how do 'they' trace me-part2.

Cheers framework,whizkid and others for the advice. I met this person on the AOL football message boards(go and have a look).He/she goes under the name of Bose followed by anumber,usually 222 or 321.He/she can be found on the arsenal and spurs boards. Just 'insult' spurs quite a lot and watch what happens next.I dare someone to find out who this 'looper' is.Im being attacked as i write. On my FW logs i do get his ips etc..but they are constantly coming from everywhere,not just one Isp. I get a new Ip addy everytime i log on with my Isp so i presume its not static.Ive changed my email addy,and passwords alot but he/she keeps finding me??I havent been on the boards for months .I have dobbed them in but it seems to do no good.BTw,this person has loads of screen names on the boards that have convo's with themselves-this is a very unusual person i believe.Perhaps somebody should try to find them,then i could inform somebody about them.I keep my stuff always up to date and i also get a free online scan aswell as my normal AV software.Would getting a new modem help??Can they find my modem id on the net??Cheers.Tommy gun.Btw,this person did send a few trojans and viruses originally but i got rid of themand they attacked my hard drive so it wouldnt workbut i got it sorted out.i think this person is trying to just really get under my skin because i made them look a fool on the football boards.I wasnt rude or anything but they were being racist etc,...etc... on the boards and i 'told them off'.This person constantly 'attacks' others on the AOL football boards and i think they are extremely evil and need the authorities onto them.Thanks.

So have you contacted the authorities and filed a complaint or multiple complaints with both AOL and the ISP the person is using? At this point, I'd almost say "stalking"..

As for the modem, as long as your IP is truly DHCP (that is, it changes regularly) it will be difficult but evidentally they may be pulling your information from an email that they are receiving from you (you may be unknowningly sending them a legit email and they are using that). Might want to speak to your ISP about ways to help deal with this.

Another thought may be for you to change your regular handle to a new one and you may want to start hiding your IP here. If it's someone from here, they can see your ip address when they get the listing of "Who's Online" (hence the reason why I hide myself here.. :D)

There could very well be a trojan in your computer sending the attacker information such as your email address, IP and any other information that he might use againts you. Try running THE CLEANER trojan remover and also do a search for sub7 and backorifice. The reason the person has multiple names talking to themselves is to confuse newbies. Run some up-to-date antivirus, antitrojan programs to clean your computer. You said you cleaned up all the trojans but might have been a few that have slipped through. Let us know if you find any more information.

It is most likely a trojan, check online for a free virus scan.

http://housecall.antivirus.com/housecall/start_corp.asp

http://www.ravantivirus.com/scan/

I would agree with the consensus it has to be a trojan. Since you using a dial-up on an aol account the only way someone could keep track of is if they had something on your machine that sent information to a certain location(it could be email,irc,certain ip whatever).

You might want to open up a command window and run netstat -na and get a list of open connections. I would do it right when I go online and repeatedly check it. Id try to figure out what any established or even listening connections are.

I could be wrong but I did not think he could get your ip from your 'who's online' list. Generally all chat communication and whos online goes through the aol server, the only time youd actaully be able to see the ip of someone your communicating with is if you do a file transfer and it sets up a direct connection between you and the other end.

Umm.. .here on AO, you do see the IP address on the Who's Online list.

Thanx for all the advice so far.I really appreciate it. :0)
I did an RAV antivirus scan and that came up clear and so did norton and mcafee and trend micro.I feel it is possibly a trojan but how come i cant find it?surely formatting/recovering which ive done a few times would remove a trojan?

P.S>Ms mittens-how do i hide my ip on here?

jewelius:

Go to Edit Site Options and select Yes for Invisible Mode. You may want to make sure that for other websites it hides your status. Many sites have this option in preferences. You may want to visit http://www.moosoft.com , home of The Cleaner. The Cleaner is software that detects specifically Trojans. Try rebooting and running it in Safe Mode, non-connected to the Internet.

Other things to consider to detect would be checking to see if any processes running on your machine are ones that you don't recognize and/or any connections that aren't related to existing activities.

What specifically has he done to make you think he actually has access to your machine and isn't just attempting?

Thanx Ms.Mittens 4 the advice. Ive already tried the cleaner and it didnt find anything. I cant understand how 'he' can know my IP addy though. I dont think they have control of my computer but to constantly attack it and dismantle my Firewall then they must somehow know my changing IP.How???As soon as i go online i get a popup saying"high risk-a remote computer is trying to access your computer".Ofcourse i block them but i get loads from different IPs constantly. I basically want to know how i can 'hide' from this bizarre being.What they get out of it im not sure but there are some very strange people out there.I just reinstall or format so its not doing me any harm,just extra work thats all but then again im sure its even more work for them basically for nothing.Oh well its teaching me a few things about computers that i wouldnt have known anyway. :0)
It appears that the only programs running are my ISP,backweb,generic host process,firewall.
I cant see anything that shouldnt be there.Its a mystery.Cheers.Tommy.

