Have we a Hacker on HomeSeer

[jon00]

Paranoia at is best!

Gogs,

Have you by chance embedded a wave file in one of your pages? Is is by chance called welcome.wav?

There is nothing wrong here. The person viewing your page is just using a media player that will also check for .smi files for the same filename. This is a Synchronised Multimedia Integration Language to provide rich Audio/Visual presentations. More details here: http://www.w3.org/AudioVideo/

I believe both Quicktime & Real Player check for this.

Your other problems are totally unrelated.

[w.vuyk]

Gogs,

I had a adware scanner earlier on my HS box that would get a list of known adware IP's en put them in my hostfile to reroute it to my home IP "localhost" i.e. 127.0.0.1.
This resulted in lots of messages like yours in my HS log, because whenever I was browsing over the internet and approaching a site wich used ads comming from those known sites it would search on my computer for the gifs, jpeg and sounds.

I am not sure, but could this be happening to you too? Does the message in HS occur at times when someone is using the HS box for browsing?

Jons pointer might be true also though.

Wim

[Gogs]

Paranoia at it's best, yes that is true. However,

Yes Jon I did get very paranoid last night when everything stopped working for no apperent reason and probably have shot off in the wrong direction. However I still cannot get HS to respond to anything, except direct X10 commands from switches. This morning I thought it was a DooMotion problem, until I realised that the speach anouncements that are triggered by DM are still working, just lights will not turn on or off. and yes Jon, I do have a greeting audio file called welcome.wav.

dhanford, I presume you are reffering to my host HS computer web site and not the remote one you access it through. I am using Ad-aware, Spybot amd McAfee. Manually running them now as I type this.

Bill changed the port number, although do not see what difference that will make to HS's operation.

Anyway I will plod on to resolve this, even if it means a re-install.

[lancenorton]

Gogs - What are the IP addresses (external) that are logging onto your server? Perhaps that may throw some more light?

[Gogs]

Gogs - What are the IP addresses (external) that are logging onto your server? Perhaps that may throw some more light?

<TABLE cellSpacing=1 cellPadding=2 width="100%" align=center border=0><TBODY><TR><TD class=tableheader></FONT></TD><TR><TD class=tableroweven noWrap align=middle>12/09/2006 11:41:04 </TD><TD class=tablerowodd noWrap align=middle>24.250.50.13</TD><TD class=tableroweven noWrap align=middle></TD><TD class=tablerowodd noWrap align=middle>Guest</TD><TD class=tableroweven noWrap align=middle>Guest</TD><TD class=tablerowodd noWrap align=middle>1</TD><TD class=tableroweven noWrap align=middle>Cox Communications</TD><TD class=tablerowodd noWrap align=middle>-</TD><TD class=tableroweven noWrap align=middle>1400 Lake Hearn Dr.</TD><TD class=tablerowodd noWrap align=middle>-</TD><TD class=tableroweven noWrap align=middle>Atlanta</TD><TD class=tablerowodd noWrap align=middle>GA</TD><TD class=tableroweven noWrap align=middle>30319</TD><TD class=tablerowodd noWrap align=middle>US </TD><TD class=tableroweven noWrap align=middle>United States </TD><TR><TD class=tableroweven noWrap align=middle>11/09/2006 06:16:52 </TD><TD class=tablerowodd noWrap align=middle>68.4.95.149</TD><TD class=tableroweven noWrap align=middle></TD><TD class=tablerowodd noWrap align=middle>Guest</TD><TD class=tableroweven noWrap align=middle>Guest</TD><TD class=tablerowodd noWrap align=middle>1</TD><TD class=tableroweven noWrap align=middle>Cox Communications Inc.</TD><TD class=tablerowodd noWrap align=middle>CXA</TD><TD class=tableroweven noWrap align=middle>1400 Lake Hearn D...</TD><TD class=tablerowodd noWrap align=middle>-</TD><TD class=tableroweven noWrap align=middle>Atlanta</TD><TD class=tablerowodd noWrap align=middle>GA</TD><TD class=tableroweven noWrap align=middle>30319</TD><TD class=tablerowodd noWrap align=middle>US </TD><TD class=tableroweven noWrap align=middle>United States </TD></TR></TBODY></TABLE>

Missed one line in the copy and paste, but it's simmilar.

