Victim of Hack attack?

[biozombie]

I was using OSXvnc to access my macMini from work. I log onto to find my Mac trying to run OS 9 classic. Also, a program was open, Cyberduck that ive never installed logged on to an ip to some weird scandinavian site. I've since changed my router pwd along with closed all ports and port fowarding. Do I have anything to worry about?

thanks all.

 

[emw]

Is there someone at your house that might have just been using Cyberduck to download something?

If not, then check the Cyberduck logs to see what was sent/retrieved, if you can. Do you have sensitive personal information on there that someone could access, such as bank account numbers or credit card information? If so, you might want to consider contacting your banks to see if there is any unwarranted activity, and perhaps even cancel the cards.

It sounds like someone may have somehow found your router IP with their own VNC client and went to town. Did you not have the VNC server password protected?

 

[biozombie]

Ok.

It was pwd protected.

No sensitive information.

I don't ever remember installing Cyberduck

No CC or Account #s

I have the IP that Cyberduck was connected to. Nothing on the PC except things ive designed. Nothing sensitive in my documents or anything. Music is the only think I figure anyone could want.

 

[ITASOR]

Ok.

It was pwd protected.

No sensitive information.

I don't ever remember installing Cyberduck

No CC or Account #s

I have the IP that Cyberduck was connected to. Nothing on the PC except things ive designed. Nothing sensitive in my documents or anything. Music is the only think I figure anyone.

You didn't answer the question about if there could have possibly been someone at your house simply using your Mini to connect to an FTP server. Was there?

Post or PM me the IP address it was connected to. If you can send the Cyberduck log, get that too.

 

[biozombie]

I can't check the log right now. but the ip was: 213.113.124.45

no one else was using the PC at the time.

http://www.ripe.net/fcgi-bin/whois?form_type=simple&full_query_string=&searchtext=213.113.124.45

I was correct when I thought earlier. Broadband customer in the netherlands.

I've since closed the ports, and changed my router pwd again.

 

[ajampam]

Something like this happening sucks.....isnt closing all the ports the best solution to keep the computer safe?