Your ISP software?? I wonder if he has a remote control software that connects via NetBIOS or something like that. I've seen a prof who had software like this where it picks up and "controls" a machine if you have the IP. Could he have software that would remotely control the ISP Software? (Perhaps he works or used to work for the ISP?)

Thanx Ms.Mittens but i still dont see how he would know my IP.If nobody knows here then i dont know who will. :0(
Thanks anyway.

OK...............I will ask Lancaster Gate (that's where our football association hold court) to ban tottenham hotspur?........just because the other guy is a gooner?


Having now made total sense to the whole AO ccommunity :D it is about sports teams...but one guy does seem out of order...I will have a go at him tomorrow......but I quite like Spurs football??????just see if he rises to the bait?

Hey jewelius....have a laugh:; please?...............I will do what needs to be done from my end



and I support SPORT, not teams


cheers

EDIT: If you persist in using AOL, you will receive the service that you obviously deserve, have great fun....................but DO NOT WHINGE HERE

MsMittens:

Quote:

---

Umm.. .here on AO, you do see the IP address on the Who's Online list.

---

I use this 'users online now' function quite often but I have never seen an IP address there.
Are you talking about another feature. Perhaps it is something the moderators/administrators can see but I have never seen anyone's IP in the place mentioned.

On for example the forum of mod-x.co.uk your IP gets posted with the posts you make untill you reach a certain level.
Admins (and perhaps moderators) can always see where you are connecting from on a message board.

OK...............I will ask Lancaster Gate (that's where our football association hold court) to ban tottenham hotspur?........just because the other guy is a gooner?


Having now made total sense to the whole AO ccommunity it is about sports teams...but one guy does seem out of order...I will have a go at him tomorrow......but I quite like Spurs football??????just see if he rises to the bait?

Hey jewelius....have a laugh:; please?...............I will do what needs to be done from my end



and I support SPORT, not teams


cheers



Hey nihil. Im not really sure what you were saying but thanks. I support Arsenal but i like all football ,abroad aswell and im a sports fan too.I have got a sense of humour but having your PC constantly attacked is not really my idea of a good night out. :0) This other person doesnt appear to have a sense of humour and has gone way overboard.cheers anyway and good luck.

Hey J.

The gooners are a tasty outfit.....but we have to be mature about this, he should not attack you...I will not be able to help because I will not tolerate AOL.................I would not prostitute myself for even 5 minutes!!

Have you tried talking to Chelsea supporters...............or Leeds United?

:D

Cheers

MsMittens

Can you tell me how you get the ip of other individuals in your whos online, is there something you set in the options that I cannot see.

I suggest you try start>run>netstat -an 3 and check your connections from time to time and you could always change you firewall(BlackIce sounds nice...), try to trace their comp, if it still comes from different IPs then I can bet his spoofing his IP(running raw sockets on *NIX OS).
Changing your ISP is always a solution...I would suggest you formating c and installing an OS like Linux Redhat or Windows 2003 Server.That's just my .02 worth...

Ok... you say he's attacking you from multiple IPs, are you sure its him?

My FW logs are full of various scans/connection attempts from all over the world (mostly worms trying to use the RPC DCOM vulnerability at the moment), you've got a FW running so theres not really much of a problem.

Correct me if I'm wrong, please.



p3pC

Hrmm... May be a moderator only thing if none of you are seeing the IPs (and yes, it's Users Online... bad habit to think of it as who is online).

That said, it doesn't change the importance of being somewhat paranoid at websites visited. Since jewelius doesn't appear to know who his "stalker" is, starting to make it harder for someone to even attempt to get the IP is a good way to go IMHO. Eliminate the possible and the impossible become the answer.

When he thinks he's being attacked, netstat might be a helpful tool to see potentially the "how" the guy is connecting.

Thanks everybody for the advice. Whats wrong with AOL? Whats the best ISP? I personally think AOL are quite good but i may change.


I just did the netstat thing-thanx guys and here are my findings;

proto; Local addy; foreign addy; state;
tcp my PC name:1027 my PCname:1041 Established.
tcp " " " :1040 berp-ma08.dial.aol.com:13784 Established
tcp " " " :1041 local host:1027 Established
tcp " " " :1042 205.188.41.108:5190 Established

Can anybody decipher this? I presume the 2nd one is my AOL connection.The 205 number i also have on my FW but as 205.188.146.146. which is uk.proxy.aol.com.It doesnt appear to be a risk though, just dropped packets.Thanks all once again.Cheers for the tip chromatic.Jewelius.

Since i did this 2 more connectiona appeared as follows:
Tcp My pcname:1281 VTOT.proxy.aol.com:11523 Time-wait
tcp " " " :1283 VTOT.proxy.aol.com:11523 Time-wait

Hi mate!

I am in the Uk and use Tiscali and FreeUK. The first is more like AOL, the second, just a connection. Both are 56.6 dial-ups, and are "free" if you choose that option (pay as you go)

I am now using BT broadband...........awesome!!!

Keep us informed of your progress


BTW...............bait out.......no bites yet :)

cheers