Results 1 to 9 of 9

Thread: Security problem , please help!

  1. #1
    rancspeak Guest

    Default Security problem , please help!

    Recently after using some p2p software, zonealarm came up with the message that it detected a new network at IP address 192.168.1.0.I know this is not my IP's address. Now everytime I connect my wireless modem the computer start looking for a network address, which it never did before, in the system tray until it finds this new network IP. I'm concerned that my machine has been hacked. I know that it shouldn't be connected to this network.
    Is it right that if I'm using a wireless modem I should have just two things in ZonealarmLoopback adapterUSBNIC adapter network
    Is this correct?
    the third thing, the new network IP 192,168,1,0 looks fishy to me. How can I remove it? Zonealarm won't let me remove it because it keeps saying it is active.
    What is this? Once it came up with the IP 169.254.0.0
    Please helpThanks


    Operating System:
    Windows XP Home Edition
    Product Name:
    ZoneAlarm Internet Security Suite
    Software Version:
    6.5


    Message Edited by Rancspeak on 11-21-200610:11 AM

    Message Edited by Rancspeak on 11-21-200610:12 AM

  2. #2
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Security problem , please help!

    Hi

    All is OK and you are safe.

    192.168.x.x is the private networking addresses and is not related to the Internet in any way.

    169.254.0.0 belongs to I.A.N.A.. The range for this is 169.254.0.0 - 169.254.255.255 plus others. The PC did a name address resolve.

    Yes those two are correct, but there should be more>

    Make sure your DNS and DHCP server IP's are in your Firewall's Trusted zone. Finding DNS and DCHP servers, etc

    1. Go to Run type in command , hit 'ok', and type ipconfig /all then press enter. In the returned data list will be a line DNS, Gateway and DHCP Servers with the IP address(s) listed out to the side.
    2. In ZA on your machine on the Firewall>Zones tab click Add and then select IP Address. Make sure the Zone is set to Trusted.
    3. Click OK and then Apply and see if that works to fix it.
    4. The loopback or localhost (127.0.0.1) must be listed as Trusted.
    5. The Generic Host Process (svchost.exe) must have server rights for the Trusted Zone.
    Plus it must have both Trusted and Internet Access.

    Oldsod

    Message Edited by Oldsod on 11-24-2006 11:07 PM
    Best regards.
    oldsod

  3. #3
    rancspeak Guest

    Default Re: Security problem , please help!

    Thanks for replying so quickly.
    Well I checked out the list and couldn't make sense of it. But what happened is this: I put in my IP's address and the name and set it to trusted in Zonealarm. The Pc was doing its "acquiring network" thing in the system tray. After a while that stopped and when I checked Zonealarm, my IP setting had actually been changed
    to this: New Network 169.264.0.0
    Is this normal?
    Thanks for the reassurance in your earlier reply but I'm still worried because this never used to happen before.

    Message Edited by Rancspeak on 11-21-200611:53 AM

  4. #4
    rancspeak Guest

    Default Re: Security problem , please help!

    Thought I should add what came up on the ipconfig/all

    Ethernet adapter local area network
    DHCP enabled


    yesautoconfiguration enabled


    yesautoconfiguration ip address 169.255.154.255
    But I'm using a wireless modem through USBfor that it has this listingDHCP enabled NoIP address (my ip's address)subnet maskdefault gatewayDNS server









  5. #5
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Security problem , please help!

    Best regards.
    oldsod

  6. #6
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Security problem , please help!

    Turn off the UPnP (Universal Plug and Play host) in the Services (Administrative Tools).

    Also in the command do this>

    This time type in ipconfig /flushdns and enter and after it is finished, just reboot.

    Also download and run this tool>

    http://www.majorgeeks.com/XP_TCPIP_Repair_d4521.html

    Just use the reset part.

    Oldsod

    Message Edited by Oldsod on 11-21-2006 03:43 PM
    Best regards.
    oldsod

  7. #7
    rancspeak Guest

    Default Re: Security problem , please help!

    Thanks for all that.
    So far I've done this: Flushdns, then downloaded the TCP/IP repair and used it to repair that and did winsock repair. Then I disabled the Upnp like you said. Then I did the ipconfig thing again and got my ip and the dns ip and put them both in zonealarm. After all that this is what is still happening:
    My zone alarm firewall starts up fine with only this in the zonesNS




















    "ip address"

    TRUSTEDLoopback adapter 127.0.0.1






    TRUSTED
    I plug in my wireless broadband modem which is connected via USB to my machine. So I get this added to the zones:
    USBNIC network adapter "ip address" TRUSTED
    And I'm on the net ... so my connection is fine
    this far and I am on the net surfing etc. Then I see those little double monitors pop up on the tray, "acquiring network", so it's doing a search again. But I still have my USBNIC connection stable while this other search is started and going on now. If I disable this other one the whole thing shuts off so I leave it. After about ten minutes it dissapears. And lo and behold this is added to my Zones in Zonealarm
    New Network
    169.254.0.0 INTERNET
    or sometimes
    New Network 192.168.1.0 INTERNET

    Surely there shouldn't be two networks in the ZONES? Only my USB modem should be there right? This other one is Ethernet. I have a bad feeling about this.
    It's as if some malicious software in my machine is doing a network search and routing to that one instead of the one I should be on. But I done a spyware search and virus search and nothing shows up. What else is there left to do to get rid of this thing?
    I tried uninstalling zonealarm and reinstalling but same deal.





    Message Edited by Rancspeak on 11-21-200603:17 PM

  8. #8
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Security problem , please help!

    169.254.0.0 is a default IP that goes for the Plug and Play. It is not internet, but it does mean that the PC could noy get internet and used it instead. ususally no internet can be gotten when the PC "finds" IP.

    Did you read the replies or do what was suggested?
    Best regards.
    oldsod

  9. #9
    rancspeak Guest

    Default Re: Security problem , please help!

    As I said in my post, I've done everything that was suggested but even when we have an internet connection on our regular usbnic this other network address still tries and does connect as well when it shouldn't. And I can't see how it is a windows issue because I have another hard drive with windows which I switched to yesterday and tried to connect on that and the same thing happened and I know that the windows onm that drive is not corrupted or infected in any way. So it must be the modem that's causing this problem or my ISP. I contacted my ISP yesterday and they say that they know nothing of this and that the address that is being connected is nothing to do with them. I'm baffled. Excuse my ignorance in these matters but it seems as if the modem (which is wireless) is picking up a network nearby and trying to connect to it. Is that possible?



Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •