Topic 'Please Help, I think my computer is being monitored' in forum 'Security' - dslreports.com

Re: Please Help, I think my computer is being monitored

Mon, 16 Nov 2009 00:37:54 EDT

tempnexus posted :

said by ironwalker:

I own diamonds port explorer which was way better, but, since diamond ditched there old customers I cannot ever get my lifetime key back.
I liked it better than TCPView, more options and control.

Indeed a real shame from a former great company, I mean their PortExplorer, TDS-3, ProcessGuard and WormGuard were ahead of their time.
Too bad that Wayne is a duche.

You know that you can get the "free versions" of their lifetime.

After all if you have the lic, then it's not stealing. :)

I have the lic for TDS-3, ProcessGuard and PortExplorer. TDS-3 is useless (not updated since 2005 if I recall correctly). PG and PE are still ok...albeit many other great freeware out there that surpasses PG.

God damn I should really proof read...sometimes my mind races ahead of my typing and I seem to write Engrish.

Re: Please Help, I think my computer is being monitored

Thu, 12 Nov 2009 19:28:49 EDT

ironwalker posted : I own diamonds port explorer which was way better, but, since diamond ditched there old customers I cannot ever get my lifetime key back.
I liked it better than TCPView, more options and control.

Re: Please Help, I think my computer is being monitored

Thu, 12 Nov 2009 19:25:41 EDT

Name Game posted : In the past, I also trusted TCPView to resolve the IP until it gave we erroneous info in the names...Now I check them all myself and just let it list the IP.

"TCPView Professional has an internal table for translating many port numbers to their names. Select the resolve addresses button or the Options|Resolve Addresses menu entry to toggle name resolution. When name resolution is enabled TCPView Professional performs IP address name lookup operations in the background, updating the static and dynamic views as translations complete. In many cases IP addresses do not have corresponding names, and so are always shown numerically. If a name lookup fails for some reason, TCPView Professional re-attempts the lookup ten seconds later if the address is referenced by new entries in the static or dynamic views, or if you toggle name resolution off and then on again. Tip: You can quickly see what IP address corresponds to the name shown in an entry or vice versa by selecting the entry and then toggling name resolution with the Ctrl+R hotkey sequence."
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

Re: Please Help, I think my computer is being monitored

Thu, 12 Nov 2009 17:31:52 EDT

pog posted : These connections might have something to do with an add-on you have in your browser? My impression (based on the snippets from a google search) is that objectsciences, among other things, develops/hosts servlets for all kinds of things.

Try starting firefox in safemode... do these connections still occur? »kb.mozillazine.org/Safe_mode
--
My Site

Re: Please Help, I think my computer is being monitored

Thu, 12 Nov 2009 11:53:41 EDT

NetFixer posted :

said by ironwalker:

If the said saic and object science sites are monitoring, and collecting data building profiles on people, why would he go to opendns to block when some feel OpenDNS is or will be doing the samething weather for the govt or marketing agencies to make some money for there hard work..

The operative word is the first word in your post: (If).

There is no evidence that this actually occurred. This entire thread was based on a misinterpretation of the information presented by TCPView. There was no traffic to or from SAIC or Object Sciences to block, and any kind of DNS based blocking (OpenDNS or otherwise) would have blocked nothing anyway since neither of those domains were actually involved.

Of course one could block Akamai (the actual operator of the servers at the IP addresses referenced in this thread) using either DNS or firewall blocking, but doing so would likely disable a large portion of that person's access to the internet since Akamai is so deeply imbedded in content delivery for so many companies.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Wed, 11 Nov 2009 17:22:49 EDT

ironwalker posted : If the said saic and object science sites are monitoring, and collecting data building profiles on people, why would he go to opendns to block when some feel OpenDNS is or will be doing the samething weather for the govt or marketing agencies to make some money for there hard work.
Opendns is too damn popular, I gave it up long ago.
Sorry to switch topic a bit but I had to ask about that advice given.

I also do not let tcpview resolve address' nor does outpost firewall.
--
Live Free or Die!
www.sidux.com
www.chronixradio.com

Re: Please Help, I think my computer is being monitored

Wed, 11 Nov 2009 16:52:20 EDT

NetFixer posted :

said by tempnexus:

Oops forgot to mention.
If you do not want to bother with a host file and if your router does not support site blocking.
Then you can always use OpenDNS...albeit not as reliable but it still works.
For example I block googleanalytics in OPENDNS and set OpenDNS in my router as a default DNS and then set the DNS IP in my Pc's on my network to my router IP.
That way all my PC's behind my router are benefiting from the domain blocks.