It is probably ligit, I got a bit paranoid and frustrated, and overeated, still am, HS is not working.

[jon00]

Gogs,

I see several posts from you regarding this problem with conflicting information. What exactly is not working with Homeseer?

You mention lights going on but not off. That does not sound like a Homeseer problem, more of a X10 issue or noise on your supply. Have you added anything recently to your house which could upset X10?

If Homeseer is crashing, you need to uninstall all plugins and start enabling them again. It may well be Doomotion - Jim seems to be having issues at the moment.

The web server issue is a complete red herring - your security has not been breached. The error just tells you that the web server could not serve that file. As you know, I have had my Web server open to guests for years and never had a single problem with security.

Just take it slowly and I'm sure you will find the problem.

[Bill Brower]

Bill changed the port number, although do not see what difference that will make to HS's operation.

If someone is mistakenly trying to hack your web page, they usually wont look anywhere but port 80.

I do run port 80 but a lot (Rupp) doesn't.

It's fun watching the kitty scripters trying to hack my HS web page, which is impervious to their MS targetted attacks.

[Gogs]

..................... Just take it slowly and I'm sure you will find the problem.

I may have found the problem.

I started HS with the windows task manager open, after the start up complete message in the HS log a programme starts called DBEXEC, then very shortly after goes to not responding. When I end the process on the screen that wants to inform Microsoft of the problem it tells me that this is the "Database administrator for DooMotion!

I'll have a search through the DM threads and see if I can shed any light on this.

[Jim Doolittle]

Gogs,

DBExec has been used for a while now to perform database administration. Not aware of any issues. It is a standalone program whose execution is started by DM and then it runs in its own thread. This was done to prevent interfence with HomeSeer.

Note that since DM 2.2 uses multi-threading via .NET2, DBEXEC is no longer used.

[Jim Doolittle]

...It may well be Doomotion - Jim seems to be having issues at the moment...

Only issues that I am aware with are the DooMotion 2.2 Beta issues and none of those issues should affect HomeSeer itself. In fact, it seems that .NET plug-ins are less likely to crash HomeSeer. DooMotion 2.0.134 should still be a very stable version.

[fireball]

Go to your HS directory and see when the last time your various files were modified. Any strange or out of the ordinary dates? How about their sizes as compared to a known good working system with fresh HS install? Unusual dates and sizes are indicitive of viruses that may have corrupted your HS install.
You say your other computers in your network are acting funny. Do they all have HS speaker client installed on them? Run msconfig and see what's in their startup. Check your task manager and see what's out of place on them.
Not saying you don't have a virus or haven't been comprimised at all. Just offering ways to detect something wrong and help you get a handle on the scope of the damage as well as figure out ways to deal with it. You may get one computer cleaned off as far as you know but another may still be infected and able to reinfect your cleaned machines unless you know and understand how that first infection happened and are able to prevent it.

[Gogs]

Fireball thanks for that advice.

I will try some of it and see what the results are. The reason I say some of it is because I updated to DooMotion 2.2 last night and it erred out trying to convert the database then logged that it would just use the existing one, then once loaded did nothing.

At about that point in time I lost the plot with HS and DM and anything else that came within reach; went into the HS directory selected all then hit delete, which gave me the great satisfaction of letting it know just who is in charge around here.

That lasted for about 3 minutes when I heard a female voice from on high, no not that high only upstairs, making an "observation" that none of the HA was working. I replied to the effect "I will look into it darling" and quickly restored a backup from a time I remembered HS worked OK.

Guess what, HS, DM and anything else is working like a dream again.

I suspect I have had a corrupt database somewhere, don't ask where.

I am going to try the DooMotion upgrade again this evening and see what happens this time. I know, don't fix something that is not broken.