FROZEN FIEFDOM

"Something's Up" In America's Big Berg

featuring

Selected Poems from The Alaska Mystery Collection

and The Tree Series
by Paula Marie Rose

Explanation, Please.

Assorted odds and ends that I can't figure out. Please send me an email if you have an answer. I'll post things in this section as they pop up. paula@frozenfiefdom.com

Below is a Log I found on my PC. I sent an email to Steve, someone I have known for approx. 20 years, because he's a computer whiz, knows networks, software, and Much, Much more about computers than I do. His first reply in blue. Bottom line: after a few other emails, he said he couldn't help and: "Try googling for tools, but guessing that after the fact its probably a stretch to discover anything. I’ve never attempted this sort of thing, so have no recommendations, except good luck. "

Anyone have something better than that, or this:

More questions first.

1.) Why do you think, someone has been accessing your computer?

2.) What operating system and version are you using?

3.) What is your computers name?

4.) How do you access the internet?

5.) Do you use a router?

Check out this link on Microsoft for more information on the logging of events.

http://msdn2.microsoft.com/en-us/library/aa385229(VS.85).aspx

let me know.

From: PR [mailto:jayoubetyou@yahoo.com]
Sent: Thursday, February 07, 2008 8:55 AM
To: Steve

Subject: security/hack questions

Hi Steve,

How's the retirement going? You've probably been spending quite a bit of time with the snow shovel, from the weather report. I have a few computer access questions; I know you be the man to see, about finding a key, or perhaps three; so I can see who has been hacking me.

What is the easiest way to see who has been accessing my computer (without my permission) how they did it, and how to prevent them or others doing so in the future? I have and run all the usual antivirus and firewall features, apparently, it isn't enough.

Below is one of the handful I found in the windows log; I have the feeling there are others. I have almost 25,000 files in my windows security logs alone; so can you recommend the best way to use the "find" feature to locate unknown computer names, or other tools, or ???? whatever I should be looking for.

Bottom line: In your opinion, what is the easiest way to sniff out who has been browsing in my box?

Thanks! Paula

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

<Channel>Security</Channel>

<Computer>Paula-PC</Computer>

</System>

- <EventData>

<Data Name="TargetUserName">ANONYMOUS LOGON</Data>

<Data Name="TargetDomainName">NT AUTHORITY</Data>

<Data Name="LogonProcessName">NtLmSsp</Data>

<Data Name="WorkstationName">KAHRMAISBALANCE</Data>

</EventData>

</Event>

______________________________________________

Here's a list of IPs who have been pinging me, according to my antivirus. What does it mean when a Ping happens? I did a trace on arin.net of 169.254.89.41 which has Ping listed in the action column. It's that Ad Hoc network that is listed below. Also 192.168.0.13 lists SNMP in the activity column, and 66.75.160.64 and 66.75.160.63 have both attempted port scans of my box numerous times; sometimes with days between attempts. Any tips, ideas, suggestions? Or is this no big deal?

My internet was down most of the day today, and while my PC could not locate my regular network it was able to find this new network which was named: SST-PR-1. How interesting! and it was a secure network which required a password. There were my own initials right there on a new network with a different connection icon (I later learned is called an Ad Hoc network), so why not see if I could log on? I was able to sign on; using an off the cuff password that I didn't think anyone else ever would; due to the unpleasant context it would be implying. Shor Nuf, I successfully linked in.

I was immediately connected to that network, but only in a limited capacity, no internet. I was connected to it and searched my log files and pull up the IP address. 169.254.89.41 which I traced, and it is listed as a "Black Hole." network. I've run across many "Black Hole" networks after tracing IPs on my box. Probably nothing out of the ordinary, but I'm all ears for your comments. Here's the log file, please fill me in if you know how to decipher all the mumbo jumbo.

When I tried to reconnect later, as my regular network was still down; I wasn't able to find that SST-PR-1, so I attempted to recreate the network configuration through the Setup Wizard. Nothing happened, so I deleted them both from the connection listings, as I don't want to be inadvertently logging on in the future.

And here below; as in the link above.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

- <System>

<Channel>Microsoft-Windows-WLAN-AutoConfig/Operational</Channel>

<Computer>ShorNuf</Computer>

</System>

- <EventData>

<Data Name="Adapter">Dell Wireless 1390 WLAN Mini-Card</Data>

<Data Name="SecurityHint">The operation succeeds.</Data>

</EventData>

</Event>

After I logged off it a few minutes later; the network was no longer visible. I used the same network name, and set up my own new network connection thru the menus, choosing the same network icon of 3 connected computers, which supposedly means that the computers must be within 30 feet of each other. I've never done that, and am a Tech Tard, so I'm amazed that I was able to create something with just a few clicks. Nothing happened, so I deleted both of those networks from my list. The original SST-PR-1 is no longer visible when I poll for available networks; and tech support at the cable co. has my usual network up and running again.

Web Hosting by Yahoo!

paularoseimages@yahoo.com