In the OP's case, only local firewall blocking by IP address would have stopped access. Most likely those Akamai servers were either being directly accessed using an IP address or by using an Akamai hostname. Blocking *.objectsciences.com (either directly in a firewall, or indirectly with DNS) would not have stopped the access of the servers in question.

The "whatever.objectsciences.com" hostname resolution was coming from TCPView being configured to do rDNS resolution, and Verizon/UUNET still leaving ancient objectsciences.com PTR records in place for the IP addresses in question. There was likely never any actual attempt to connect to an objectsciences.com server, so blocking that domain name would not have stopped anything.

The screenshot below shows what a connection to http://65.222.174.5 in Internet Explorer looks like with TCPView configured to do rDNS resolution. I already posted the information in a previous post to show that IP address does actually point to an Akamai server.

[att=1]
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Wed, 11 Nov 2009 13:00:36 EDT

tempnexus posted : Oops forgot to mention.
If you do not want to bother with a host file and if your router does not support site blocking.
Then you can always use OpenDNS...albeit not as reliable but it still works.
For example I block googleanalytics in OPENDNS and set OpenDNS in my router as a default DNS and then set the DNS IP in my Pc's on my network to my router IP.
That way all my PC's behind my router are benefiting from the domain blocks.

Re: Please Help, I think my computer is being monitored

Wed, 11 Nov 2009 00:16:27 EDT

tempnexus posted : Nice quote:
I personally like this one by him:

"A question that sometimes drives me hazy: am I or are the others crazy? "

Re: Please Help, I think my computer is being monitored

Wed, 11 Nov 2009 00:14:02 EDT

NetFixer posted : TCPView (and most network diagnostic tools) can be configured to either resolve addresses or not.

[att=1]

[att=2]

I generally never configure such tools to resolve IP addresses for reasons such as what happened in this thread.

As Henry David Thoreau said, "Simplify, simplify simplify!".

Albert Einstein said it slightly differently, but the reasoning was the same: "Everything should be made as simple as possible, but not simpler."

As for who is/was in bed with whom, UUNET/MCI was just an ISP. Are you saying that some organizations should not be allowed to have internet service based on their political affiliation? Talk such as that might indeed put you in someone's gunsights.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Wed, 11 Nov 2009 00:13:47 EDT

tempnexus posted : Pfft if NSA/FBI/MOM/DAD/SIS/BRO are after your computer then they will probably get it.

I would not start freaking out about it unless you have a real reason to freak out (aka you just sold 3939393 pounds of pure white cocaine to a dude named bob).

Re: Please Help, I think my computer is being monitored

Tue, 10 Nov 2009 23:59:08 EDT

JosephL posted : I appreciate this explantion very much, thank you Netfixer.
Perhaps I was being somewhat paranoid. But it concerned me when I saw how objectsciences is now part of SAIC. I think it was last year when a bill named HR 604? something was passed by the US Government giving total legal immunity to violate constitutional privacy rights of anyone.

I think I am beginning to better understand things now.

I should maybe explain though also that I only found this page »www.robtex.com/cnet/65.222.174.html
by chance through a Google search for "objectsciences"
Which is how the entries appear in TCPVIew , host1 , host2.objectsciences etc. I never could find any IP associated with it until I came across that link.

All this which if I understand is basically due to MCI, now Verizon, who only formerly offered IP blocks to Objectsciences , who is now part of SAIC. And this lease has apparently since discontinued.

So essentially the reason my TCpView displays "objectsciences.com" instead of anything else is because Verizon still owns this block, but the DNS info has not been updated to display anything different.

Although I do wonder why I had never seen this entry before in TCPVIew until recently and nobody else had either.

But so hopefully the NSA/FBI is not after my computer after all then.

It does seem curious though that MCI or any other former major communications corporation for that matter, would be however much in bed so to speak with whomever objectsciences or any other similar company apparently involved with federal intelligence agencies. But nowadays Telecom/ISP corporations probably have an even greater relationship with these agencies. Something which they probably have had already for several decades anyways.

