HELP! I think someone is trying to get into my computer.

How can I tell if someone is hacking my computer? This is a person that I know and lives in the same town as me. I have my own message board and this person is a member of it, so I was able to jot down a few of their IP addresses that are logged on the board.
The guy that hosts my website has proof that this person has hacked a mutal friends home computer, so I think they are trying to get into mine too, along with my moms computer.

I have the McAfee Personal Firewall and it has logged numerous ICMP Pings and some other events such as, World Wide Web HTTP, Port 3127 (TCP), DCE endpoint resolution, Microsoft-DS, etc...


Here are some of the entries on my Firewall log:
2004/02/28 19:16:31 172.192.12.223:3602 (ACC00CDF.ipt.aol.com) 172.192.144.251:80 World Wide Web HTTP

2004/02/28 19:35:16 172.192.58.225:4258 (ACC03AE1.ipt.aol.com) 172.192.144.251:80 World Wide Web HTTP

2004/02/28 19:33:54 172.192.58.225:1892 (ACC03AE1.ipt.aol.com) 172.192.144.251:80 World Wide Web HTTP

2004/02/28 19:16:31 172.192.12.223:3602 (ACC00CDF.ipt.aol.com) 172.192.144.251:80 World Wide Web HTTP

2004/02/28 18:59:39 172.192.95.29:2113 (ACC05F1D.ipt.aol.com) 172.192.144.251:80 World Wide Web HTTP

2004/02/28 07:47:14 172.132.174.110:0 (AC84AE6E.ipt.aol.com) 172.135.139.208:0 ICMP Ping


Here are a some of their IP's from my board:

Today: 172.199.1.170
Yesterday: 172.195.13.45
2/25: 172.197.99.169
2/24: 172.192.96.180
2/21: 172.194.43.156
172.195.13.45


I have no idea how to prove its this person or find out what they know, I am at a loss...
Any info would be truley appreciated!

April

do a whois (in windows) get to you command prompt then type in: tracert x.x.x.x (ip numbers)

Don't even bother with stuff like pings and attempts to access port 80. These things are just 14 year olds trying to be smart.

Cheers,
cgkanchi

first of all get your ip adress off the board.

if you get these requests when you first sign on its because you've been assigned an ip address of someone who has recently signed off and was sharing files on the kazaa network which uses port 80.

if not it could be one of the code red victims still out there or just some kid scanning for a victim or just plain scanning. scanning isnt against the law you know.

I need to know if these pings are coming from the person that I know... is there a way to find out?

I am really new to this stuff.... What do you mean by get your ip address of the board?
I can see the member's IP addresses because I am the Admin. no one else can see my ip or anyone else's unless they are admin.

do you keep updated anti virus software on your computer? in order for someone to know YOUR ip address it either has to be sent to then by a trojan of some sorts, exchange a file with them or have it posted on a bbs like you just did :-) same goes for theirs

im sorry i meant to type "off" the board. your the admin of AOL? your confusing me.

aol uses dynamic ip addresses. every time you or anyone else signs on their assigned a differant address with no information given as to who has what address

OK mate try this:

/ME...no more Mr niceguy mode

Post this on your message board:

"WARNING this site has a ZERO tolerance of uber 1337 Hax0rs and other internet scum. All activities on this site WILL be monitored, and anyone suspected of illegal activity reported to the relevant authorities.

To Report Internet Crime:

http://www.usdoj.gov/criminal/cybercrime/reporting.htm

Remember, these people are criminals...............it is YOUR civic duty"

That should liven him up a bit :D

Maybe a bit later ask him how his dad would react to being woken at 3am by the foresight of a Glock 9mm tickling his tonsils?.............as well as all computer equipment impounded for months, if not forever?

/Back to Mr niceguy

He might just get the message?.........like you are only 1337 until you get caught, then you are a *******?

Good luck....follow the other good advice, but I read this as one who needs to be scared off?

Quote:

---

Originally posted here by Tedob1
im sorry i meant to type "off" the board. your the admin of AOL? your confusing me.

---

Sorry about that. I have my own website, which has a message board, I can see the IP numbers of people that post.

The person that I suspect is trying to crack/hack my computer is a person I know. I need to get proof that this person is trying to do this so I can confront her with the solid proof.

The guy that owns the web hosting company I go thru already has proof that she has hacked into a mutual friends computer. I only assume that she is trying to get into mine to read my emails and instant messages and whatever else she can get her grubby hands on.

