iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (1)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
NEED HELP
  • ckritnalej1337
    Posts: 23
    can you help me? I have been hacked. I run the netstat and neststat -ano commands and i see ip's that are "established" which are not me.

    For example, i see:

    local ip 192.168.1.71 with a foreign address as 143.127.102.32:https

    And i also see foreign addresses that look like:

    aretsa01:https
    iy-in-f139:http
    customer-187-141-2-88-sta:http
    v-client-1b:https
    sjc-not6:http

    i also sometimes see this as foreign address
    logger:http
    and it will have this SYN_SENT instead of "ESTABLISHED"

    i have already restored my computer to factory default and its still there.

    please help
  • Sh3llc0d3
    Posts: 1,910
    Do a full sweep with malwarebytes. Update it first.
  • sangf
    Posts: 203
    143.127.102.32 whois returns: symantec corp -> accessing directs to norton home page :p also syn_sent is probably something that is attempting to connect but failing (or just in the process of awaiting a response): http://en.wikipedia.org/wiki/Transmissi ... ablishment
  • Sh3llc0d3
    Posts: 1,910
    Translation:
    In actuality your norton software is updating or something along those lines.
  • ckritnalej1337
    Posts: 23
    said:


    Translation:
    In actuality your norton software is updating or something along those lines.



    From what I read and understand is if I see something other than 127.0.0.1 or 0.0.0.0 when I run netstat or netstat -ano then it is someone else connected especially when it says "ESTABLISHED"

    True?[hr]
    said:


    said:


    Translation:
    In actuality your norton software is updating or something along those lines.



    From what I read and understand is if I see something other than 127.0.0.1 or 0.0.0.0 when I run netstat or netstat -ano then it is someone else connected especially when it says "ESTABLISHED"

    True?


    Norton isn't running when I see these.
  • Sh3llc0d3
    Posts: 1,910
    said:


    said:


    Translation:
    In actuality your norton software is updating or something along those lines.



    From what I read and understand is if I see something other than 127.0.0.1 or 0.0.0.0 when I run netstat or netstat -ano then it is someone else connected especially when it says "ESTABLISHED"

    True?[hr]
    said:


    said:


    Translation:
    In actuality your norton software is updating or something along those lines.



    From what I read and understand is if I see something other than 127.0.0.1 or 0.0.0.0 when I run netstat or netstat -ano then it is someone else connected especially when it says "ESTABLISHED"

    True?


    Norton isn't running when I see these.


    Right, go into "services.msc". Stop ALL norton/symantec services - completely. The fact you say Northon isn't running, means you have it installed. A service or part of the norton product is running and connected to another system. Don't alter anything in services.msc apart from stopping the services. Then run netstat. You'll see the issue is resolved if you've closed all their programs. If it's not then you need to contact symantec/norton and delve deeper into the precise connection.

    netstat -ano (as far as I'm aware) gives you the process ID and also the socket information (source and destination). Find the PID and look it up in task manager or using process hacker.

    PS: to undo changes made in services.msc reboot your pc.
  • sangf
    Posts: 203

    From what I read and understand is if I see something other than 127.0.0.1 or 0.0.0.0 when I run netstat or netstat -ano then it is someone else connected especially when it says "ESTABLISHED"

    True?



    not true. it will show all connections, incoming or outgoing (including you > somewebsite). established is just a state, could happen on any tcp connection (in or out).


    -a Displays all connections and listening ports.
    -n Displays addresses and port numbers in numerical form.
    -o Displays the owning process ID associated with each connection.



    of course, it could be a malicious connection, but it's doubtful with such a target destination.
  • ckritnalej1337
    Posts: 23
    The who is on the ip address 192.168.1.71 comes back as private and untraceable belonging to ARIN?????

    I was on hackforums and I was asking about some software and how it is used. Someone invited me to Teamviewer and Skype and like a dumbass I accepted. He was acting all weird and then I got uncomfortable and closed it out. Ever since then I've been seeing these things.

    I sent a semi-nasty email to this guy and his crew leader and then next thing you know .... weird shit happens.
  • Sh3llc0d3
    Posts: 1,910
    192.168.1.71 is your local LAN address!
  • ckritnalej1337
    Posts: 23
    said:


    192.168.1.71 is your local LAN address!



    Local LAN?? WTF?? Are you saying it's impossible what I'm saying? I hope thats the case but shits very weird.
  • Sh3llc0d3
    Posts: 1,910
    I'm saying thats it's insane.

    No one has hacked you. Unless it's an extraneous issue to this situation. You have a service connected to symantec's service. Its using SSL.

    Your pc 192.168.1.71 is connected to Symantecs server. LAN = Local Area Network. You can't whois your local address (192.168.1.71). Whois is for domains and remote host/server IP addresses not your local network addresses.
  • ckritnalej1337
    Posts: 23
    said:


    I'm saying thats it's insane.

    No one has hacked you. Unless it's an extraneous issue to this situation. You have a service connected to symantec's service. Its using SSL.

    Your pc 192.168.1.71 is connected to Symantecs server. LAN = Local Area Network. You can't whois your local address (192.168.1.71). Whois is for domains and remote host/server IP addresses not your local network addresses.



    Unless it's an extraneous issue to this situation. Yes, this is what I believe.
  • sangf
    Posts: 203
    yep. 192.168.x.x are private addresses, used for your local network. this could be an address for one of the computers on your local network, your router itself, or the private ip your router assigned for you (aka your external ip as far as your computer is concerned: this would make the most sense).
  • ckritnalej1337
    Posts: 23
    http://elamb.org/hacked/IDTools.htm

    what about what it says here? this is exactly what mine is doing when I run netstat!
  • Sh3llc0d3
    Posts: 1,910
    An "extraneous issue" means something outside what you have told us.

    They say clearly:

    If there is a ridiculous amount of activity scrolling up the screen and your system is a sluggish, you may have a Trojan, virus or worm.



    That is in no way a definite. You may have. That warrants checking into the source of the connection and where its going. Thats been done. Your the one end and symantec is the other. Unless symantec has been hacked just for the purpose of a revenge attack on you i'd say your safe on this occasion.
  • ckritnalej1337
    Posts: 23
    said:


    An "extraneous issue" means something outside what you have told us.

    They say clearly:

    If there is a ridiculous amount of activity scrolling up the screen and your system is a sluggish, you may have a Trojan, virus or worm.



    That is in no way a definite. You may have. That warrants checking into the source of the connection and where its going. Thats been done. Your the one end and symantec is the other. Unless symantec has been hacked just for the purpose of a revenge attack on you i'd say your safe on this occasion.


    No ... nothing outside what I've told you. The hackforums experience being the biggest red flag. Yes, there sometimes is a ridiculous amout of activity scrolling up the screen.
  • sangf
    Posts: 203
    maybe post some complete details about your suspicion, not really much to go on about now. process and network tab dumps from process hacker might be helpful to see (select tab, ctrl+s -> pastebin url to here).
Add a Comment