Thank you again for the info.

Re: Please Help, I think my computer is being monitored

Tue, 10 Nov 2009 19:12:42 EDT

NetFixer posted : What this means is that if you had supplied us with IP addresses in the first place instead of using hostnames, this "mystery" could have been resolved rather quickly.

Briefly, UUNET/MCI originally was assigned that IP address block, and they subsequently sublet a portion of it to Object Sciences. Verizon is the current owner of UUNET/MCI. What you are seeing is old PTR (AKA rDNS) records that still point to objectsciences.com even though they are no longer using that IP address block. It would appear that Akamai is now using that IP address block.

Your ISP is Verizon, so it is not really unexpected that you may have open sessions with Verizon IP addresses. Akamai Technologies provides content services for almost every major internet player, and it is not unexpected to find open sessions to Akamai IP addresses.

Here are whois queries that show a similar situation, except that Object Sciences is still listed as sub leasing this IP address block from UUNET/Verizon:

whois -h whois.arin.net n Object Sciences Corporation CustName:   OBJECT SCIENCES CORPORATIONAddress:    6359 WALKER LN STE 100City:       AlexandriaStateProv:  VAPostalCode: 22310Country:    USRegDate:    2004-03-18Updated:    2004-03-18 NetRange:   65.196.131.240 - 65.196.131.247CIDR:       65.196.131.240/29NetName:    UU-65-196-131-240-D4NetHandle:  NET-65-196-131-240-1Parent:     NET-65-192-0-0-1NetType:    ReassignedComment:    Addresses within this block are non-portable.RegDate:    2004-03-18Updated:    2004-03-18 RTechHandle: OA12-ARINRTechName:   UUnet Technologies, Inc., TechnologiesRTechPhone:  +1-800-900-0241RTechEmail:  help4u@verizonbusiness.com OrgAbuseHandle: ABUSE3-ARINOrgAbuseName:   abuseOrgAbusePhone:  +1-800-900-0241OrgAbuseEmail:  abuse-mail@verizonbusiness.com OrgNOCHandle: OA12-ARINOrgNOCName:   UUnet Technologies, Inc., TechnologiesOrgNOCPhone:  +1-800-900-0241OrgNOCEmail:  help4u@verizonbusiness.com OrgTechHandle: SWIPP-ARINOrgTechName:   swipperOrgTechPhone:  +1-800-900-0241OrgTechEmail:  swipper@verizonbusiness.com OrgTechHandle: JHU140-ARINOrgTechName:   Huffines, JodyOrgTechPhone:  +1-703-886-6093OrgTechEmail:  Jody.Huffines@verizonbusiness.com # ARIN WHOIS database, last updated 2009-11-07 20:00# Enter ? for additional hints on searching ARIN's WHOIS database. ------------------------------------------------------------------ whois 65.196.131.240MCI Communications Services, Inc. d/b/a Verizon Business UUNET65 (NET-65-192-0-0-1)                                  65.192.0.0 - 65.223.255.255OBJECT SCIENCES CORPORATION UU-65-196-131-240-D4 (NET-65-196-131-240-1)                                  65.196.131.240 - 65.196.131.247 # ARIN WHOIS database, last updated 2009-11-09 20:00# Enter ? for additional hints on searching ARIN's WHOIS database.

To head off what is probably the next question, the PTR/rDNS records are likely still pointing to objectsciences.com because of a simple oversight. There are no standards or requirements for PTR/rDNS records, and in fact many IP addresses do not even have PTR/rDNS records.

For the super paranoid among us, yes it is possible that Object Sciences decided to farm out whatever those IP addresses are used for to Akamai. However, if that were the case, I would think that a company with as much experience in covert operations as Object Sciences would have covered their tracks a bit better and removed the old PTR/rDNS records.

And for the record, it is definitely an Akamai server:

* + 65.222.174.5  |___    80  World Wide Web HTTP      |___ HTTP/1.0 400 Bad Request..Server: AkamaiGHost..Mime-Version: 1.0..Content-Type: text/html..Content-Length: 192..Expires: Wed, 1

[att=1]

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Tue, 10 Nov 2009 15:25:46 EDT

JosephL posted : Thanks maybe I will check out Ghostery.

