Singnet Users: any intrusion attempts?

• casshern

  17 Mar 06, 15:16

  This noon i got all these warnings from my Norton
  
  Intrusion: MS ASN1 Interger Overflow TCP.
  Intruder: 219.74.186.88 (181) <--- this address is variable
  Risk Level: High.
  Protocol: TCP
  Attacked IP: ROOM (192.168.1.2) <<--- my room's comp addy
  
  someone from Chit Chat also kena this thing. Using Singnet also...
  
  there's supposed to be an update from windows for this but i installed liao no use. this keep popping up. I wonder if its on Singnet's side
• casshern

  17 Mar 06, 15:57

  reference
  
  http://www.sgforums.com/?action=thread_display&thread_id=182650&page=0
• browniebaobao

  17 Mar 06, 16:39

  wat do u use to detect?
  
  i keep kena disconnected lately, esp today, two times within an hour.
• casshern

  17 Mar 06, 17:22

  Originally posted by browniebaobao:

  wat do u use to detect?
  
  i keep kena disconnected lately, esp today, two times within an hour.

  norton anti virus
• Kenashi

  17 Mar 06, 17:49

  i oso ganna this for twice today.
  
• casshern

  17 Mar 06, 17:53

  Originally posted by Kenashi:

  i oso ganna this for twice today.
  

  twice only? i lost count...
• Kenashi

  17 Mar 06, 17:55

  Originally posted by casshern:

  twice only? i lost count...

  
  i only logged on for 2 hrs plus mah.
  i oso ganna a stupid adware that keep asking me to apply for a green card n all my spyware n adware detector can't prevent it.
  it is getting on my nerves
  
• casshern

  17 Mar 06, 18:04

  Singnet Attempting to intrude into all its users computers?
  
  i got the ip address from worm protection and did a search on
  
  http://www.geobytes.com/IpLocator.htm?GetLocation
  
  Origin from SG.
  
  and i probe further at this webby
  
  http://www.completewhois.org
  
  and this is what i got
  
  

  inetnum: 219.74.0.0 - 219.75.127.255
  netname: SINGNET-SG
  descr: SingNet Pte Ltd
  descr: 2 Stirling Road
  descr: #03-00 Queenstown Exchange
  descr: Singapore 148943
  country: SG
  admin-c: SH9-AP
  tech-c: SH9-AP
  status: ALLOCATED PORTABLE
  mnt-by: APNIC-HM
  mnt-lower: MAINT-SG-SINGNET
  mnt-routes: MAINT-SG-SINGNET
  remarks: ----------------------------------------------------------
  remarks: This object can only be modified by APNIC hostmaster
  remarks: If you wish to modify this object details please
  remarks: send email to [email protected] with your organisation
  remarks: account name in the subject line.
  remarks: ----------------------------------------------------------
  changed: [email protected] 20041213
  source: APNIC
  
  person: SingNet Hostmaster
  address: SingNet Engineering & Operations
  address: 2 Stirling Road
  address: #03-00 Queenstown Exchange
  address: Singapore 148943
  phone: +65 7845922
  fax-no: +65 4753273
  e-mail: [email protected]
  nic-hdl: SH9-AP
  notify: [email protected]
  mnt-by: MAINT-SG-SINGNET
  changed: [email protected] 20000921
  source: APNIC
  

• Kenashi

  17 Mar 06, 18:06

  Originally posted by casshern:

  Singnet Attempting to intrude into all its users computers?
  
  i got the ip address from worm protection and did a search on
  
  http://www.geobytes.com/IpLocator.htm?GetLocation
  
  Origin from SG.
  
  and i probe further at this webby
  
  http://www.completewhois.org
  
  and this is what i got
  
  

  
  they trying to spy on our internet activity huh
• casshern

  17 Mar 06, 18:12

  Originally posted by Kenashi:

  
  they trying to spy on our internet activity huh

  i dunno, i called up the number from completewhois.com to question. no answer.
  
  will call up customer service.
  
  i think our privacy are at sake
• casshern

  17 Mar 06, 18:50

  Updates: Singnet Tech Service have no answers for now. however i had given them all the intruder's IP address and it's all traced to singnet's servers. the officer told me this is rather serious and they need to know who on the server's end is actually trying to intrude our computers.
  
