Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 27 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Incident Responsearrow Am I hacked and is there a defence?
EH-Net
May 18, 2013, 11:32:11 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Am I hacked and is there a defence?  (Read 22724 times)
0 Members and 1 Guest are viewing this topic.
veronca
Newbie
*
Offline Offline

Posts: 3


View Profile
« on: March 03, 2011, 03:10:42 PM »

Hello,
I have problems with my PC and internet connection for a long time and I´m definitely unable to solve it.
Perhaps it would be better to show some examples:
4/2010
tracing to server seznam.cz

Microsoft Windows XP [Verze 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:Documents and Settingspc1>tracert 77.75.72.3

Výpis trasy k 77.75.72.3 s nejvýše 30 směrováními

1 1 ms 1 ms 1 ms 10.0.0.138
2 * * * Vypršel časový limit žádosti.
3 * * * Vypršel časový limit žádosti.
4 * * * Vypršel časový limit žádosti.
5 * * * Vypršel časový limit žádosti.
6 * * * Vypršel časový limit žádosti.
7 * * * Vypršel časový limit žádosti.
8 * * * Vypršel časový limit žádosti.
9 * * * Vypršel časový limit žádosti.
10 * * * Vypršel časový limit žádosti.
11 * 43 ms 43 ms www.seznam.cz [77.75.72.3]

Trasování bylo dokončeno.

after I discussed my provider (Telefonica) - according to it´s statement, there was no trouble - the tracing had after few days changed:

Microsoft Windows XP [Verze 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:Documents and Settingspc1>tracert 77.75.72.3

Výpis trasy k www.seznam.cz [77.75.72.3]
s nejvýše 30 směrováními:

1 1 ms 1 ms 1 ms 10.0.0.138
2 * 8 ms 8 ms 194.228.196.8
3 12 ms 12 ms * 88.103.203.33
4 13 ms 12 ms 12 ms 198.18.65.65
5 14 ms 13 ms 14 ms 198.18.10.37
6 13 ms 12 ms 13 ms 194.228.190.158
7 13 ms 12 ms 12 ms 194.228.190.157
8 13 ms 13 ms 14 ms nix.seznam.cz [194.50.100.195]
6 15 ms 13 ms 13 ms www.seznam.cz [77.75.72.3]

now it seems like this:

Microsoft Windows XP [Verze 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\h>tracert 77.75.72.3

Výpis trasy k www.seznam.cz [77.75.72.3]
s nejvýše 30 směrováními:

  1     2 ms     2 ms     2 ms  10.0.0.138
  2    40 ms    40 ms    39 ms  88.103.200.10
  3    47 ms    44 ms    44 ms  88.103.203.33
  4    47 ms    45 ms    44 ms  194.228.190.161
  5    46 ms    45 ms    45 ms  nix.seznam.cz [194.50.100.195]
  6    44 ms    45 ms    45 ms  www.seznam.cz [77.75.72.3]

Trasování bylo dokončeno.

Microsoft Windows XP [Verze 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\h>tracert 77.75.72.3

Výpis trasy k www.seznam.cz [77.75.72.3]
s nejvýše 30 směrováními:

  1     2 ms     2 ms     2 ms  10.0.0.138
  2    40 ms    40 ms    39 ms  88.103.200.10
  3    47 ms    44 ms    44 ms  88.103.203.33
  4    47 ms    45 ms    44 ms  194.228.190.161
  5    46 ms    45 ms    45 ms  nix.seznam.cz [194.50.100.195]
  6    44 ms    45 ms    45 ms  www.seznam.cz [77.75.72.3]

Trasování bylo dokončeno.

Microsoft Windows XP [Verze 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\h>tracert 77.75.72.3

Výpis trasy k www.seznam.cz [77.75.72.3]
s nejvýše 30 směrováními:

  1     2 ms     2 ms     2 ms  10.0.0.138
  2    40 ms    40 ms    39 ms  88.103.200.10
  3    47 ms    44 ms    44 ms  88.103.203.33
  4    47 ms    45 ms    44 ms  194.228.190.161
  5    46 ms    45 ms    45 ms  nix.seznam.cz [194.50.100.195]
  6    44 ms    45 ms    45 ms  www.seznam.cz [77.75.72.3]

Trasování bylo dokončeno.

Time to 10.0.0.138 is sometimes below 1ms.
But there are some others things which threaten me.
For example:
I do manualy clean my disk to cut free more space. I delete all possible temp files from: C:\Documents and Settings\h\Local Settings but when emptying basket it shows it´s not empty and if I try to reampte it shows label asking whether I want to delete file WINDOWS and if I agree then it says it´s it´impossible Dc6 can´t be deleted since it´s currently used: access was denied.
Sometimes it shows file Dc3, Dc23.
Once when started Firefox it started with http://95.168.201.76/ instead of google.com another time it started with http://dp.000.in/.
I used Combofix, avptool, SystemLook, HickjackThis but no problem has been found.
To protect my PC I´m using NOD32 and ZoneAlarm.

                                Thanks for Your help and suggestions

                                                                      Veronca
Logged
kriscamaro68
Jr. Member
**
Offline Offline

Posts: 61



View Profile
« Reply #1 on: March 03, 2011, 04:25:49 PM »

Why don't you just back up your data and re-install windows? If you do you need to scan the backed up data for possible malware as well. If your that worried about it that is probably the only way to get rid of a possible infection to the OS.
Logged

A+, Net+, Server+, Security+, MCP/XP
WCNA
Full Member
***
Offline Offline

Posts: 187



View Profile
« Reply #2 on: March 03, 2011, 05:58:58 PM »

The best answer has already been given- wipe the machine and start over.

However if you must:
Compare the traceroute from a different machine on the same switch to see if there's a difference
AND/OR
shut down all connections on the box, run wireshark, determine if any remaining traffic is legitimate. If you still have traffic after that....... wipe the machine  Grin
« Last Edit: March 03, 2011, 06:01:31 PM by WCNA » Logged

ISC2 Associate, WCNA, CWNA, OSCP, Network+
veronca
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #3 on: March 04, 2011, 11:14:54 AM »

I should mentioned that it´s not the first PC I´m using but troubles like that had appeared in about 24 hours in every one I had connected. I even tryed to secure them with different security soft (different antivirus, firewalls, antispy- antimale-ware) and I reinstalled OS many times but there was no effect.
I was told that it´s like revers DNS attack but I´m not sure.
Do You know some really good soft which is able to detect it?
Logged
WCNA
Full Member
***
Offline Offline

Posts: 187



View Profile
« Reply #4 on: March 04, 2011, 11:28:46 AM »

Detect it? Other than Wireshark, no. In your case, I'd consider deepfreeze from faronics.
Logged

ISC2 Associate, WCNA, CWNA, OSCP, Network+
veronca
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #5 on: March 10, 2011, 01:14:15 AM »

I´ll try it since yesterday while surfing ZoneAlarm showed me alarm: ZoneAlarm has detected a new network with IP (10.0.0.0/255.255.255.0) and added it to the Internet Zone.
Thanks
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.091 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.