Question for anyone here:

I found this page now - »www.robtex.com/cnet/65.222.174.html

It lists most of the "objectsciences.com" addresses along with this IP block - 65.222.174.0

Can someone please tell me what that IP has to do with any of this?

When I click on that IP the information lists :

MCI Communications Services, Inc. d/b/a Verizon Business UUNET65 (NET-65-192-0-0-1)
65.192.0.0 - 65.223.255.255
WS/Akamai Technologies/Akamai Technologies UU-65-222-174-D3 (NET-65-222-174-0-1)
65.222.174.0 - 65.222.174.255

My ISP is Verizon.

Re: Please Help, I think my computer is being monitored

Tue, 10 Nov 2009 12:41:27 EDT

Robotics posted : Get this program (for firefox) it blocks that one you mentioned, and a crap load of others flawlessly.

»www.ghostery.com/

Once installed, go through the program and make sure "block all" is selected. It also tells you what all is happening in the upper right of your screen. I think you will like the program. I personally think its great.

Hope this helps.

**edit...forgot to mention, I no longer have the problem you are having at the moment**
--
Long you live and high you fly and Smiles you'll give and tears you'll cry
and all you touch and all you see, is all your life will ever be.

Re: Please Help, I think my computer is being monitored

Tue, 10 Nov 2009 12:04:18 EDT

JosephL posted : Sorry, duplicate post.

Re: Please Help, I think my computer is being monitored

Tue, 10 Nov 2009 12:04:15 EDT

JosephL posted : Last night I decided to re-install Win XP. I believe it was a clean install , I just installed it/reformatted right over drive C: where it was before, erasing everything from before.

This morning as soon as I start up Yahoo IM, suddenly I see the same type of connections as before all over again.
YahooMessenger.exe:880: host25.objectsciences.com

Next, I click on the link inside YIM settings to read about their privacy policy. After I open default browser IE , I see even more various host#.objectsciences.com connections now in IE.

I haven't seen them in Firefox yet, but I suspect its just a matter of time now again.

I don't know if this has anything to do with Yahoo maybe?
I read about their some sort of affiliated ad info collection thing, maybe this has something to do it ?
»www.networkadvertising.org/manag···_out.asp

I even tried to ping "host25.objectsciences.com" for example but I get nothing, no response. I don't understand how TCPView can show these connections, but when I try to ping them , it comes back as as no server being there etc.

I don't know what to do anymore, I thought this would all be over now.

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 23:34:54 EDT

38632383 posted : If it were my computer I would either find out what it was or I would erase and start over.

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 18:59:57 EDT

JosephL posted : My Hosts file apparently was created by SPybot. There are no entries listing any specific IP address. The majority are formatted such as "127.0.0.1 www.007guard.com" and so on, thus blocking these websites from accessing my computer if I understand it correctly.

I have now gone in in notepad and added several name servers I have found relating to this site in my hosts file. I have placed these at the top of the file and listed the apparent main SAIC servers first , followed by most others listed sequentially. I'm not sure how many "host1, host2. servers they have, so I listed as many as I reasonably could" most info I have discovered from this site - »www.robtex.com/dns/objectsciences.com.html

I have also disabled my DNS Client in Services.

So far I have not noticed any more connections appearing in TCPView. SO I hope this problem is somehow now however much resolved?

When I open my command window and ping "objectsciences.com " or any other entry from my Hosts list, all now list "Ping statistics for 127.0.0.1 :
Packets sent = 4, Recieved = 4, Lost = 0 ,
Approximate Round Trip times in milliseconds :
Minimum = 0ms , Maximum = 0ms, Avergae = 0ms

Again, I am a novice to all this with using Hosts file to block sites if as I believe I now understand it correctly to do. I appreciate any advice. I should mention - I am on a router sharing the connection with other computers in the home. I have not attempted to block anything by configuring the router in any way, I have only done just this modification to my hosts file on my machine.
I will list the first portion of my hosts file with my modifications below -

