HOW DO i GET RID OF A HACKER ON MY LINE

---

Request for Question Clarification by joseleon-ga on 13 Aug 2003 05:03 PDT

Hello:
  You should give us more info, how do you know there is hacker on your line?

Regards.

---

Clarification of Question by moneypenny-ga on 13 Aug 2003 05:30 PDT

I CAN SEE SOMEONE IS TRYING TO BREAK INTO MY FIRE WALLS AS MY IP
ADDRESS IS MAKING PING ATTACKS ON THIS DESTINATION IP ADDRESS
165.165.193.139. THIS IP ADDRESS IS MAKING NETBIOS BROWSING ON MY
ANTI-VIRUS PROGRAM SINCE 31 JULY ON A DAILY BASIS AND IS WORKING
THROUGH DIFFERENT SOURCE DESTINATIONS

---

Clarification of Question by moneypenny-ga on 23 Aug 2003 04:30 PDT

I HAVE SEND THESE INFORMATION ON TO ABUSE@SAIX.NET WHERE THEY SEND A
E-MAIL TO ME INFORMING ME THAT TELKOM WILL CONTACT ME, BUT NOTHING
HAPPENED EVER SINCE AND THIS PING ATTACKS IS STILL GOING ON ON A DAILY
BASIS.
THE LATEST IP ADDRESS BEING USED IS 165.165.198.249 IT IS ALWAYS THE
LAST SIX DIGITS THAT IS CHANGING

On doing a reverse IP lookup I found this information:
Search results for: 165.165.193.139 


OrgName:    Telkom
OrgID:      TELKOM
Address:    Soekor Building
Address:    151 Frans Conradie Ave
City:       Parow
StateProv:  Western Cape
PostalCode: 7500
Country:    ZA

NetRange:   165.165.0.0 - 165.165.255.255
CIDR:       165.165.0.0/16
NetName:    IPNET-ADSL
NetHandle:  NET-165-165-0-0-1
Parent:     NET-165-0-0-0-0
NetType:    Direct Assignment
NameServer: IGUBU.SAIX.NET
NameServer: SANGOMA.SAIX.NET
NameServer: NS1.TELKOM.CO.ZA
Comment:
RegDate:    1993-06-30
Updated:    2003-01-13

AbuseHandle: TIA-ARIN
AbuseName:   Telkom IPNet Abuse
AbusePhone:  +2712 6770224
AbuseEmail:  abuse@saix.net

NOCHandle: TIN2-ARIN
NOCName:   Telkom IPNet NNOC
NOCPhone:  +2712 6770224
NOCEmail:  nnoc@saix.net

TechHandle: PB455-ARIN
TechName:   Bezuidenhout, Pieter
TechPhone:  +2721 9302789
TechEmail:  bezuidp@telkom.co.za

OrgAbuseHandle: TIA-ARIN
OrgAbuseName:   Telkom IPNet Abuse
OrgAbusePhone:  +2712 6770224
OrgAbuseEmail:  abuse@saix.net

OrgTechHandle: TIN2-ARIN
OrgTechName:   Telkom IPNet NNOC
OrgTechPhone:  +2712 6770224
OrgTechEmail:  nnoc@saix.net

# ARIN WHOIS database, last updated 2003-08-12 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

_______________________________

Without knowing the details of the attack (i.e. information obtained
through the logfile generated by your firewall) I'd suggest sending an
email to "abuse@saix.net" which is their abuse reporting email address
and asking them how best to proceed.

i ALREADY HAVE THIS INFORMATION SEND TO ME. AS A MATTER OF FACT THE
FOLLOWING IP SOURCE MAKE PING ATTACKS ON MY IP ADDRESS 192.168.10.200
i DID SOME RESEARCH ON GOOGLE AND READ A LITTLE ON THE SUBJECT BUT DO
NOT UNDERSTAND WHY THIS IS HAPPENING

Hi, moneypenny.

Take it easy! =)  It seems that your firewall is successfully blocking
the traffic.  .. If I understand the situation correctly, there hasn't
been any breach of security on your computer.  There's just traffic
coming in, and your firewall is reporting it to you.  It is
unfortunate that your firewall is reporting it to you in bright red,
large letters.. Am I right?  .. Don't worry.  The IP addresses that
you see traffic coming from (on netbios ports) are probably just other
people's computers that have become infected with any number of
viruses and worms..  The worm then tries to connect to random
computers (you) and infect them too.  But your firewall is blocking
the attempts.

Just in case your firewall does fail sometime, you should make sure
that you have all the latest Critical Updates for Windows.  To check,
visit the Windows Update website at http://windowsupdate.microsoft.com
.

Hope this helps (or comforts, at the case may be.)

Many "attacks" are nothing more than internet noise.  If you are sure
someone is trying to hack you, I would recommend searching for
"shields up" and have there free on-line service scan your ports.  It
will show you where you are vulnerable to attack.  If everything is in
stealth mode, you're pretty safe.  I would then ignore the logging of
such events.

If it is truly a hacker, I would question why is he/she attacking you?
 If your system is in total stealth mode, they will not receive any
feedbak on their progress.  They won't even know, if your computer
exists.  If it continues, it may be someone you know waiting for you
to let down your guard.