Was I being hacked? Here's an IP, analyze it please.

[antness]

My computer was just running really really slow...i couldn't open my volume control, explorer was crashing, and it would take like 10 minutes to open a Word file..there was network activity when I wasn't active so i unplugged it and everything started working fine.

Then windows xp puts this message on my screen:

216.33.111.110 has requested information from this computer. What connection would you like to use to connect?

- ISP 1
- ISP 2, etc

can someone figure out just who 216.33.111.110 is? thanks

 

[Jfur]

that's all I could find, an IIS 5.0 server

Exodus Commnications Inc. (NETBLK-ECI-7)
1605 Wyatt Dr. Santa Clara, CA
95054US
US

Netname: ECI-7
Netblock: 216.32.0.0 - 216.35.255.255
Maintainer: ECI

Coordinator:
Center, Network Control (NOC44-ARIN) CompServ@Exodus.net
(888) 239-6387 (FAX) (888) 239-6387

Domain System inverse mapping provided by:

NS.EXODUS.NET 206.79.230.10
NS2.EXODUS.NET 207.82.198.150

* Rwhois reassignment information for this block is available at:
* rwhois.exodus.net 4321

ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE

Record last updated on 09-Mar-2000.
Database last updated on 21-Jul-2001 23:13:10 EDT.

 

[bigbootydaddy]

do a netstat -n and see what port they trying to get in.

booty -n

 

[Locutus of Board]

Could be that IIS server has code worm virus.

 

[Jfur]

I think it ends up in Sterling, VA, part of that same Exodus network.

 

[antness]

sterling is like 5 miles away from here

 

[Jfur]

well, you can try that 888 # -- they probably won't do anything, but at least report it.

did you run netstat (like booty suggested)? how about searching for trojans, etc?

 

[BooneRebel]

I'd be more concerned about what is on your system now. The IP address itself may be harmless, just a 'host' for some script kiddie's worm.

 

[CinderElmo]

There is a site called hackyourself.com which can show you any trojans that are running and also your vulnerabilities...but they seem to be down (permanently?).

Also grc.com to test yourself.

Also check your task manager to see if something odd is being run.

Try putting on zonealarm if only to get a feel for what is trying to access the web and access you.

 

[StageLeft]

zonealarm.com rocks - download it!

 

[slag]

<< zonealarm.com rocks - download it! >>



Wait.. you want him to download the entire website?
What a boob

And I really don't like zonealarm. It is not very customizeable like tinyfirewall is.

Joe