127.0.0.1 localhost

# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 cpes1.saic.com
127.0.0.1 mcles1.saic.com
127.0.0.1 mail.objectsciences.com
127.0.0.1 ns1.objectsciences.com
127.0.0.1 ns2.objectsciences.com
127.0.0.1 ns2.objectsciences.com
127.0.0.1 superclass.objectsciences.com
127.0.0.1 class.objectsciences.com
127.0.0.1 www.objectsciences.com
127.0.0.1 objectsciences.com
127.0.0.1 host1.objectsciences.com
127.0.0.1 host2.objectsciences.com
127.0.0.1 host3.objectsciences.com
127.0.0.1 host4.objectsciences.com
127.0.0.1 host5.objectsciences.com
127.0.0.1 host6.objectsciences.com
127.0.0.1 host7.objectsciences.com
127.0.0.1 host8.objectsciences.com
127.0.0.1 host9.objectsciences.com
127.0.0.1 host10.objectsciences.com
127.0.0.1 host11.objectsciences.com
127.0.0.1 host12.objectsciences.com
127.0.0.1 host13.objectsciences.com
127.0.0.1 host14.objectsciences.com
127.0.0.1 host15.objectsciences.com
127.0.0.1 host16.objectsciences.com
127.0.0.1 host17.objectsciences.com
127.0.0.1 host18.objectsciences.com
127.0.0.1 host19.objectsciences.com
127.0.0.1 host20.objectsciences.com
127.0.0.1 host21.objectsciences.com
127.0.0.1 host22.objectsciences.com
127.0.0.1 host23.objectsciences.com
127.0.0.1 host24.objectsciences.com
127.0.0.1 host25.objectsciences.com
127.0.0.1 host26.objectsciences.com
127.0.0.1 host27.objectsciences.com
127.0.0.1 host28.objectsciences.com
127.0.0.1 host29.objectsciences.com
127.0.0.1 host30.objectsciences.com
127.0.0.1 host31.objectsciences.com
127.0.0.1 host32.objectsciences.com
127.0.0.1 host33.objectsciences.com
127.0.0.1 host34.objectsciences.com
127.0.0.1 host35.objectsciences.com
127.0.0.1 host36.objectsciences.com
127.0.0.1 host37.objectsciences.com
127.0.0.1 host38.objectsciences.com
127.0.0.1 host39.objectsciences.com
127.0.0.1 host40.objectsciences.com
127.0.0.1 host41.objectsciences.com
127.0.0.1 host42.objectsciences.com
127.0.0.1 host43.objectsciences.com
127.0.0.1 host44.objectsciences.com
127.0.0.1 host45.objectsciences.com
127.0.0.1 host46.objectsciences.com
127.0.0.1 host47.objectsciences.com
127.0.0.1 host48.objectsciences.com
127.0.0.1 host49.objectsciences.com
127.0.0.1 host50.objectsciences.com
127.0.0.1 host51.objectsciences.com
127.0.0.1 host52.objectsciences.com
127.0.0.1 host53.objectsciences.com
127.0.0.1 host54.objectsciences.com
127.0.0.1 host55.objectsciences.com
127.0.0.1 host56.objectsciences.com
127.0.0.1 host57.objectsciences.com
127.0.0.1 host58.objectsciences.com
127.0.0.1 host59.objectsciences.com
127.0.0.1 host60.objectsciences.com
127.0.0.1 host61.objectsciences.com
127.0.0.1 host62.objectsciences.com
127.0.0.1 host63.objectsciences.com
127.0.0.1 host64.objectsciences.com
127.0.0.1 host65.objectsciences.com

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 16:44:55 EDT

NetFixer posted :

said by ironwalker:

Understood, but, still doesn't help me.

The answer is quite simple, and also personal. If you have a router or other gateway firewall device that is capable of blocking domain names and/or IP address ranges, you are legally and morally entitled to block access to anything you wish.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 16:35:46 EDT

ironwalker posted : Understood, but, still doesn't help me.

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 16:33:14 EDT

NetFixer posted :

said by ironwalker:

Ok, I noticed today several deleted replies, one of which suggested to block the address block of the offending saic site.
I went and added this in my router, should I remove it now....why was that reply deleted?

Don't ask, don't tell. :hmm:
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 16:22:32 EDT

ironwalker posted : Ok, I noticed today several deleted replies, one of which suggested to block the address block of the offending saic site.
I went and added this in my router, should I remove it now....why was that reply deleted?

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 14:58:11 EDT

The Snowman posted :

EG,

I just did an online Whois on that url an had the same results............online lookup would it be effected by a Hosts File ?

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 14:47:42 EDT

EGeezer posted :

said by The Snowman:

... kindda makes a person wonder. ...

