PDA

View Full Version : Was I hacked?!


Comp01
April 28th, 2004, 02:59 AM
Ok, I just signed online, all was going well, when Mozilla Firefox closed itself, I opened it again, and decided to test something, I brough a command prompt up, and done a netstat, I had an odd connection to the IP 209-250-109-69.client.dsl.net and it said under state "FIN_WAIT" next to it was I hacked? Sygate 5.5 didn't say anything! :( I lost the log of what the entire thing said, as I accidentally closed the DOS prompt.

meneer
April 28th, 2004, 10:44 AM
I suspect that the connection you saw was either a left over from your broken browser session, or a service connection from your ISP.
Since you're probably protected enough by your firewall, any attack would be blocked?

Perhaps this page (http://tangentsoft.net/wskfaq/articles/debugging-tcp.html) can help.

Comp01
April 28th, 2004, 03:37 PM
I would suspect it was my ISP, but, I don't use a DSL connection. After tracing the IP at www.samspade.org it just says it belongs to the company DSL.net, etc...

CrazyM
April 29th, 2004, 12:57 AM
Hi Comp01

The "FIN_WAIT" state is normal to see when a connection is closing.

Did you happen to note the services/ports in use in addition to the remote IP?

Regards,

CrazyM

Comp01
April 29th, 2004, 09:38 PM
Sorry, I just now checked back at this post, anyways, no, I didn't get a chance to note them, I know that the remote port was 1030, I didn't catch the local port number...