Help:Unauthorised User on My Internet account

TonyA

TonyA

Expert Member
Joined
Oct 13, 2005
Messages
2,304
Reaction score
2
Location
Capri, South Pennisula, Cape Town
Hi, I discovered when I checked my user stats both with SASA and with my ISP that some one had been using my account downloaded 935 mb between 11 and 12 this morning (Sat 16 sep). I have subsequently changed my passsword on the account, on my ADSL modem and rebooted modem as well. I also ran a virus scan on all PCs connected to modem. I found one with a Trojan Horse virus which has been deleted. Are there any other precautions or actions I should take. I have the firewall activated on modem and all PCs are running software firewalls.
Thank you
 
so this is the second time someone has gained access to your account after changing passwords ? Who else plays on your pc? Do you keep your password lists on your pc in a file or do you keep it written down in a file somewhere locked away safely?
 
does your router have wi-fi? do you use the wifi?

if so make sure the security level is set to WPA-PSK
 
Thanks for replies.
1. I have only had one unauthorised access, I change passwords monthly.
2. I use wiresless but it iis secured access using WPA
3. I have 2 other PCs connected to router used by my kids software firewalls in place Windows and Zone Alarm. They are prevented from accessing certain sites via firewall and router.
3. Passwords are not written or kept in lists on PC. Written down in my organiser in locked briefcase.
 
I checked this intrusion again on SASA and find that the IP numbers are very different from the ones allocated to my system. Can I use this information to tracke the intruder?
 
Your account is being hijacked. Contact your ISP and ask them to identify the other IP address. Are you with TelkomISP?
 
"downloaded 935 mb between 11 and 12 this morning" hmmmmm

That must be a "upto 4mbit" user that got yur pass/login. Since 512K adsl can only get around 160mb - 180mbper hour. at max.

If your using IS, u can even see on the usage website, wich area that login was made from. (it says Durbanville 2, or Parow 3)
*nice to see, cause maybe one of your buddies zife'd your account when coming for a quick visit*

I'm not sure if Saix Usage website shows similar stats
 
Last edited:
Check what's the NAS ID, and ask telkom who it belongs to. You can probably fing the NAS port id on your isp's stat's page. They can probably track telephone number that uses that port.
 
Thanks for help. I shut down all PCs and Modem until this morning. I'm with MWEB (Sick) and will contact their help line when it opens at 1000. I don't understand how they got hold of my new password so soon. I Changed it on router, mweb etc.
Thanks again. I'm closing down again until 1000, I only have 500mb left and don't need that to be hijacked!"(
 
I think it could be that your antivirus didn't do a good job and there is still a trojan or pws stealer program hiding somewhere.
 
If someone is using your account remotely you might want to find a clean computer - preferably a friends - log in and change your password before you lose all your bandwidth. Dont update the one in your router until you've had a chance to make sure nobody is getting into that remotely.

BTW - what type of router is it?
 
Hi, sorry been offline trying fix problem. PC clean scanned again with AVG and Nortons. Can't change password, have been on to MWeb Technical, they've reset password but I still can't access my account, Now waiting for callback. The Router is a Billion 7402G
 
I will recommend you to try a free virus scan and removal program from Russian Antivirus Vendor Dr.web, it's called CureIT. About 4MB and use it to scan your PC and see what it will find. IMO Norton and AVG is not the sharpest tool against trojan horse and such new generation malicious software.
 
Hi Thanks for help. I reset router to factory settings and then tried again and lo and behold I was able to access my account. Now to change all passwords etc. Many thanks for help.
 
TonyA said:
Hi Thanks for help. I reset router to factory settings and then tried again and lo and behold I was able to access my account. Now to change all passwords etc. Many thanks for help.
Click to expand...
Make sure to change the default router password now that you've got it working.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X