If it's what I mentioned with the host files, it could be a legit app simply opening a pipe with address of 127.0.0.1 and displaying the host names instead of or ina addition to the address.
--
The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 14:31:55 EDT

The Snowman posted : EGeezer said:

When I did a lookup and a PING for the specific hostnames, host4.objectsciences.com host50.objectsciences.com but I get no IP address resolved for them. That makes me wonder if your Hosts file might have something in them. "

________________________________

EG,

That was the same results I had as well. Thanks for posting that information.
It should be interesting to see just where that Server is located.
An like you I agree that if I were the OP I would not rest until this was resolved.
It will also be interesting if we ever learn what the OP has installed that is calling out that way.......kindda makes a person wonder.

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 12:43:56 EDT

EGeezer posted : If it were my system, I think I'd want to find out what's initiating those connections too -

Objectsciences article;

said by article :

Science Applications International Corp. has completed another local acquisition, paying an undisclosed sum for Object Sciences in Alexandria.

The San Diego-based company says Object Sciences will become part of its Operational Intelligence Solutions Business unit. Object Sciences, which has 133 employees, specializes in systems integration and analysis for government intelligence agencies. ...

»washington.bizjournals.com/washi···y28.html

SAIC company profile -partial, read the rest at the link;

SAIC, Inc. provides scientific, engineering, systems integration, and technical services and solutions to various branches of the U.S. military, agencies of the U.S. Department of Defense, the intelligence community, the U.S. Department of Homeland Security and other U.S. government civil agencies, state and local government agencies, foreign governments, and customers in select commercial markets ...

»finance.yahoo.com/q/pr?s=SAI

When I did a lookup and a PING for the specific hostnames, host4.objectsciences.com host50.objectsciences.com but I get no IP address resolved for them. That makes me wonder if your Hosts file might have something in them.

One thing that would be helpful would be to PING from that computer and post what IP address it resolves to. Another would be to look in your HOSTS files to see if there's an entry in it for the host names. If they're in your hosts file and resolve to 127.0.0.1, you're good :) If the names are in the hosts file and resolve to other addresses, document the entry information and delete the entries.

Note that connections to 127.0.0.x may display the first name listed for that address. That entry is usually (and should be)

127.0.0.1 localhost

netstat -b will also show the application name associated with the connection, but I don't think it shows the underlying process. As NetFixer indicated, Process Explorer from »technet.microsoft.com/en-us/sysi···653.aspx will go deeper.
--
The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis

Re: Please Help, I think my computer is being monitored

Sun, 08 Nov 2009 10:18:25 EDT

caffeinator posted :

said by La Luna:

I (and many, many others) have use SUPER for a long time without issues. When the updater asks to connect to the internet, I deny it. I doubt it was the cause of your problem.

+1 to that. I use Super and ALL2AVI all the time and have no such processes....perhaps it's one of those dodgey divx sites eh?
--

My 9/11 Tribute..online since 9/14/01
Need an Avatar? Check out Wafen's Avatar Pages

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 23:33:28 EDT

La Luna posted : I (and many, many others) have use SUPER for a long time without issues. When the updater asks to connect to the internet, I deny it. I doubt it was the cause of your problem.

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 23:26:06 EDT

fatness posted : I found this: »www.tv-cards.com/messageboard/vi···id=15361

It seems the Arcsoft thing may be running as a service, which you would need to turn off.
»forums.techguy.org/all-other-sof···ain.html
»www.arcsoft.com/Forum/forum_post···84f3b49e
--
"I cannot teach him. The boy has no pants."

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 23:19:21 EDT

JosephL posted : Thank you everyone for the advice and help, I really appreciate it.

The processes associated with this appear to be primarily my browsers, both Firefox and IE from what I can tell.

To the best of my memory, the only programs I had recently installed and now since deleted were ArcSoft Video Downloader, Flvsoft YouTube FLV Downloader and Erightsoft Super Video Converter.

Arcsoft was part of software with a Phillips Mp3 player I had recently purchased and came in the form of a Firefox browser add-on. I don't know much about this company so I can't conclusively say if it necessarily contained any malware, although I am noticing an "ArcSoft Connect Daemon - ACService.exe" entry in Hijack this even despite uninstalling it.
The Arcsoft privacy policy does seem to mention something relating to information collection however.

