• November 15, 2019, 05:51:02 PM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Pages: 1 [2]

Author Topic: Am I being hacked??  (Read 15440 times)

Fatman

  • Level 9 Member
  • ****
  • Posts: 1675
Re: Am I being hacked??
« Reply #15 on: April 02, 2009, 03:15:39 PM »

/. had a post today on a cornflicker eye chart that I found amusing.  It would be interesting to see what results you get on it from an infected host.  The theory seems sound given what little I know of cornflicker.  As always it would be at your own risk.
Logged
non progredi est regredi

suprra_girl

  • Level 1 Member
  • *
  • Posts: 19
Re: Am I being hacked??
« Reply #16 on: April 02, 2009, 03:23:17 PM »

I did a scan with mcaffee's conficker scanner and it searched ips from 1 - 254 and nothing. Is there another one you want me to try? Have a link? I couldn't really find info/scanners? related to antiroot detecter for conficker
Logged

Fatman

  • Level 9 Member
  • ****
  • Posts: 1675
Re: Am I being hacked??
« Reply #17 on: April 02, 2009, 03:46:47 PM »

I was referring to a http://slashdot.org post this morning (april fools day is a constant affair there) showing a eye chart to detect cornflicker installations.

The links was

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

That said while it appears sound based on what little I know of cornflicker, I am not the person to run to for security advice, and I can't confirm that this is an effective test.
Logged
non progredi est regredi

suprra_girl

  • Level 1 Member
  • *
  • Posts: 19
Re: Am I being hacked??
« Reply #18 on: April 02, 2009, 04:00:55 PM »

My computer appears fine so far... I did find obfuscated.A trojan on my mums pc which is now cleaned, it ended up in a file called torrent101.exe which neither of us recall downloading :/

My scanner is at 99% with nothing detected yet :)
My mums pc however is finding a few little trojans, they appear to be related to games but I've deleted them anyway :)
Logged

Lycan

  • Administrator
  • Level 15 Member
  • *
  • Posts: 5335
Re: Am I being hacked??
« Reply #19 on: April 02, 2009, 04:55:57 PM »

none the less, my guess is the firewall is simply doing it's job. blocking unwanted traffic, it could be as simple as those IP were part of the swarm you were a member of last and are simply not ack'ing your disconnected status. Unless you see breaches, I wouldn't sweat it.
Logged

suprra_girl

  • Level 1 Member
  • *
  • Posts: 19
Re: Am I being hacked??
« Reply #20 on: April 02, 2009, 05:47:22 PM »

Yep, I can see that it's blocking it so that's great, I was just curious as to what these constant listings were but am glad that the router is doing it's job well

Thank you all for your help, I appreciate it alot :)
Logged

SouthPawn

  • Level 1 Member
  • *
  • Posts: 5
Re: Am I being hacked??
« Reply #21 on: July 16, 2009, 05:30:55 PM »

I think Lycan is right,

I saw your other post: http://forums.dlink.com/index.php?topic=2954.0

Where you state you're using the DGL-4100 and 502t together. I'm gonna guess that the 502t is natting the connections to the dgl-4100 and what you're seeing is a connection state the 502t has established that the dgl-4100 has already timed out.

Whenever you run two gateways in-line with each other you're going to see an uptick in blocked connections, this doesn't mean you're getting hacked it just means the state tables aren't synced 100%, which is mostly likely due to the state timing out on the dgl-4100 before the 502t.
Logged

suprra_girl

  • Level 1 Member
  • *
  • Posts: 19
Re: Am I being hacked??
« Reply #22 on: July 16, 2009, 05:39:43 PM »

Err, I appreciate the response but you should have read my last post
http://forums.dlink.com/index.php?PHPSESSID=ab4e031ed8bdf7803598305245cf07ab&topic=2954.msg15976#msg15976

The purpose of that thread was to get bridge mode working correctly. As posted in that thread I noted that the 502T with isp firmware is a pos. And that's all I can say about it LOL.
If you had read a litltle further you would have seen that I wrote up a solution for NZ users.

Thanks for your reply.
Logged

SouthPawn

  • Level 1 Member
  • *
  • Posts: 5
Re: Am I being hacked??
« Reply #23 on: July 16, 2009, 06:21:00 PM »

I did read the rest of your forum post, the most logical explination lies in how a half-bridge setup works.

if you run a trace route from you system you'll see a hop in there, the ip address of the modem, because in half-bridge mode it still working similar to a router.

Having said that, I stand by my answer, you're likely seeing connections that have expired on the dgl-4100 but have yet to expire on the modem itself.

Check out http://www.dslreports.com/forum/remark,14201975, it's quite insightful.
Logged

suprra_girl

  • Level 1 Member
  • *
  • Posts: 19
Re: Am I being hacked??
« Reply #24 on: July 16, 2009, 06:24:14 PM »

The modem is not using nat at all (the dynalink) I turned it off so it's just a modem and nothing else.

I'll read your link

Cheers :)
Logged

suprra_girl

  • Level 1 Member
  • *
  • Posts: 19
Re: Am I being hacked??
« Reply #25 on: July 16, 2009, 06:38:27 PM »

Omg, they have some horrible tracert results!

40ms ping to their modems!!!! They need to sort the network out I think haha.

Thanks for the link, it was interesting seeing other peoples connections. I like mine :)
Logged
Pages: 1 [2]