Connection cut by a hacker Solved

Question

Hello, and thanks in advance for the answers. So here, I was playing Counter-Strike (online game) with friends and the opposing team was frustrated from losing, they started insulting etc. Then after a while they told us that if we spoke again they would cut our internet connection, and 1 minute later they made our internet connection drop. When I say drop, my Freebox stays in normal state (as time), MSN etc. don’t close, but the connection is broken or intercepted, I don’t know how to say it, and this lasts about 2 minutes, then they wanted to chat with us, we gave them allopass in exchange they would leave our connection alone, which we did not do, so now they enjoy disconnecting us.. for this they got our IP, I don’t know how, probably on the Counter-Strike server, but being on a FIXED IP they have my IP and can enter it into their software whenever they want to disconnect me, and I read that it is impossible to switch to a dynamic IP with Free Dégroupé … so what to do? thanks for the help.

AntiLamer · Accepted Answer

Hello, I met the same person under the nickname TS ADMIN. He asked me for Allopass to stop flooding my connection. Same symptoms: he says your connection will be cut and it does cut. I looked more closely and I saw how he operates. He is on a Dedibox; it's a dedicated server with a 100 Mbps connection installed under Linux. Then when he has your IP, he sends a lot of ping requests to saturate your connection. The solution is therefore to configure your box so that it does not respond to his ping requests, so no more problems. I’m at your disposal in case anyone encounters problems configuring this box. bye bye.

BeFacmoi · Answer

Do a Trojan scan, it’s thanks to that that we control PCs remotely

HzN · Answer

No, it's not a trojan, nor a virus or anything like that, it's just that the guy has a software, he puts my IP in it, and it blocks my connection, but how to stop that I don't know :s

BeFacmoi · Answer

The "software" that he uses is the client side of the trojan; you must have the server side installed on your PC.
It enters your IP (which never changes) and can access anything on the PC, and even cut a connection.

HzN · Answer

No no no, I’m telling you it’s impossible, he doesn’t control anything on my PC, we were on the Counter-Strike server, he said 4, 3, 2, 1, 0 boom, connection cut. To have the client side on my PC you have to have received it by email or via MSN, in short you have to have accepted something. Here, while playing, we don’t accept anything. He only got the IP, that’s all. But I’ll run an analysis with an anti-rootkit, Avast, and Spybot, we’ll see...

HZN · Answer

Help me .. they're starting again.

BeFacmoi · Answer

I don’t quite understand, are you in a LAN with an opposing team? If that’s the case, it’s possible someone installed something on your device without your knowledge.

NeoL- · Answer

I ran into the same guys... I have their address and when I’m in Paris I’m going to burn them one by one. Otherwise go to the cops, file a report. I have their source DNS with the intrusions violating privacy, and there’s a professional in my IUT who will help me.

HgaN · Answer

The same thing happened yesterday: two guys using the nickname TSADMIN, a connection cut each time they want, in exchange for an Allopass...

AtomicFox · Answer

Arf a good old Denial of Service! A bit brute force but very effective. The only way to fix it: a firewall on the router (box).

houselectro · Answer

I was the victim of these people last night...
Same problem, I have the time display on the Freebox, but no internet!!! I’m receiving nothing at the packet level.
My Freebox is saturated, as AntiLamer had noted above.
Does anyone have a solution?

InfernO.vir · Answer

Good evening,

Very interesting topic!

As BeFacmoi indicated, it’s thanks to malicious software that we control PCs! from its name -> TS ADMIN, that probably means it is admin of the server you connected to! whereas the admin of a server receives your IPs when you request a connection to the server! On the other hand HzN you say you have a fixed IP, but for a multiplayer game you need to use the internet, and with any internet connection your IP changes! Or is it the router that keeps you from changing IP?! I don’t know, in any case do this:

- Download HiJackThis by Merijn on your desktop.

- Double-click HijackThis

- Generate a report following these instructions:
- Run it and click on Do a scan and save log file.
- The report opens in Notepad

- Paste the report here, for that:
- Edit menu / Select All
- Edit menu / Copy
- Here in a new message: right-click / paste

Help: Don’t hesitate to consult HiJackThis help

In any case it is fraud since they ask for Allopass in exchange! The gendarmerie could possibly trace by their IP to catch them, provided they don’t cover their tracks!

--
[$écurité|Viru$]-->Respect during disinfections<-STOP the bullets!!-- >I am only available on weekends, it is not to create another topic!!

InfernO.vir

houselectro · Answer

I have a static address with Free, so it stays the same...
Note that I have disabled the "Ping reply" option in the router settings.
I have 3 PCs at home, 1 on WIFI and 2 on ETHERNET.
The problem doesn't come from my computers but from the fact that my Freebox is saturated with requests!
So I don't know if a HiJackThis report would be useful... yes?