  Recommended action for all singnet Users, turn on all your firewall and worm protection etc.
  
  if you do not have any, please disconnect from your internet if you treasure your privacy. of cos u can take the risk, if ur computer's screwed who will take the responsibility?
• chanff8

  17 Mar 06, 18:55

  I hope everyone is sensible enough to at least get firewall and antivirus softwares before going online. free ones like Zonealarn and AVG are better than nothing
• casshern

  17 Mar 06, 19:00

  Originally posted by chanff8:

  I hope everyone is sensible enough to at least get firewall and antivirus softwares before going online. free ones like Zonealarn and AVG are better than nothing

  we must understand that not everyone is as tech savvy as us.
  some simply use the net for surfing of information and that's it. i think those who really suffers are those who does transaction online and dont have a good firewall.... imagine if some one really managed to get all the personal info thru key loggers and all tat
• chanff8

  17 Mar 06, 19:16

  Originally posted by casshern:

  we must understand that not everyone is as tech savvy as us.
  some simply use the net for surfing of information and that's it. i think those who really suffers are those who does transaction online and dont have a good firewall.... imagine if some one really managed to get all the personal info thru key loggers and all tat

  The problem is even if users are not tech-savvy, it should already be common knowledge that Firewall and Antivirus applications are needed.
• casshern

  17 Mar 06, 19:54

  Originally posted by chanff8:

  The problem is even if users are not tech-savvy, it should already be common knowledge that Firewall and Antivirus applications are needed.

  that's your personal point of view.
  
  heard of pple who actually uses the net and MS office very oftne for their office and personal uses, but don't even have an idea what firewall does?
  
  they exist, and please understand that not everyone have the 'basic knowledge' of IT security that you have
• maggot

  17 Mar 06, 21:29

  Originally posted by Kenashi:

  
  they trying to spy on our internet activity huh

  I'm on 512k but the strength is 256k...so half of the bandwidth is used on something else...not too hard to figure out what's the activity for that right?
  
  To simultaneously do something else at the same speed given...
  
  So what do you all think of this?
• casshern

  17 Mar 06, 21:52

  3 hrs since i had reported this issue and i'm still getting attacks
• browniebaobao

  17 Mar 06, 22:36

  Originally posted by casshern:

  norton anti virus

  oh im using symantec.
  
  anti virus i know.. but how to check whether my pc has been intruded?
  
  if singnet is doing that.. then that explains why i always get disconnected?
  
  No wonder I called up to complain they also could not give me a satisfactory answer..
• browniebaobao

  17 Mar 06, 22:43

  Erm.. i juz enabled TAMPER PROTECTION ALERT and sysmantec anti virus notification pops up.. with 14 results..
  
  This is one of them..
  
  SYMANTEC TAMPER PROTECTION ALERT
  
  Target: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  Event Info: Open Process
  Action Taken: Blocked
  Actor Process: C:\Program Files\Yahoo!\YPSR\ypsr.exe (PID 536)
  Time: Friday, March 17, 2006 10:43:20 PM
  
  What does this mean?
• chanff8

  17 Mar 06, 23:02

  Originally posted by browniebaobao:

  Erm.. i juz enabled TAMPER PROTECTION ALERT and sysmantec anti virus notification pops up.. with 14 results..
  
  This is one of them..
  
  SYMANTEC TAMPER PROTECTION ALERT
  
  Target: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  Event Info: Open Process
  Action Taken: Blocked
  Actor Process: C:\Program Files\Yahoo!\YPSR\ypsr.exe (PID 536)
  Time: Friday, March 17, 2006 10:43:20 PM
  
  What does this mean?

  It seems that a file inside your Yahoo! folder is trying to tamper with your antivirus' file...
  
  I urge everyone using Singnet to disconnect if you discover anything suspicious (files disappearing, suspicious programs running etc.)
  
  Right now it seems that theres some security problems at Singnet. Better let them sort out first...
• browniebaobao

  17 Mar 06, 23:05

  Originally posted by chanff8:

  It seems that a file inside your Yahoo! folder is trying to tamper with your antivirus' file...
  
  I urge everyone using Singnet to disconnect if you discover anything suspicious (files disappearing, suspicious programs running etc.)
  
  Right now it seems that theres some security problems at Singnet. Better let them sort out first...

  but I blocked them liao.. should be safe right?
  
  or should i Disconnect?
• chanff8

  17 Mar 06, 23:24

  Originally posted by browniebaobao:

  but I blocked them liao.. should be safe right?
  
  or should i Disconnect?

  Right now I suppose you can still remain online. Make sure your firewall is at max security. If there are more of those alerts, disconnect
• browniebaobao

  17 Mar 06, 23:38

  Originally posted by chanff8:

  Right now I suppose you can still remain online. Make sure your firewall is at max security. If there are more of those alerts, disconnect

  yup. set my firewall also.
  
  thanks.
• casshern

  17 Mar 06, 23:42

  alamak i'm still getting the attacks... wonder wat's going on.
• duotiga83

  17 Mar 06, 23:44

  recently theres lots of attacks......get dc quite a lot of tmes already......