chimpy Posted September 6, 2010 ID:309974 Share Posted September 6, 2010 Can someone else access my router, that is through the url 192. etc? I had a few "Administrator login failure" in the logs, when I had not tried to access them, then I noticed that I was getting the Firefox "can't access web page" on a refresh for a few mins and then I checked my logs again and I got the same "Administrator login failure" at the time I was refreshing, and I got that Firefox screen quite a few times tonight. I changed the password and network key but still I had had the "Administrator login failure" on a refresh, I have scanned with MBAM and it was clean, I use Sandboxie 90% of the time so I am confused as to why this happened. Plus it happened at between 1am and 7am.Thanks Link to post Share on other sites More sharing options...
yardbird Posted September 6, 2010 ID:309975 Share Posted September 6, 2010 If you have a password on it, I don't think so. WEP has been broken, WPA1 broken, did anyone crack WPA2 yet?edit correction Link to post Share on other sites More sharing options...
chimpy Posted September 6, 2010 Author ID:309976 Share Posted September 6, 2010 I'm not sure, I use WPA PSK but I admit this was the first time in 3 or so years I have changed the PW for it as to be honest I didn't know how, I even locked myself out of the web before working it out Link to post Share on other sites More sharing options...
yardbird Posted September 6, 2010 ID:309977 Share Posted September 6, 2010 Manic post the thread a while back WPA1 was cracked... Link to post Share on other sites More sharing options...
chimpy Posted September 6, 2010 Author ID:309980 Share Posted September 6, 2010 Well on my computer is says I use WPA Personal and TKIP, and I checked my firewall and nothing unusual was ticked. Link to post Share on other sites More sharing options...
yardbird Posted September 6, 2010 ID:309981 Share Posted September 6, 2010 you can go to Steve Gibson's site and run some free programs, like "Shields Up" https://www.grc.com/x/ne.dll?bh0bkyd2 don't know if that what your looking for? But he has some freeware.... Link to post Share on other sites More sharing options...
chimpy Posted September 6, 2010 Author ID:309983 Share Posted September 6, 2010 Thanks here is what it say's I did it while non sandboxedFile Sharing" Attempting connection to your computer. . .Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet! Your Internet port 139 does not appear to exist!One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion. Unable to connect with NetBIOS to your computer.All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet." Common ports"Solicited TCP Packets: PASSED Link to post Share on other sites More sharing options...
yardbird Posted September 6, 2010 ID:309994 Share Posted September 6, 2010 thats where am at stealthed... theres more tests look at the top left of the page, there a bar, go to Freeware and do the Leaktest and a bunch of others Link to post Share on other sites More sharing options...
chimpy Posted September 6, 2010 Author ID:310035 Share Posted September 6, 2010 Leaktest failed, my windows firewall didn't ask even ask me, even though I know I have that option ticked... Unless thats down to me using a limited account? But even then it should have at least stopped it. I would get another firewall but config is not my strange point and vistas firewall is supposed to be ok. I can't say I know entirely what the other's do so I think I will just leave them for now and keep a eye on the situation, thanks for your help EditHow to I remove leaktest? I see it in all programs but its not under add/remove and Revo doesn't show it. Link to post Share on other sites More sharing options...
yardbird Posted September 6, 2010 ID:310163 Share Posted September 6, 2010 Just delete it.... it should not be in Program Files, just Temporary Internet Files & Prefetch folder only a 25K exe... you should run https://www.grc.com/unpnp/unpnp.htm If its Enabled. Disable it read the page & see why..... No it won't disable your plug n play.. Link to post Share on other sites More sharing options...
chimpy Posted September 6, 2010 Author ID:310167 Share Posted September 6, 2010 Thanks, by program files what I meant was when you typed the name into start menu > all programs, that was the only way I could find it, and thanks for the other link. Link to post Share on other sites More sharing options...
yardbird Posted September 6, 2010 ID:310172 Share Posted September 6, 2010 Your welcome! all the info is on the grc website....regards Link to post Share on other sites More sharing options...
chimpy Posted September 7, 2010 Author ID:310380 Share Posted September 7, 2010 I am getting them every 25 minutes, to the second.Mon, 2010-09-06 22:35:40 - Administrator login failure - IP:192xxxxxxMon, 2010-09-06 23:00:40 - Administrator login failure - IP:192xxxxxxMon, 2010-09-06 23:25:40 - Administrator login failure - IP:192xxxxxxMon, 2010-09-06 23:50:40 - Administrator login failure - IP:192xxxxxxTue, 2010-09-07 00:15:40 - Administrator login failure apart from the last one here which is me logging in.This is odd and I have no idea what it means, anyone have a idea? I have reset it, changed passwords, and yet it still is happening, is something on my PC trying to access it? Link to post Share on other sites More sharing options...
