Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a product creator, and in attempt to track and stem my losses from piracy, I occasionally visit a bulletin board dedicated to piracy and piracy-for-profit; my products are regularly pirated and sold there.

When visiting, I often get intrusion alerts from Kaspersky, and I received one such today.

After I left the site and browsed elsewhere with the new FireFox 4 beta, a window popped up to indicate that a Thunderbird add-on for the beta was available, and offered to install it.

I accepted the installation.

A few minutes later, Thunderbird opened without my doing, and displayed an outbound email with the administrator of the bulletin board named as recipient. (I know the guy's email address, and he explicitly boasts of hiring hackers to penetrate sites so as to copy and sell the products he finds.)

So, have I been hacked, and if so, what should be the next step, security-wise?

(Note: Kaspersky regularly alerts me of intrusion attempts when visiting that guy's site, but never displays a record of them afterward.)

Thanks in advance for any suggestions.

share|improve this question

closed as off topic by Zoredache, Sam, Iain, sysadmin1138, Wesley Jan 26 '11 at 22:29

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Reading this once over gives the impression that you are pirating software. You should add that one of the products you created is sold there. –  atx Jan 26 '11 at 22:16
    
Good point; thanks. –  tim Jan 26 '11 at 22:32

1 Answer 1

As many are fond of saying: "Nuke it from orbit"

Remove all internet connectivity, backup important files (even those can't be trusted fully though) and DBAN that thing.

share|improve this answer
1  
+1 - that has to be one of my favourite way of dealing with things –  Mark Henderson Jan 26 '11 at 22:37
    
I'd add that you should restore from a backup made BEFORE the attack. Anything on that system is now suspect, to say the least. –  John Gardeniers Jan 27 '11 at 2:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.