hack attempt?

I think some jerk might be trying to hack me. Has anyone else had any intrusion attempts on their machine from IP 85.255.115.227? I traced the address on RIPE.net and it came back to some ISP in the Ukraine. My firewall stopped it trying to use something called "HTTP MS IE Dbl Backslash Local Zone Exec". After that, my AVS program got Download.Trojan and some other random trojan horse program in my Internet Explorer temporary files. So far, this IP address has tried to hit me twice, once while using my laptop at home, and once while using it at school. Has anybody else had a problem from this source? If so, what can be done about it?

Are you sure you dont have something on your laptop calling the IP address..."calling home"

so when you are connected to the internet the IP is alerted and tries to come back at you.

Sounds like a piece of malware "calling home"

MLF

Block that IP address in your firewall and see if this keeps up.

I would say you definatley have something installed that you shouldnt have!

If you think about it, When your at home you will have a different IP address than when you are at school, so if he has managed to find you in two different locations, you definatley have something 'calling home' as MLF said!

Why don't you post your firewall log entries which contain this ip address? Make sure you remove or obscure your own ip address.

Quote:

---

Block that IP address in your firewall and see if this keeps up.

---

Not gonna work if he has a dynamic IP address which is what 99.9% of home users have.

Also, Downloader.Trojan is exactly that. A trojan that downloads other spyware/adware/virii nasty type stuff. I would say that this is a 'calling home' situation for sure. Let's see those FW logs though, (obscuring your own info of course)

Ukraine??

I found the server at 85.255.115.227 in Amsterdam in the Netherlands. And he is running using Apache version 1.3.34 and PHP 4.40.

I've included a jpg listing a few ports under 200 that he's vulnerable with.

Have fun.

(The RIPE Whois resolves to Ukraine, but I don't trust it.)

Might I recommend that you install all the current MS security patches?

This is what might be on your machine:

http://www.symantec.com/avcenter/att...gs/s21421.html

Good luck ;)

Yes, I agree that the Ukraine does sound a bit suspicious

Here's a couple of pages on Downloader.trojan:

http://www.symantec.com/avcenter/ven...er.trojan.html

http://www.computing.net/security/ww...rum/14592.html

These threats are constantly evolving, you've got a full blown case of spyware. You got your work cut out for you.

Fwiw, it got in via an unsecured Internet Explorer. You need to tighten up IE or switch browsers.

Don't forget to shut off system restore before all the cleansing and then establish a new restore point when your box is squeaky clean. There's several thorough malware cleaning posts in AO, Ole Fox put together a cleaning tutorial so you might want to take a peek at it Foxyloxley

If I may add two cents, also include Ewido in your tool bag.

cheers

Some of the virus,spyware,adware and firewall software may have tracking in it(maybe check log) and the ablity to report to your software vender's web site.You will have to check your documentation or help files.Your service provider(tech support) would also like to know.After all it is going through thier server and may or could be affecting them as well other customers( they may track it for themselves,after all they are the professionals and also may offer some helpful tools from thier site). They can help sometimes.

To prevent future attack or lessen attacks...

A router is a good to have. I connect my adsl modem to it and my computer to the router. It acts as a physical firewall which can let you hide your ip address(not 100% but better than nothing) and allow you to turn some ports off.

I got so tired of the viruses and other crap that at one time I was running three types of scanning software(this can cause problems when trying to surf the net or run offline software). With eveyone of one them running,I could scan and find some type of virus,spyware or some other nasty stuff.One software would would pick some of it up but then other would find more but not what the other software found.

Find the best protection software for your computer.

I use Zone Alarm now. I have also used Spy Sweeper and AdAware SE.
Be aware of porn sites.. just like in real life these are loaded with viruses.. all kinds of s**t . Wares sites are maybe the worst. Many of them are run by hackers.. or hacker want ta bes.
the word," FREE" as in free softeware is good bait which can hide a trojan. If you must download,at least scan it before opening.

These are a few things I learn in the school of hard knocks.

please correct me if there are any errors...

xenoborg2001

I think that the time has come for you to sit back and take stock of your situation.

Based on this and your other thread, you appear to have been owned. There is only one reliable, secure solution in that situation:

Save data, reformat, reinstall, update.

Sorry pal, but that's the way it is :(

Quote:

---

Originally posted here by nihil
xenoborg2001

I think that the time has come for you to sit back and take stock of your situation.

Based on this and your other thread, you appear to have been owned. There is only one reliable, secure solution in that situation:

Save data, reformat, reinstall, update.

Sorry pal, but that's the way it is :(

---

If that is the case, then yeah. I have had to do that a few times in my computer/internet history... not fun.

I scanned my computer with both antivirus and my antispyware programs in safe mode and havent found any malware. I also havent had any more intrusion attempts in the last couple of days. I made sure both my Internet Explorer and Firefox browsers were up to date with the security patches. I don't know if I'm in the clear, but I havent had any more issues at this point. Thanks guys for your assistance.

It is possible that the ip you are seeing is not your hackers’ personal computer. More likely it is another computer that he has compromised. In this situation I would check your outgoing traffic logs to make sure he/she is not using your computer as a stepping stone to attack others. The legal problems for you when things like that happen can be major. Also I would not make a move against the computer that is attacking yours because of this possibility. What I would do is use the contact information listed under the whois for that ip and try to get the situation resolved.

Fast Web Hosting Support
01110, Ukraine, Kiev, 20Á, Solomenskaya street. room 201.
UA
+357 99 117759
[email protected]

Andrei Kislizin
OOO Inhoster,
ul.Antonova 5, Kiev,
03186, Ukraine
+38 044 2404332

IMHO

the best way to be 100 % sure you have nothing....

Backup data- format-reinstall-restore data

improves performance -cleans EVERYTHING up...including malware, system, reg entries etc

and is good practice ;)

MLF

Greeting's

Get an online scan done at either Trendmicro or Microsoft. If you can post your Hijackthis log.

1. http://housecall.trendmicro.com/

2. http://safety.live.com/site/en-US/default.htm?s_cid=sah

and get back to us.