Some1 Is Trying

**toco004** · 03-20-2004, 08:21 PM

someone is trying to hack me since yesterday

wut should i do?
heres the info: the ip to the hacker is 200.193.90.179

Code:

OrgName&#58; &nbsp; &nbsp;Latin American and Caribbean IP address Regional Registry 
OrgID&#58; &nbsp; &nbsp; &nbsp;LACNIC
Address&#58; &nbsp; &nbsp;Potosi 1517
City&#58; &nbsp; &nbsp; &nbsp; Montevideo
StateProv&#58; &nbsp;
PostalCode&#58; 11500
Country&#58; &nbsp; &nbsp;UY

NetRange&#58; &nbsp; 200.0.0.0 - 200.255.255.255 
CIDR&#58; &nbsp; &nbsp; &nbsp; 200.0.0.0/8 
NetName&#58; &nbsp; &nbsp;LACNIC-200
NetHandle&#58; &nbsp;NET-200-0-0-0-1
Parent&#58; &nbsp; &nbsp; 
NetType&#58; &nbsp; &nbsp;Allocated to LACNIC
NameServer&#58; TINNIE.ARIN.NET
NameServer&#58; NS.LACNIC.ORG
NameServer&#58; NS.DNS.BR
NameServer&#58; NS2.DNS.BR
Comment&#58; &nbsp; &nbsp;This IP address range is under LACNIC responsibility for further
Comment&#58; &nbsp; &nbsp;allocations to users in LACNIC region.
Comment&#58; &nbsp; &nbsp;Please see http&#58;//www.lacnic.net/ for further details, or check the
Comment&#58; &nbsp; &nbsp;WHOIS server located at whois.lacnic.net
RegDate&#58; &nbsp; &nbsp;2002-07-27
Updated&#58; &nbsp; &nbsp;2003-06-12

TechHandle&#58; LACNIC-ARIN
TechName&#58; &nbsp; LACNIC Hostmaster 
TechPhone&#58; &nbsp;&#40;+55&#41; 11 5509-3522
TechEmail&#58; &nbsp;[email protected] 

OrgTechHandle&#58; LACNIC-ARIN
OrgTechName&#58; &nbsp; LACNIC Hostmaster 
OrgTechPhone&#58; &nbsp;&#40;+55&#41; 11 5509-3522
OrgTechEmail&#58; &nbsp;[email protected]

# ARIN WHOIS database, last updated 2004-02-28 19&#58;15
# Enter ? for additional hints on searching ARIN&#39;s WHOIS database.

OrgName&#58; &nbsp; &nbsp;Latin American and Caribbean IP address Regional Registry
OrgID&#58; &nbsp; &nbsp; &nbsp;LACNIC
Address&#58; &nbsp; &nbsp;Potosi 1517
City&#58; &nbsp; &nbsp; &nbsp; Montevideo
StateProv&#58; &nbsp;
PostalCode&#58; 11500
Country&#58; &nbsp; &nbsp;UY
Comment&#58; &nbsp; &nbsp;
RegDate&#58; &nbsp; &nbsp;2002-07-27
Updated&#58; &nbsp; &nbsp;2004-02-24

AdminHandle&#58; LACNIC-ARIN
AdminName&#58; &nbsp; LACNIC Hostmaster 
AdminPhone&#58; &nbsp;&#40;+55&#41; 11 5509-3522
AdminEmail&#58; &nbsp;[email protected]

TechHandle&#58; LACNIC-ARIN
TechName&#58; &nbsp; LACNIC Hostmaster 
TechPhone&#58; &nbsp;&#40;+55&#41; 11 5509-3522
TechEmail&#58; &nbsp;[email protected]

# ARIN WHOIS database, last updated 2004-02-28 19&#58;15
# Enter ? for additional hints on searching ARIN&#39;s WHOIS database.

**Virtualbody1234** · 03-20-2004, 08:28 PM

How do you know you were being hacked?

**Spider_dude** · 03-20-2004, 08:29 PM

sorry.

**baccyman** · 03-20-2004, 08:29 PM

this could be your isp doing a scan of your computer . i get this a lot with NTL . i am using sygate firewall and it is always picking up these scans and they always turn out to be my isp .

**toco004** · 03-20-2004, 08:33 PM

dont know but my Norton Internet Security
say that i have been attacked on
3/20/04
11:30:05 am
attemps :45
most frequent attacker is 200.193.90.179

**LSA** · 03-20-2004, 08:34 PM

He's trying to 0wn you with netbus....

Stupid scriptkiddies

Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-03-20 13:35 CST
Interesting ports on 200-193-090-179.fnsce7001.dsl.brasiltelecom.net.br (200.193.90.179):
(The 1646 ports scanned but not shown below are in state: closed)
PORT      STATE    SERVICE
21/tcp    filtered ftp
25/tcp    filtered smtp
80/tcp    filtered http
135/tcp  filtered msrpc
137/tcp  filtered netbios-ns
138/tcp  filtered netbios-dgm
139/tcp  filtered netbios-ssn
1080/tcp  filtered socks
3128/tcp  filtered squid-http
12345/tcp filtered NetBus
12346/tcp filtered NetBus

**toco004** · 03-20-2004, 08:35 PM

Originally posted by baccy_man@20 March 2004 - 20:29
this could be your isp doing a scan of your computer . i get this a lot with NTL . i am using sygate firewall and it is always picking up these scans and they always turn out to be my isp .

but the trace is coming from Brazil

**Marius24** · 03-20-2004, 08:37 PM

Originally posted by toco004+20 March 2004 - 19:35--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (toco004 @ 20 March 2004 - 19:35)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-baccy_man@20 March 2004 - 20:29
this could be your isp doing a scan of your computer . i get this a lot with NTL . i am using sygate firewall and it is always picking up these scans and they always turn out to be my isp .

but the trace is coming from Brazil

[/b][/quote]
do you have any filesharing program open such as bittorrent or kazaa?