My ISP saying I hacked some1

[casanova]

I am currently using TATA Indicom broadband connection. I got a call from Tata saying that I hacked some1 on Friday at 1.20 pm.
The funny part is I was not using My computer at that time as I had gone to offer prayers.Yup, my comp was on and so was my net connection as my downloading was going on through eMule v0.47a.
I am using NetMeter currently and I noticed something crazy, my download and upload speeds are shown higher than my usage,
eg If only eMule is using net connection and downloading at 3KBPS and uploading at 2KBPS, netmeter shows around 6KBPS for download speed and 5 KBPS for upload speed. I noticed this only after I received call from Tata.

Now, I am in trouble as they might be filing an FIR against me, so help me out on following points:-
1. Am I infected with some spyware. (I am not using any spyware remover currently, downloading Spybot right now).
2. Is it possible for some1 to connect with my IP address.
3. And how to overcome this problem? (what shud I do prove myself innocent)

[satyamy]

ya its is possible that u r PC is infected by some virus or spyware & when U download something their is a lot of possibilities of these types of things
u did'nt specified what u wer downloading & from which site?..............

[champ_rock]

tell those tata people EXACTLY what had u done... it is fundamental right to know of the accusation against u .....then u can proceed... also does tata have a lan?

[blackpearl]

I guess ur PC is infected with a trojan which is carrying out DDoS attack from ur computer.
My suggestion is to first install a firewall and block access to all programs other than ur browser and other applications that u use for downloading stuff. Then run a through virus scan on ur PC with some trust worthy antivirus s/w like Norton. Also scan with some anti trojan and anti spyware. Make sure u have upto date virus defination files.

[casanova]

I stated that I was downloading thru eMule and cant exactly say wat since my download list in eMule is always 2 big.

My Norton antivirus auto protection was enabled and updates were also the latest and I had done my virus check on 10th may, it found 1 virus and it was deleted successfully and Friday was 12th.
I scanned my comp for spywares with Spybot, it showed 5 errors, 4 of them were tracking cookies and 1 was windows security center disable antivirus notify.
The 4 tracking cookies were from Avenue A. Inclusive, DoubleClick, HitsLink and SexTracker. I havent visited any of these sites. Even wen some unwanted sites open, I close them even before it is 10% loaded.
I am using Norton Systemworks 2003 with latest updates.
[Edit]
My OS is Windows XP SP2 with automatic updates on .
@champ rock
What do u mean by Tata having LAN.
They have given me a router with 1:4 connection.

[drvarunmehta]

Post a HijackThis! log file. Maybe you should just reinstall XP and get rid of whatever virii, malware or trojan is there on your PC.

[casanova]

Ok here is the hijackthis logfile. I am not understanding anything from this logfiles. Further, when at times when a trojan is detected, Norton deletes it and mostly I even then clear my temp folder.

[santu_29]

after looking at your logfile i found 2 bad entries, so please check them out

> O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM32\ldr64.dll
> O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

Also get the full details from your isp about the accusition, as said by champ

[it_waaznt_me]

The log is clean ...
{This word limit thingy sucks}

[robin345]

You should aslo have Norton internet Security b`coz you need extra firewall .
Also Try to clear everything with tata as soon as possible .

[Rollercoaster]

man keep a record of everything u detect and do with screenshots or something... if u really think they will file FIR...

[Akshay]

Just install Zone alarm (latest ver.). I wud suggest a thorough scan with NAV 2006 or just format ur sys (if poss.). Dont worry about the FIR n stuff coz nothing much can happen with it coz there is no "mens rea" (guilty mind) on ur part and u didnt do it purposly.

When companies like microsoft with latest techniques, technology, etc. are not immune from hackers how can we be?

[abracadabra]

as for your ip thing u r assigned the ip dynamically and not a static ip. but ppl remember not to try something nast as u r modem network card has a phsical address like thiz xx-xx-xx-xx-xx-xx can be gat by typing ipconfig /all at command prompt. they can find the excat location as to where the problems erupt.

[samrulez]

First scan ur pc with Anti spyware.........Then just check if the no 1 has access to ur phone ....or internet connection....Some1 else might be using ur connection and thats the reason u are getting low speeds

[PainKiller]

i think its not tata ppl but one of your friend must have played a prank of u. what do u think???????

[samrulez]

See TATA indicom is wireless..ok.Any on who has knowledge abt this can tune to a frequency of ur phone..ok..So he will have a phone on ur line.
And he can also connect to the net via ur line..And if he hacks some1 it will be via ur line..and therefore it is u who is blamed coz it is ur account.

[Netjunkie]

Originally Posted by abracadabra

as for your ip thing u r assigned the ip dynamically and not a static ip. but ppl remember not to try something nast as u r modem network card has a phsical address like thiz xx-xx-xx-xx-xx-xx can be gat by typing ipconfig /all at command prompt. they can find the excat location as to where the problems erupt.

TATA Indicom Broadband is Router based & provides a Static IP.
So no need of the Mac address for tracking purpose

In this case ask them what exactly do they mean by "hacking someone".
I dont feel they will take this issue very far.

