My ISP saying I hacked some1

[casanova]

I am currently using TATA Indicom broadband connection. I got a call from Tata saying that I hacked some1 on Friday at 1.20 pm.
The funny part is I was not using My computer at that time as I had gone to offer prayers.Yup, my comp was on and so was my net connection as my downloading was going on through eMule v0.47a.
I am using NetMeter currently and I noticed something crazy, my download and upload speeds are shown higher than my usage,
eg If only eMule is using net connection and downloading at 3KBPS and uploading at 2KBPS, netmeter shows around 6KBPS for download speed and 5 KBPS for upload speed. I noticed this only after I received call from Tata.

Now, I am in trouble as they might be filing an FIR against me, so help me out on following points:-
1. Am I infected with some spyware. (I am not using any spyware remover currently, downloading Spybot right now).
2. Is it possible for some1 to connect with my IP address.
3. And how to overcome this problem? (what shud I do prove myself innocent)

 

[satyamy]

ya its is possible that u r PC is infected by some virus or spyware & when U download something their is a lot of possibilities of these types of things
u did'nt specified what u wer downloading & from which site?..............

 

[champ_rock]

tell those tata people EXACTLY what had u done... it is fundamental right to know of the accusation against u .....then u can proceed... also does tata have a lan?

 

[blackpearl]

I guess ur PC is infected with a trojan which is carrying out DDoS attack from ur computer.
My suggestion is to first install a firewall and block access to all programs other than ur browser and other applications that u use for downloading stuff. Then run a through virus scan on ur PC with some trust worthy antivirus s/w like Norton. Also scan with some anti trojan and anti spyware. Make sure u have upto date virus defination files.

 

[casanova]

I stated that I was downloading thru eMule and cant exactly say wat since my download list in eMule is always 2 big.

My Norton antivirus auto protection was enabled and updates were also the latest and I had done my virus check on 10th may, it found 1 virus and it was deleted successfully and Friday was 12th.
I scanned my comp for spywares with Spybot, it showed 5 errors, 4 of them were tracking cookies and 1 was windows security center disable antivirus notify.
The 4 tracking cookies were from Avenue A. Inclusive, DoubleClick, HitsLink and SexTracker. I havent visited any of these sites. Even wen some unwanted sites open, I close them even before it is 10% loaded.
I am using Norton Systemworks 2003 with latest updates.
[Edit]
My OS is Windows XP SP2 with automatic updates on .
@champ rock
What do u mean by Tata having LAN.
They have given me a router with 1:4 connection.

 

[drvarunmehta]

Post a HijackThis! log file. Maybe you should just reinstall XP and get rid of whatever virii, malware or trojan is there on your PC.

 

[casanova]

Ok here is the hijackthis logfile. I am not understanding anything from this logfiles. Further, when at times when a trojan is detected, Norton deletes it and mostly I even then clear my temp folder.

 

[santu_29]

after looking at your logfile i found 2 bad entries, so please check them out

> O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM32\ldr64.dll
> O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

Also get the full details from your isp about the accusition, as said by champ

 

[it_waaznt_me]

The log is clean ...
{This word limit thingy sucks}

 

[robin345]

You should aslo have Norton internet Security b`coz you need extra firewall .
Also Try to clear everything with tata as soon as possible .

 

[Rollercoaster]

man keep a record of everything u detect and do with screenshots or something... if u really think they will file FIR...

 

[Akshay]

Just install Zone alarm (latest ver.). I wud suggest a thorough scan with NAV 2006 or just format ur sys (if poss.). Dont worry about the FIR n stuff coz nothing much can happen with it coz there is no "mens rea" (guilty mind) on ur part and u didnt do it purposly.

When companies like microsoft with latest techniques, technology, etc. are not immune from hackers how can we be?

 

[abracadabra]

as for your ip thing u r assigned the ip dynamically and not a static ip. but ppl remember not to try something nast as u r modem network card has a phsical address like thiz xx-xx-xx-xx-xx-xx can be gat by typing ipconfig /all at command prompt. they can find the excat location as to where the problems erupt.

 

[samrulez]

First scan ur pc with Anti spyware.........Then just check if the no 1 has access to ur phone ....or internet connection....Some1 else might be using ur connection and thats the reason u are getting low speeds

 

[PainKiller]

i think its not tata ppl but one of your friend must have played a prank of u. what do u think???????

 

[samrulez]

See TATA indicom is wireless..ok.Any on who has knowledge abt this can tune to a frequency of ur phone..ok..So he will have a phone on ur line.
And he can also connect to the net via ur line..And if he hacks some1 it will be via ur line..and therefore it is u who is blamed coz it is ur account.

 

[Netjunkie]

as for your ip thing u r assigned the ip dynamically and not a static ip. but ppl remember not to try something nast as u r modem network card has a phsical address like thiz xx-xx-xx-xx-xx-xx can be gat by typing ipconfig /all at command prompt. they can find the excat location as to where the problems erupt.

TATA Indicom Broadband is Router based & provides a Static IP.
So no need of the Mac address for tracking purpose

In this case ask them what exactly do they mean by "hacking someone".
I dont feel they will take this issue very far.

 

[techiways]

He He. Don be scared dude. Its most obvious that your friends have bug a big well for you to fall in! Maybe its an true Bakra!

Come on... if you had really commited a cyber crime, why would tata indicom call you to inform that on first hand. Moreover i don think Indian Isps have time and such advancements to file an fir for some mere DDOS attack.

Unless you had abused someone online or had engaged in data theft, you could face such problems. Since you haven done any of these, its most likely that someone is playing a prank on you.

Also remember, no one can simply file an fir. They need evidence. Even if your computer was hacked and was being controlled by an third party, it could all be revealed through the ISPs log files. so dont worry. Everything is electronically logged and you cannot be held liable at all.

 

[casanova]

Hey, there was some confusion, it wasn't from TATA Indicom but someone very hifi. Wenever I try to call back that no., there is no ringing tone i.e; that is my call is picked up but some kind of different sounds come over there.

I reside in Pune and the no was from Mumbai. Strange thing is it doent look like a Mumbai no. The no is +912267925400
My cousin in Mumbai told me that it is not a MTNL no. Does anybody know this no is from which service provider.

I dont think so that it is a prank played by any of my friends. Reason 4 this is that my friends know me as Naveed Patel and my complete name is Naveed Shaikh Mohammed Patel. And most of the first timers call me Naveed Shaikh (even the TATA people) as Shaikh is a very common surname. Secondly, if it were any1 of my friends atleast I wud have listened a ringingtone. I tried the above mentioned no. many times and tat also from different nos. but same sound comes.
Yes, I am having a static IP and it is router based connection. Also tis connection is from proper TATA Indicom and not from Tata Indicom VSNL.

Is there any such s/w that can show how much bandwidth is consumed by which program so tat I can know wat is actually using my bandwidth.
Also, can some1 from Mumbai find out the service provider for the no. (+912267925400) and if possible whose no. is this.
Wud be scanning with Zone alarm soon.

[Edit]
Zone alarm is having a variety of packages. Which pacakge shud I use.

 

[Akshay]

Use Zone Alarm Security Suite v 6.1.744.001:

*www.zonelabs.com