Possible hacker?

TCP server:3389 ip-122-152-181-170.asianetcom.net:32745
SYN_RECEIVED

when I perform a netstat I get this entry, sometimes it is in there twice.
How can I find out what is going on and how can I stop it? Currently this
client just has a cheap firewall which cannot block specific IPs and we need
to get the remote desktop port open for admin purposes.. sure we can change
the port, but that wouldnt really stop this.

Hello,

as it is not ESTABLISHED, this ip is not connected (but it contacted the tse
port). This computer may be scanning your server.

You may change the Terminal server port to get a more discrete door.

If this ip seems really bad, you can block it the cheap way:
route add -p 122.152.181.170 MASK 255.255.255.255 127.0.0.1 on the server.



--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"Dan" <(E-Mail Removed)> wrote in message
news:FDEBA854-D55F-4A08-854C-(E-Mail Removed)...
> TCP server:3389 ip-122-152-181-170.asianetcom.net:32745
> SYN_RECEIVED
>
> when I perform a netstat I get this entry, sometimes it is in there twice.
> How can I find out what is going on and how can I stop it? Currently this
> client just has a cheap firewall which cannot block specific IPs and we
> need
> to get the remote desktop port open for admin purposes.. sure we can
> change
> the port, but that wouldnt really stop this.
>
>

Blocking it the cheap way sounds good, considering we are having other issues
and it continues to return whenever we reboot.

Thanks.

"Mathieu CHATEAU" wrote:

> Hello,
>
> as it is not ESTABLISHED, this ip is not connected (but it contacted the tse
> port). This computer may be scanning your server.
>
> You may change the Terminal server port to get a more discrete door.
>
> If this ip seems really bad, you can block it the cheap way:
> route add -p 122.152.181.170 MASK 255.255.255.255 127.0.0.1 on the server.
>
>
>
> --
> Cordialement,
> Mathieu CHATEAU
> http://lordoftheping.blogspot.com
>
>
> "Dan" <(E-Mail Removed)> wrote in message
> news:FDEBA854-D55F-4A08-854C-(E-Mail Removed)...
> > TCP server:3389 ip-122-152-181-170.asianetcom.net:32745
> > SYN_RECEIVED
> >
> > when I perform a netstat I get this entry, sometimes it is in there twice.
> > How can I find out what is going on and how can I stop it? Currently this
> > client just has a cheap firewall which cannot block specific IPs and we
> > need
> > to get the remote desktop port open for admin purposes.. sure we can
> > change
> > the port, but that wouldnt really stop this.
> >
> >
>
>

If you think it was really connected (mean logged), you are in a big issue.
Is your administrator password strong ?

You may also rename the administrator account to protect it more.


--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"Dan" <(E-Mail Removed)> wrote in message
news:F048C3E0-1971-4C59-B6E1-(E-Mail Removed)...
> Blocking it the cheap way sounds good, considering we are having other
> issues
> and it continues to return whenever we reboot.
>
> Thanks.
>
> "Mathieu CHATEAU" wrote:
>
>> Hello,
>>
>> as it is not ESTABLISHED, this ip is not connected (but it contacted the
>> tse
>> port). This computer may be scanning your server.
>>
>> You may change the Terminal server port to get a more discrete door.
>>
>> If this ip seems really bad, you can block it the cheap way:
>> route add -p 122.152.181.170 MASK 255.255.255.255 127.0.0.1 on the
>> server.
>>
>>
>>
>> --
>> Cordialement,
>> Mathieu CHATEAU
>> http://lordoftheping.blogspot.com
>>
>>
>> "Dan" <(E-Mail Removed)> wrote in message
>> news:FDEBA854-D55F-4A08-854C-(E-Mail Removed)...
>> > TCP server:3389 ip-122-152-181-170.asianetcom.net:32745
>> > SYN_RECEIVED
>> >
>> > when I perform a netstat I get this entry, sometimes it is in there
>> > twice.
>> > How can I find out what is going on and how can I stop it? Currently
>> > this
>> > client just has a cheap firewall which cannot block specific IPs and we
>> > need
>> > to get the remote desktop port open for admin purposes.. sure we can
>> > change
>> > the port, but that wouldnt really stop this.
>> >
>> >
>>
>>

and change the admin password in case.
Also check that there isn't any new administrator account, and no
netbot/spyware

--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


"Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
news:O%(E-Mail Removed)...
> If you think it was really connected (mean logged), you are in a big
> issue.
> Is your administrator password strong ?
>
> You may also rename the administrator account to protect it more.
>
>
> --
> Cordialement,
> Mathieu CHATEAU
> http://lordoftheping.blogspot.com
>
>
> "Dan" <(E-Mail Removed)> wrote in message
> news:F048C3E0-1971-4C59-B6E1-(E-Mail Removed)...
>> Blocking it the cheap way sounds good, considering we are having other
>> issues
>> and it continues to return whenever we reboot.
>>
>> Thanks.
>>
>> "Mathieu CHATEAU" wrote:
>>
>>> Hello,
>>>
>>> as it is not ESTABLISHED, this ip is not connected (but it contacted the
>>> tse
>>> port). This computer may be scanning your server.
>>>
>>> You may change the Terminal server port to get a more discrete door.
>>>
>>> If this ip seems really bad, you can block it the cheap way:
>>> route add -p 122.152.181.170 MASK 255.255.255.255 127.0.0.1 on the
>>> server.
>>>
>>>
>>>
>>> --
>>> Cordialement,
>>> Mathieu CHATEAU
>>> http://lordoftheping.blogspot.com
>>>
>>>
>>> "Dan" <(E-Mail Removed)> wrote in message
>>> news:FDEBA854-D55F-4A08-854C-(E-Mail Removed)...
>>> > TCP server:3389 ip-122-152-181-170.asianetcom.net:32745
>>> > SYN_RECEIVED
>>> >
>>> > when I perform a netstat I get this entry, sometimes it is in there
>>> > twice.
>>> > How can I find out what is going on and how can I stop it? Currently
>>> > this
>>> > client just has a cheap firewall which cannot block specific IPs and
>>> > we
>>> > need
>>> > to get the remote desktop port open for admin purposes.. sure we can
>>> > change
>>> > the port, but that wouldnt really stop this.
>>> >
>>> >
>>>
>>>
>

Thanks for the info. I changed the Admin password and checked all the admin
groups to ensure knowone was added to it. Their doesnt seem to be any
suspicious applications running, but in my experience with spyware/bots they
are good at hidding.

"Mathieu CHATEAU" wrote:

> and change the admin password in case.
> Also check that there isn't any new administrator account, and no
> netbot/spyware
>
> --
> Cordialement,
> Mathieu CHATEAU
> http://lordoftheping.blogspot.com
>
>
> "Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
> news:O%(E-Mail Removed)...
> > If you think it was really connected (mean logged), you are in a big
> > issue.
> > Is your administrator password strong ?
> >
> > You may also rename the administrator account to protect it more.
> >
> >
> > --
> > Cordialement,
> > Mathieu CHATEAU
> > http://lordoftheping.blogspot.com
> >
> >
> > "Dan" <(E-Mail Removed)> wrote in message
> > news:F048C3E0-1971-4C59-B6E1-(E-Mail Removed)...
> >> Blocking it the cheap way sounds good, considering we are having other
> >> issues
> >> and it continues to return whenever we reboot.
> >>
> >> Thanks.
> >>
> >> "Mathieu CHATEAU" wrote:
> >>
> >>> Hello,
> >>>
> >>> as it is not ESTABLISHED, this ip is not connected (but it contacted the
> >>> tse
> >>> port). This computer may be scanning your server.
> >>>
> >>> You may change the Terminal server port to get a more discrete door.
> >>>
> >>> If this ip seems really bad, you can block it the cheap way:
> >>> route add -p 122.152.181.170 MASK 255.255.255.255 127.0.0.1 on the
> >>> server.
> >>>
> >>>
> >>>
> >>> --
> >>> Cordialement,
> >>> Mathieu CHATEAU
> >>> http://lordoftheping.blogspot.com
> >>>
> >>>
> >>> "Dan" <(E-Mail Removed)> wrote in message
> >>> news:FDEBA854-D55F-4A08-854C-(E-Mail Removed)...
> >>> > TCP server:3389 ip-122-152-181-170.asianetcom.net:32745
> >>> > SYN_RECEIVED
> >>> >
> >>> > when I perform a netstat I get this entry, sometimes it is in there
> >>> > twice.
> >>> > How can I find out what is going on and how can I stop it? Currently
> >>> > this
> >>> > client just has a cheap firewall which cannot block specific IPs and
> >>> > we
> >>> > need
> >>> > to get the remote desktop port open for admin purposes.. sure we can
> >>> > change
> >>> > the port, but that wouldnt really stop this.
> >>> >
> >>> >
> >>>
> >>>
> >
>
>