[techiways]

He He. Don be scared dude. Its most obvious that your friends have bug a big well for you to fall in! Maybe its an true Bakra!

Come on... if you had really commited a cyber crime, why would tata indicom call you to inform that on first hand. Moreover i don think Indian Isps have time and such advancements to file an fir for some mere DDOS attack.

Unless you had abused someone online or had engaged in data theft, you could face such problems. Since you haven done any of these, its most likely that someone is playing a prank on you.

Also remember, no one can simply file an fir. They need evidence. Even if your computer was hacked and was being controlled by an third party, it could all be revealed through the ISPs log files. so dont worry. Everything is electronically logged and you cannot be held liable at all.

[casanova]

Hey, there was some confusion, it wasn't from TATA Indicom but someone very hifi. Wenever I try to call back that no., there is no ringing tone i.e; that is my call is picked up but some kind of different sounds come over there.

I reside in Pune and the no was from Mumbai. Strange thing is it doent look like a Mumbai no. The no is +912267925400
My cousin in Mumbai told me that it is not a MTNL no. Does anybody know this no is from which service provider.

I dont think so that it is a prank played by any of my friends. Reason 4 this is that my friends know me as Naveed Patel and my complete name is Naveed Shaikh Mohammed Patel. And most of the first timers call me Naveed Shaikh (even the TATA people) as Shaikh is a very common surname. Secondly, if it were any1 of my friends atleast I wud have listened a ringingtone. I tried the above mentioned no. many times and tat also from different nos. but same sound comes.
Yes, I am having a static IP and it is router based connection. Also tis connection is from proper TATA Indicom and not from Tata Indicom VSNL.

Is there any such s/w that can show how much bandwidth is consumed by which program so tat I can know wat is actually using my bandwidth.
Also, can some1 from Mumbai find out the service provider for the no. (+912267925400) and if possible whose no. is this.
Wud be scanning with Zone alarm soon.

[Edit]
Zone alarm is having a variety of packages. Which pacakge shud I use.

[Akshay]

Use Zone Alarm Security Suite v 6.1.744.001:

http://www.zonelabs.com

[Rollercoaster]

dude try to find the owner of the phone no..
try http://mumbai.mtnl.net.in/directory/telephone.html

[samrulez]

I think I found it ,its from...............go to the following link http://mumbai.mtnl.net.in/directory/telephone.html
and then paste the number I.E 2267925400 coz +91 is country code..

[casanova]

It is not a MTNL no. Akshay said it is a Tata No. They shifted from 5xxxxxxx to 6xxxxxxx.
Does anybody know the directory site for Tata.
A program edlm2.exe was trying to access the Internet repeatedly. It is residing in c:\windows\system32 (Zone Alarm tracked this). Any information about this program.

[prophet of the pimps]

its a trojan alright.
http://www.liutilities.com/products/...library/edlm2/

[hermit]

mac id saves u if ur innocient ,as u r id differs from hacker , u can walk off at ease .

as them to check the hacker mac id and urs

[Choto Cheeta]

Now, I am in trouble as they might be filing an FIR against me, so help me out on following points:-

they cant... u r a legal user of their system and services... for any reason if u have used any other account still they cant... u have used the account of some on else... so technically TATA doesnt have right to FIR against u... only the person who's account u have used is eligible to any such FIR with the help of the ISP...

in the history of internet... there wasnt any such case as u r saing... what will be the point of FIR?? u stole TATA's bandwidth... ?? lol...

so relax... TATA cant do any FIR against u... yes they can send u a bill for extra usage... thats all...

[casanova]

I am not sure whether the call was from Tata or some1 else but it is a high probabilty tat it was from Tata only. Its more than 5 days since the hacking was done. No action yet other than the phone call on monday. Does any1 hav an idea how much time they take to react in such cases.

Further, there is no chance of stealing bandwidth. I am not even getting my commited bandwidth.

[Choto Cheeta]

@casanova

why r u so warried... there is no CASE... some one fooled u man.. TATA as an ISP doesnt have right to file any such FIR.... they have right only to charge u as for the extra DATA of bandwidth u have used or inform u and ask u that whether u r notified about the action or not... thats what TATA as an ISP can do... worst thing is they may warn u and for showing this reason they may DC the line... there is no such thing as fileing any FIR... so relax...

[neo_online]

yes he is right man............
no isp has a right to file any complain against u........
n if u still thinklike some one stil using ur system...so download nod32 antivirus n follow aa deep scan....only dat cn help u.nod32 is a very perfect amtivirus n its signature is also very small......
so do it if u want..

[casanova]

thx 4 ur +ve responses. I am also thinking now that nothings gonna happen. If ot wud hav been real hacking, there wud definitely been sum action against me. If anything happens further I wud post here.

BTW I am infected with edlm2.exe trojan. Norton Systemworks 2003 wasnt succesful in removin it. Wat shud I do to remove it. Didnt start a new thread 4 this since I think it may be related to the hackin case. And is Zone Alarm Antivirus better than Norton systemworks.

Thx again. I can relax a bit now