I also have read some debate on the safeness of Super video converter. But I dont even know what remaining files it may have left after uninstall.

I am however unfortunately noticing the connection still randomly appearing upon arriving at whatever various legit webpages and also when I go to try to login to Hotmail or Yahoo mail.

I may just end up re-installing Windows. Although I have scanned the system directory with Avira, and Malwarebytes even in safe mode and both found nothing.

For the record I do beleive the Whois for this site is accurate.
I don't know much of anything about this Corporation but it seems quite large and kinda scary.

Maybe I am just being paranoid, as someone suggested this company may also have other, however more hopefully seemingly benign "Scientific" or otherwise less evil data mining type stuff associated with it but who really knows. I doubt I will end up calling them on the phone to ask.

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 21:09:40 EDT

caffeinator posted : Some info on the company: »washington.bizjournals.com/washi···y28.html

--

My 9/11 Tribute..online since 9/14/01
Need an Avatar? Check out Wafen's Avatar Pages

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 15:22:12 EDT

NetFixer posted :

said by Anav:

How did you find information on this company as others have shown/researched to indicate your information is bogus??

Exactly what part of the information in this thread do you find to be bogus (not counting the bogus claim that "whois" did not return any information)?

»investors.saic.com/releasedetail···D=315256
Snapped 2009-11-07 15:20:07

Is your broken?
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 15:04:02 EDT

Anav posted : How did you find information on this company as others have shown/researched to indicate your information is bogus??

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 14:07:03 EDT

DownTheShore posted : Are you involved with any kind of distributed network project? Perhaps they are legitimately receiving information as a part of that project.

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 11:07:13 EDT

Blackbird posted : (post deleted by author)

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 05:00:01 EDT

38632383 posted :

said by JosephL:

Recently, I'd say within the last few weeks I have begun noticing through TcpView that my computer seems to be periodically connecting to a site called "objectsciences.com".

You have most likely installed a program or service that is connected to them. Why not call 1-877-999-7242 and ask them what it might be ?

Edit - It is unlikely that a company who registerd their name in the year 1989 is up to anything very nefarious today.

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 04:33:28 EDT

NetFixer posted : What process does TCPview show is making the connections in question?

If it is the ubiquitous "System" process, you might want to try using Process Explorer to better pinpoint the source.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: Please Help, I think my computer is being monitored

Sat, 07 Nov 2009 04:28:55 EDT

NetFixer posted :

said by The Snowman:

A "whois" of that name did not show up anything.........

I don't know what you are using for your "whois", but....

 Server used for this query:  [ whois.tucows.com ] Registrant: SAIC 10260 Campus Point Drive San Diego, CA 92121 US  Domain name: OBJECTSCIENCES.COM  Administrative Contact:    SAIC, SAIC  domains@saic.com    10260 Campus Point Drive    San Diego, CA 92121    US    +1.8779997242 Technical Contact:    SAIC, SAIC  domains@saic.com    10260 Campus Point Drive    San Diego, CA 92121    US    +1.8779997242  Registration Service Provider:    Melbourne IT DBS, support@melbourneitdbs.com    1-866-907-3267    1-650-963-3266 (fax)    Please contact Melbourne IT DBS, Inc. for domain updates,    DNS/Nameserver changes, and general domain support questions.  Registrar of Record: TUCOWS, INC. Record last updated on 12-Aug-2009. Record expires on 08-Aug-2013. Record created on 09-Aug-1997.  Registrar Domain Name Help Center:    http://domainhelp.tucows.com  Domain servers in listed order:    MCLES1.SAIC.COM    CPES1.SAIC.COM

Server used for this query:  [ whois.networksolutions.com ] Registrant:Science Applications International Corporation   10260 Campus Point Drive   San Diego, CA 92121   US    Domain Name: SAIC.COM    Administrative Contact, Technical Contact:      SAICdomains@saic.com      10260 Campus Point Drive      San Diego, CA 92121      US      +1.8779997242    Record expires on 10-Feb-2010.   Record created on 09-Feb-1989.   Database last updated on 7-Nov-2009 04:19:22 EST.    Domain servers in listed order:    CPES1.SAIC.COM               198.151.12.53   MCLES1.SAIC.COM              198.151.13.53

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson