I think I've been hacked

[azop]

You are welcome ^^.

I don't even know anyone in France.

Now you know one, I'm French.
I'm trying to gather informations on gouv.fr network, because I'm curious about some weird things.
Could you give me the entire log of those connections in a private message ?
It would really help me !

[joegumbo]

Hi Azop,

I'm glad to know someone from France! I'm from the US.

Unfortunately, when I had to totally reformat my hard drive, I lost everything. I haven't been bothering to save the records of the hits in the several days since reformatting. But, if you know a way to get the info, perhaps somewhere in my pc there's a file that I don't know about, I would be happy to send it to you.

I now know that you are interested in this. If I start getting hits again, I will save and send the file to you at your address that was included in your private email to me. But, it has been really quiet on my firewall recently.

Maybe the watchers realize that they are being watched?

Thank you,

-Joe

[stanjam]

Originally Posted by joegumbo

Hello Azop,

I have absolutely no idea why the French government wold want to connect to my computer. I don't even know anyone in France.

-Joe

Governments routinely practice their information warfare tactics. You may have been the subject of such an experiment.

OR someone managed to get a bot into their network and it is now looking for computers to spread to. That isn't unheard of as well.

[joegumbo]

Hi Stanjam...

I've been wondering, "What could I have done to get the French government mad at me?"

Also,

Azop... I have been digging around in my system and I think I found what you are looking for. I'll send it shortly.

-Joe

[azop]

To joegumbo & Stanjam : I wonder why a french government would do that too !
This AkamaiGHost server is really strange, because it seems to be there for streaming, but in this case, there is no reason for it to connect to a personnal US computer.

To joegumbo : Thank you ! I send you by private message my personnal email adress, Bye

A last thing : it seems that 77.67.127.42 is there for personnal uses too :

Request Header (190 bytes)

GET http://content.dl-rms.com/rms/8001/nodetag.js
Accept-Encoding: gzip
Referer: http://www.nytimes.com
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)


Response Header (357 bytes)

Connection: close
Date: Thu, 21 Jun 2007 11:43:49 GMT
Accept-Ranges: bytes
ETag: "2003c186-6f-ddbf95c0"
Server: Apache-AdvancedExtranetServer/2.0.50 (Mandrakelinux/7.2.101mdk.16kLimit) mod_perl/1.99_16 Perl/v5.8.5 PHP/4.3.8
Content-Length: 111
Content-Type: application/x-javascript
Last-Modified: Thu, 08 Feb 2007 21:38:39 GMT
Client-Peer: 77.67.127.42:80

I collected it in google's cache (click here to see it)

If I wasn't a French citizen, i would ping all the 77.67.127.* , to see if one accepts connections.
Is there somebody who could do it ?

[dysphorichermit]

Originally Posted by The_Jaymz

Yeah, I use it. I like the idea that we can share info on the baddies.

Does 9911 need to be opened on the firewall and port forwarded on the router?

[mmix]

http://www.dnsstuff.com/tools?runFro...=ipInformation

better off to use latest linux distro, and firewall.
https://en.wikipedia.org/wiki/List_o..._distributions
http://www.sophos.com/en-us/products/free-trials.aspx (formerly known as astero )