This person is not a child she is 27 years old. She has some major issues and is a total back-stabber. I need to gather proof that she has or is trying to get into my computer. So, far all I have are the entries in my firewall log (a few are posted in the first post of this thread). I really don't know how ip numbers work so I am having a hard time confirming that she is doing this to me. I have been having a lot of the same problems as the other friend we know she hacked.

I was able to gather several of the ip numbers that she had from my board and try to compare them to the ip's that are pinging me. I also listed those in the first thread.

Just because she's pinging you don't mean she's attacking you unless the pings are so volumnious that you cannot access the internet. That said, what OS do you use? Certain OSes have the ability to log and track changes on machines. And really, you have no proof it is her/him. Because of AOLs size, this could be anyone.

You may also want to go through the logs of your board. This can usually indicate issues or violations. If you work with your admin, you should be able to gather information that will prove it one way or another.

Quote:

---

The guy that owns the web hosting company I go thru already has proof that she has hacked into a mutual friends computer

---

Then this should be reported to the police. Unless I'm mistaken, the laws haven't changed and breaking into some's computer is still against the law.

Quote:

---

I only assume that she is trying to get into mine to read my emails and instant messages and whatever else she can get her grubby hands on.

This person is not a child she is 27 years old. She has some major issues and is a total back-stabber.

---

You know, this sounds childish. If you are serious about dealing with this, then honestly, act serious about it. Whatever issues happened in the past should remain there. Otherwise, it may look like a vendetta (attempting to prove someone did something wrong based on assumption and anger when they didn't do anything).

Try to remember that a person is innocent until proven guilty, not guilty until proven innocent. Right now, based on what you have presented, nothing wrong is happening. Until there has been an attempt to by-pass your firewall and data access, it's all legal.

There are two types of ip addresses. Static and Dynamic. It seems from the snippets of your firewall log that the person attacking your computer is using aol (AC84AE6E.ipt.aol.com) . AOL uses dynamic ip addresses, meaning everytime someone comes on, they get a new ip address. Static is the total opposite. You get the same IP addresess everytime. this is more for broadband. also, upon closer inspection of the ip addresses from your board and from your firewall logs, theyre not the same. the only thing about them that is the same is that they are from AOL. you can't say that so and so is attack your computer without more concrete proof than similar ip addresses. remember one thing about aol...it is a breeding ground for script kiddies....


slick

[edit] MsM beat me to the punch again. :( [/edit]

Nihil i believe that the special agents now are equiped with USP pistols and MP5s :)...

Quote:

---

Originally posted here by Coder365
do a whois (in windows) get to you command prompt then type in: tracert x.x.x.x (ip numbers)

---

I did this on three of IP's and the trace timed out 30 times each... What am I trying to find?

Thanks!

BTW- A HUGE thank you goes out to all that have replied to my problem!!!

Quote:

---

I did this on three of IP's and the trace timed out 30 times each... What am I trying to find?

---

Usually to find out if the machines are up and alive. This won't always work given that AOL has dynamic addressing (machines go up and down) and/or firewalls prevent ping response (something you can set on your firewall if you want). By preventing ping/ICMP response, you are "hiding" somewhat whether you are online.

Quote:

---

Originally posted here by MsMittens

You know, this sounds childish. If you are serious about dealing with this, then honestly, act serious about it. Whatever issues happened in the past should remain there. Otherwise, it may look like a vendetta (attempting to prove someone did something wrong based on assumption and anger when they didn't do anything).

---

The only thing I meant by them having issues and back-stabbing is I think they are capable of doing this and would do this to her friends/family. The web hosting guy is sending the proof to the friend and she is going to report her to the police.

Quote:

---

The only thing I meant by them having issues and back-stabbing is I think they are capable of doing this.

---

Anyone is capable of doing an attack and having the desire to attack. AOL is (was?) a haven for "scriptkiddies". Your machine may look like an inviting target because of the OS you run. Your forum board may be an inviting target if it has known flaws in it. Be careful that you don't immediately assume that any attacks are in fact from this person and not from a third party. All that an IP can tell you is the IP address of the machine at the time of an attack. It doesn't tell you who was at the keyboard when the attack happened.

Quote:

---

Originally posted here by MsMittens
Anyone is capable of doing an attack and having the desire to attack. AOL is (was?) a haven for "scriptkiddies". Your machine may look like an inviting target because of the OS you run. Your forum board may be an inviting target if it has known flaws in it. Be careful that you don't immediately assume that any attacks are in fact from this person and not from a third party. All that an IP can tell you is the IP address of the machine at the time of an attack. It doesn't tell you who was at the keyboard when the attack happened.

