Kiddie Scripts

[Kirkpat]

Hello I've been getting attacks for a while but recently prevented myself from it and now I think I may be under attack again. Some of the security certificates on sites seem fake and I think someone did it from my account when I log onto a certain account.

"http://www.google.com/url?sa=t&rct=j&q=pseudo%20calm%20topstocks&source=web&cd=1&cad=rja&ved=0CDEQFjAA&url=https%3A%2F%2Fwww.topstocks.com.au%2Fstock_discussion_forum.php%3Faction%3Dshow_thread%26threadid%3D846012&ei=O6gAUffZM6TQmAXVmIHQAg&usg=AFQjCNFOTjpyvbHmwI5jM01u6SADopP-cw&bvm=bv.41248874,d.dGY

^^^^ This isn't the attacker but if the username doesn't show as Psuedo Calm then I know I'm being targeted by some hackers.

Also this search result comes up as him being a member but the site certificate is fake.

http://www.google.com/search?hl=en&tbo=d&biw=1024&bih=634&sclient=psy-ab&q=pseudo+calm+topstocks&btnG=&oq=&gs_l=&pbx=1&sei=OqgAUdf4O9HsmAX0pYHAAQ&gbv=2

I don't pick up anything on my firewall but the same ip addresses and my comp is clean but it may be a rootkit in the works as they try to flash my router. What do you see? Ever dealt with kiddie scripts before?

Edited January 25, 2013 by AdvancedSetup
Removed hyperlinks

[AdvancedSetup]

Hello and Welcome to Malwarebytes Kirkpat I would recommend following the advice from this topic Available Assistance for Possibly Infected Computers and have one of the Experts assist you in checking your computer for any potential infections and get you cleaned up. There is no cost and nothing to buy.

Thanks

[Kirkpat]

If not the links, can you search in google, psuedo calm+topstocks and tell me if you get a result?

[Kirkpat]

I don't have an infected pc and I have a lot of live distros as backup with net support. Would it be possible for someone to setup an account that can trigger kiddie scripts or make its way from the browser to my router, like hidden in nat or a dns? I know hackers and crackers can setup accounts where once you login it's a trap and they look for open ports, can they do more?

[AdvancedSetup]

There are many things that are "possible" but is not of much value just guessing at whats going on. If you're certain the computer is not infected and don't wish to have one of the Experts help you verify that then not sure how we can really help you or what your issue/concern is.

[Kirkpat]

If the router is flashed like it was before then the router itself is infected the router is like a pc it has a cpu and it has ram I never had an infected pc because they would just hide behind the router. Doing a hard reset doesn't do anything only a firmware flash or replacement. So would an expert deal in possibly infected routers and not just pc's I have done searches and can only find answers on the hackers forum itself where they give what they do away but no one could ever tell me this was the case themselves. Before I do anything with the router or ask for help or pay for it again I need to know if it is indeed a kiddie script and why it comes up as a fake certificate but not with other usernames that are not suspicious (to me, long story).

[AdvancedSetup]

Not that is isn't potentially feasible but is highly unlikely that someone would hand code a firmware flash targeted directly at you.

Quite common to have someone reset your router to some specific settings so that they can monitor everything you do but doing a factory reset would remove that.

Then set it with a strong password and they would not be able to get back on it.

You can also check the flash firmware on the router and if it is not what you expect then flash it yourself again and set a strong password.

[Wide_Glide]

The SSL certificate for:

www.topstocks.com.au

Expired (1280 days ago)

So there's no fake to them, they just do not exist, legally

What are Script Kiddies ?

Before I do anything with the router or ask for help or pay for it again I need to know if it is indeed a kiddie script

In order to find out, please follow AdvancedSetup's advise in Post #2