InfernO.vir · Answer

If I can clearly glimpse an infection in this report, with which it(s) are used! -- [$sécurité|Viru$]-->Respect during disinfectionsI am only present on weekends, it's not to say that another topic should be created!! InfernO.vir

houselectro · Answer

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:18:06, on 30/11/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Audio Deck\EnMixCPL.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Steam\steam.exe C:\Program Files\eChanblard\emule.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org R0 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [EnvyHFCPL] C:\Program Files\Audio Deck\EnMixCPL.exe 1 O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/... O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1C499828-FE58-4C4F-8D3E-57D57FE97550}: NameServer = 212.27.53.252,212.27.54.252 O17 - HKLM\System\CS1\Services\Tcpip\..\{1C499828-FE58-4C4F-8D3E-57D57FE97550}: NameServer = 212.27.53.252,212.27.54.252 O17 - HKLM\System\CS2\Services\Tcpip\..\{1C499828-FE58-4C4F-8D3E-57D57FE97550}: NameServer = 212.27.53.252,212.27.54.252 O17 - HKLM\System\CS3\Services\Tcpip\..\{1C499828-FE58-4C4F-8D3E-57D57FE97550}: NameServer = 212.27.53.252,212.27.54.252 O20 - AppInit_DLLs: ???????????????????? l?:?: cE?:?? O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe  -- End of file - 8138 bytes

InfernO.vir · Answer

Hello,

Your report shows an infection!

Do this:

-Download MBAM--> http://www.malwarebytes.org/mbam/program/mbam-setup.exe, to your desktop.

-Follow this tutorial to install and configure it properly: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

-Restart in Safe Mode (F8 at BIOS startup)

-Double-click on Malware's bytes anti-malwares

-Run a full scan.

-Delete everything found by MBAM (red list), for that, check the infections and click "Delete the selection"

-This will open a report in Notepad, close Notepad

-Click on the Quarantine tab and empty it

-Restart in normal mode and post your report

NOTE: If you can't find it, run MBAM, click the Reports/logs tab and open the one corresponding to the date and time of the scan.

NOTE²: The scan can take several hours depending on the space used on your PC.

--
[$écurité|Viru$]-->Respect during disinfections<--STOP the needless errors!!-->I am only present on weekends, this does not mean you should create another topic!!

InfernO.vir

houselectro · Answer

Malwarebytes' Anti-Malware 1.30
Database version: 1437
Windows 5.1.2600 Service Pack 3

30/11/2008 12:25:05
mbam-log-2008-11-30 (12-25-05).txt

Scan type: Full Scan (C:\|G:\|)
Items scanned: 141338
Elapsed time: 38 minute(s), 34 second(s)

Infected memory process(es): 0
Infected memory module(s): 0
Infected Registry key(s): 0
Infected Registry value(s): 0
Infected Registry data item(s): 1
Infected folder(s): 0
Infected file(s): 1

Infected memory process(es):
(No malicious items detected)

Infected memory module(s):
(No malicious items detected)

Infected Registry key(s):
(No malicious items detected)

Infected Registry value(s):
(No malicious items detected)

Infected Registry data item(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Infected folder(s):
(No malicious items detected)

Infected file(s):
C:\Program Files\eChanblard\EvID4226Patch.exe (Adware.Agent) -> Quarantined and deleted successfully.

InfernO.vir · Answer

From evolution to the PC level?   -- [$écurité|Viru$]-->Respect during disinfectionI am only present on weekends, that doesn't mean we should create another topic!!  InfernO.vir

houselectro · Answer

I haven't received any other attacks yet for the moment.

als1190 · Answer

Listen, thanks for your help, but HOW can a person tell you they cut your internet connection via a Counter-Strike exploit, having ONLY your IP?

A friend of mine had the same problem, they got the crap beaten out of them, everyone got mad, and the guy calling himself SKEUD told him I’m going to hack you, and bam, no more connection!

I did some research, they told me the only possible way would be to flood the connection.

It’s already been 15 hours this is lasting.

Does anyone have a solution? knowing that he has rebooted and reset his modem (IP changed, all that stuff!)

I find it really crazy.

Timai · Answer

Hi there, Damn I just got my internet cut off because of those guys who rage, they said hahahahahahaha we’re going to cut your internet connection

Connection cut by a hacker

21 answers

Copy/paste scanned text jpeg format

Startup error message

Black screen on hp pc

Case fan not working

Username and password

How to delete quarantine files in defender?

Taskbar icon visibility

Texture issues in enshrouded

Activation of the esu program for updates on windows 10

Remove marker stain from pc screen