yardbird Posted September 7, 2010 ID:310410 Share Posted September 7, 2010 Routers come with my ISP. Unless I go buy my own. and they break (on me, I'm on my 3rd in 3yrs.) Did you run any programs? I would write down your password, reset the router. Post the make & model of the router. So we can see the FAQ's & DOC's on it. if needed.... If its going on all the time! Start a new post asking for HELP in this or the General forum... Link to post Share on other sites More sharing options...
chimpy Posted September 7, 2010 Author ID:310430 Share Posted September 7, 2010 Thanks Yardbird, I have reset and its still the same, its a Netgear DG934 and the IP that is trying to access it is mine I think, 192. one is the same number you put in the url bar (apart from the last two digits are 02 and not 01), so why is and what is trying to access it on my PC is now the question Link to post Share on other sites More sharing options...
Firefox Posted September 7, 2010 ID:310592 Share Posted September 7, 2010 Just a thought....Do you think there may be a rootkit on your computer that is trying to hijack your DNS settings in the router. Since you have a password on it the rootkit may not be able to login to it with the default user name and password so maybe that is why you are getting the login attempts failed. Link to post Share on other sites More sharing options...
chimpy Posted September 7, 2010 Author ID:310609 Share Posted September 7, 2010 I think I will post on the infect thread then Link to post Share on other sites More sharing options...
Firefox Posted September 7, 2010 ID:310624 Share Posted September 7, 2010 I think I will post on the infect thread then It may not hurt to do that, this way we can all be sure your computer is clean. Link to post Share on other sites More sharing options...
chimpy Posted September 11, 2010 Author ID:312422 Share Posted September 11, 2010 Checked the HJT thread and PC is clean so...This is the netstat /b log from the other day. I cannot read these logs though but thought they may help in finding out why my PC is doing this?Microsoft Windows [Version 6.0.6002]Copyright Link to post Share on other sites More sharing options...
DarkSnakeKobra Posted September 12, 2010 ID:312608 Share Posted September 12, 2010 Might I ask if its a problem if you are in full stealth, but fail ping attacks? I tested my Ubuntu 10.04 32 bit pc a while back ago, but failed only the ping attack. Ufw is enabled, so I'm not sure why it's responding. Link to post Share on other sites More sharing options...
chimpy Posted September 13, 2010 Author ID:313030 Share Posted September 13, 2010 I don't really config my machine so that only way I knew it failed pings were the first time I took the test, but the router issue has only just started happening a week or two ago, so I don't think its connected? Link to post Share on other sites More sharing options...
yardbird Posted September 13, 2010 ID:313032 Share Posted September 13, 2010 are you connected via eithernet cable... or wifi? I have wifi and never use it FWIW open a CMD box, type ping www.yahoo.com - then press enterEDIT: should look like this, Link to post Share on other sites More sharing options...
chimpy Posted September 13, 2010 Author ID:313171 Share Posted September 13, 2010 I use Wifi.Microsoft Windows [Version 6.0.6002]Copyright © 2006 Microsoft Corporation. All rights reserved.C:\Users\panda>ping www.yahoo.comPinging eu-fp.wa1.b.yahoo.com [87.248.122.122] with 32 bytes of data:Reply from 87.248.122.122: bytes=32 time=61ms TTL=54Reply from 87.248.122.122: bytes=32 time=60ms TTL=54Reply from 87.248.122.122: bytes=32 time=61ms TTL=54Reply from 87.248.122.122: bytes=32 time=59ms TTL=54Ping statistics for 87.248.122.122: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 59ms, Maximum = 61ms, Average = 60msThats the ping, but does this explain why my PC is independently trying to access my router? Link to post Share on other sites More sharing options...
chimpy Posted September 15, 2010 Author ID:314183 Share Posted September 15, 2010 Can no one explain this? Link to post Share on other sites More sharing options...
chimpy Posted September 18, 2010 Author ID:315390 Share Posted September 18, 2010 Can anyone explain this then?I noticed it on my HJT log (I am clean) but...O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe Googling that entry gets a few reds on the WOT scale. I have looked at the file and it seem to be about a label printer? apart from msvcr70.dll which seems to be Microsofts runtime library, if thats the case isn't that in the wrong place? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now