been edited by AlwaysTired (edited 07-10-2003).]

ok folks heres the drill. go to this site and test the security of your machines: http://grc.com/intro.htm

step 1: click on where it says: shields up

step 2: where it says free ip agent click that and download the ip agent it makes sure you test your true ip.

step 3: after the dowload completes go to the folder you saved it in and click on the ip agent icon it will pop up with your true ip in the window .

step 4: in the same window click where it says test my shields you will be taken back to the gibson research corporation to the shield testing page.

step 5: click test my shields. heres what mine says copied direct from the site...

Attempting connection to your computer. . .

Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist!

One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.

Unable to connect with NetBIOS to your computer.

All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

step 6: click on probe my ports, here is what mine says...

Port

Service

Status Security Implications

21

FTP

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

23

Telnet

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

25

SMTP

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

79

Finger

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

80

HTTP

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

110

POP3

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

113

IDENT

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

135

RPC

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

139

Net

BIOS

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

143

IMAP

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

443

HTTPS

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

445

MSFT

DS

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

5000

UPnP

Stealth! There is NO EVIDENCE WHATSOEVER that a port (or even any computer) exists at this IP address!

---------------------------------------------

anything else is unacceptable at least to me it is. if you get anything back other than what you see above then let me know and i will post how to make it so even tho this isnt quite the forum for it i hope AM and TRYP will allow it.

quote:Originally posted by AlwaysTired:

Ok I know she does snoop...But there is no way in hell she could've come up with all that. And she honestly doesn't know anything about it. Except that she turned the share feature on once. Like I said though I turned it off myself at least 2 other times. And the crap in their folders....their C++ programing language, Switrd's tweekin but he knows what he saw...and then deleted. It was far beyond trd's wife's realm. They put some time into this project. Files were write protected, Access denied...it was backed up....AhhhhhKk!!

[This message has been edited by AlwaysTired (edited 07-10-2003).]

those files can still be gotten rid of SWIAT SWIM knows the way let me know if you need help and also what platform of windows you are running as well. SWIM is cancelling tonights activities and will be here to help anyone who may need it, with these processes at least he will try to help as best he can

[This message has been edited by Wicked_Rain (edited 07-10-2003).]

Man, my finger gott tired rolling down all those pages. This is a lot of information.

I don't remember who asked, but the jist of the question was, Does the word SWIM serve as any kind of legal protection.

NO

Think about this. You have been monitored for 3 months and the DEA strikes your house.

1. It doesn't matter if you call yourself uncle joey, they don't need your computer bullshit if they have a truckload of evidence from your house.

2. They won't be knocking down your door unless they know for sure they will score.

The only reason you should be here and not be a moron (sorry if any of you cool guys fit this description) is if the house where your computer is, is not the same location where SWIY works. Even then, extra security measures are worth the effort to make sure you are not being followed. I have been on a rant before and posted how many miles Swigotta lives from me. Its obvious that I am a moron, just not a moron with hard evidence of manufacturing in his house.

The point is this. LE doesn't need your internet babbling to bust you. They may use it to gather intelligence on you, but how many people here are completely full of shit, or 12 years old, or wannabees? The answer is most. It would be a logistical nightmare to track the activities of every idiot here. You must come up with a plan that insures that the computer you use is not at the same location where clandestine study and enlightenment are cultured.

This would also give you the opportunity to, I am so against that string of letters bullshit, Roll On The Floor Laughing My Fucking Aaa Off.

These guys do not seek justice. Instead, they seek anything that furthers their quest for wealth and power.

duh why don't you guys just get 2 hard drives

stacked, install linux on one and keep your

windows, on the other? I gotta give Wicked_rain some credit though, he just successfully port fucked his own computer from port low to 5000, Im surprised,

not giving a second thought thaT hundreds of

stranger net observation tools could have

been throwing switches, AND telling you that

your computer is deliberately not responding,

>>>(Thats cool!)<< is the most proffessional

line in re-assuring you that your pc is safe

I've read yet, that almost blows (panasync's) BitchX client out of the water,

but at least his shits still wet when it surfaces....haha you guys crack me up.

yeah Im gonna leave this topic open for sure, do it up. In my opinion, computer security is something worth taking the time to learn. Us dreamers cant be too careful, its been proven in this topic.

hey anyone know if netobserve will work with other OS's that arent listed.... like say windows server 2003 (any edition), or windows server 2000 ?

yea phrog it must be a bitch knowin everything. how do you keep your head from exploding with all that knowledge? nothin gos in or out of this motherfuckin comp i dont know about.

There is more to pHrog than meets the eye. Use caution as he may be working for your large male sibling.