---

That is why I came here, to find out if I can even tell if it was her or not.
I would never accuse anyone of anything with out rock solid proof.

I have Windows ME. McAfee Virus Scan and McAfee Personal Firewall

Thanks for the replies, they have been very helpful!

Quote:

---

The only thing I meant by them having issues and back-stabbing is I think they are capable of doing this and would do this to her friends/family. The web hosting guy is sending the proof to the friend and she is going to report her to the police.

---

Uhhh.. Why isn't he reporting it to the police if his machine/server was the one broken into? or did I misunderstand something?

Quote:

---

I have Windows ME. McAfee Virus Scan and McAfee Personal Firewall

---

Hrmmm.. I'm not overly familar with ME but McAfee Virus I am. And I suspect the firewal ties in with the virus package. Right now, based on what you've presented there is little that you can do to "prove" who might be attacking you. I'd even go as far as to question whether this is even an attack at this point.

But you can do some things to prevent any potential attack from happening.

- Check the logs of your firewall regularly. Anything unusual happen?
- Check for unusual processes running in memory. TaskManager should be able to help (someone help me here: is there a "task manager" in ME that's brought up with the CTL+ALT+DEL?)
- Ensure that your anti-virus signatures are up to date
- be extremely careful about any attachments received in emails (viruses and trojans are often sent this way)
- download and install some spyware detection software (CWShredder is a good one as is HiJackThis!; Ad-Aware is another as is SpyBot -- Google can help you find these and many are free/shareware)
- ensure that your OS has all necessary patches/fixes. Microsoft, IIRC, has a WindowsUpdate feature that can help you with this.
- Be aware and alert; educate yourself on some of the risks.

Quote:

---

Originally posted here by MsMittens
Uhhh.. Why isn't he reporting it to the police if his machine/server was the one broken into? or did I misunderstand something?

---

The machine was not his. It belongs to a friend. He helped this friend get proof and is sending it to her.

Quote:

---

I'd even go as far as to question whether this is even an attack at this point.

---

That's what I want to know, how can I find out if there has been an attack?

Quote:

---

That's what I want to know, how can I find out if there has been an attack?

---

Based on the information provided, I don't think there has been one. What makes you think there has been an attack beyond the pings? Do you have more information beyond that? Does you firewall have more attack information (check the logs of the firewall)? Is there anything else that makes you think your machine has been broken into?

You need to check your system to see if data has been altered, if there are extra processes running, if things don't seem to be reacting the way they are supposed to (mail is marked read as you've downloaded it or before you read it), passwords get changed, you're logged into forum(s) twice -- eventhough you've only logged in once.

I don't think (although I could be mistaken) that ME has the capability to log activity done on the machine (accounts changed/added, etc.) as it was designed for simple home use rather than active logging/auditing (security in mind as it were).

Quote:

---

Originally posted here by MsMittens
Do you have more information beyond that? Does you firewall have more attack information (check the logs of the firewall)?

---

What do I need to look for in the logs?

MsMittens:

Quote:

---

I don't think (although I could be mistaken) that ME has the capability to log activity done on the machine (accounts changed/added, etc.) as it was designed for simple home use rather than active logging/auditing (security in mind as it were).

---

You are quite right, I have it on five machines, and have been running it for several years. It is basically "Win98 Third Edition", the last of the 9x series of domestic OSes.

Ctrl+Alt+Delete will bring up a rudimentary task manager, but I guess that could be circumvented quite easily?

I would suggest http://www.winpatrol.com for a better tool, AND HijackThis, which you have already mentioned.

Also http://www.digilander.libero.it/zancart

WinSonar 2003..............it checks background processes and can be set to kill unknown processes whilst you are connected to the internet.

I guess I would expect a fair number of hits on a machine using AOL as it is very popular, and will have a proportional number of "idiots" skiddies or whatever you like to call them :)

I am using BT broadband, and have had 29 hits (pings/scans) in the last 30 minutes.......I consider that to be "quiet" these days, but it is late, and most of them will have gone to bed.

Cheers

EDIT: Cyber1d.............MP5 huh?................not bad piece, I prefer the L34-A1 (Sterling) for competition work as it only has half the rate of fire and is very stable. At "the kind of range you don't have to bother to aim" I think the Ingram is the tool of choice, 1200rpm? But about as easy to aim as an angry tomcat
:D