He's right about the Gibson, you know.

[This message has been edited by gottagogo (edited 07-10-2003).]

My head did explode once already but

gotta pieced it back together with superglue.

nah like I would have a beef up version of linux running, but in turn putting all

network deamons to the least available priority level, or disabling everything execpt ppp popd and maybe 2 other network deamons/ports. leaving only very few ways to monitor your activities by another individual

on the net UNLESS they knew your root password, setup your linux drive from root to serve 1 UID (wich would be you) and fuckin

disable/slow down as many processes other than essential system programs and your(machine's) network connection, when using any back-up secureness, so then there are few ways to log into or break into your machine by an outside user,and even if they do, set any other PID(process ID)'s to the least priority, so if they do break in it will be slow as hell trying to damage/copy

even download anything from your machine.

Point being that Windows, priority levels are

1 for all, all for 1 get my drift.

LInux/SCO unix can be got at your local software store. Hey gootagot gotta any superglue left?

WR i use XP if that tells you anything.

I got freaked last night when while I was performing that Sheilds Up deal, Switrd's fort was not so fortified. Thanks gotta for your input...those are some good tips. And you are correct in thinking that "common sense" is not that common with some people. (not addressing anyone outright)

As for Switrd's puter, I finally got it so all the ports come up as closed, but as the Rainman stated earlier, that's not good enough for switrd. He absolutely insists on complete STEALTH mode. You're probably gonna be swamped with tryin to help everyone here WR...but Switrd is patient. If you can give me some tips on converting Switrd's puter to become a stealth one, I'd apreciate it. Switrd's running Windows 98 2nd edition. You can forward any information to Chiknhawk63@aol.com Thank you in advance. And thank you moderators for letting this thread ride

Hey AT...SWirh would tend to agree with Wicked on the point that Netobserve would prob have to be installed physically on ur puter and/or network. You said something bout the amount of information was beyond scope of wifey...well that program is pretty user friendly ya know? It would be pretty much do all the tech work and safeguard it... all someone would have to do is view it. And it has to be configured to work with your firewall (which Swirh would suggest having) The site WR suggested actually has some free firewalls available as well as some ratings on different firewalls. Swirh doesn't use Black Ice..but wow always thought that was a pretty tight program. Turns out that it is not. And AM... Swirh thinks he remembers the Win2000 server but can't remember 2003. This program is especially made for networks... where the admin can snoop at all the users (or just some).

Pikk... you said XP...dunno if you know this or not but you can cut alot of shit out on XP that aren't necessary. There was a good writeup on this on a thread. I think it was http://www.totse.com/en/technology/computer_technology/generalguideto169361.html

Anyhow...hope this helps...

quote:Originally posted by gottagogo:

He's right about the Gibson, you know.



Gotta.. was wondering about the "Gibson"? Maybe Swirh ate too many paint chips as a small children but for the life of him can't find the "Gibson" anywhere. Is he missing something?

Switrd is absolutley positive his better half didn't screw with his puter. And the netobserve program was actualy installed twice, on Swi's system.

[This message has been edited by AlwaysTired (edited 07-11-2003).]

"Gotta.. was wondering about the "Gibson"? Maybe Swirh ate too many paint chips as a small children but for the life of him can't find the "Gibson" anywhere. Is he missing something?"

I don't know a whole lot about computers, but I would avoid using super computers to analyze my system. Who knows, maybe I'm just too cynical. The name came from:

"gibson research corporation"

in Wicked's post way up there.

[This message has been edited by gottagogo (edited 07-11-2003).]

quote:Originally posted by gottagogo:

"Gotta.. was wondering about the "Gibson"? Maybe Swirh ate too many paint chips as a small children but for the life of him can't find the "Gibson" anywhere. Is he missing something?"

I don't know a whole lot about computers, but I would avoid using super computers to analyze my system. Who knows, maybe I'm just too cynical. The name came from:

"gibson research corporation"

in Wicked's post way up there.

[This message has been edited by gottagogo (edited 07-11-2003).]

its not a super computer that anylizes anything lol read up on the technology and the programs he writes and how the probe works. i been goin there over two years now since his website 1st opened. like i said read up on steve gibson and his accomplishments. if you have win xp check out the program called xpedite. check out leak test if you wanna test your firewall. all his progs are written in pur assymbly language so they are really small most around 500kb. and maybe he is right however i dont believe so. if he is so right let him show us or make some contribution. no one can keep everyone out but everyone can keep most out. and no matter what you think of gibson or what im saying the fact remains AT had his ass hangin out in the wind. i was just trying to help him cover it.

[This message has been edited by Wicked_Rain (edited 07-11-2003).]