Printable View
Aren't they both programmed to stop automatically at some point (I think I read that somewhere)? A lot of the stupid neighbors in my area have the virus and cant be bothered to do anything about it, so it's been sucking up the cable bandwidth in my neighborhood for quite some time.
well :)
Detecting network traffic that may be due to RPC worms
http://securityresponse.symantec.com...rpc.worms.html
W32.Blaster.Worm
Discovered on: August 11, 2003
http://securityresponse.symantec.com...ster.worm.html
There's two things to consider:
One: There are multiple versions of the virusses, each having another date on which they stop functioning. New versions (with new dates that are further away in the future) can come out any time.
Two: There's a (serious) security hole (or bug) in those computers that are infected now. If those holes are not patched, they're still open for others (virusses, worms, other attacks) to use.
Viper,
You are quite right! these malware will suck up bandwidth. Not only that, I would expect them to impact on the performance of their machines...................the trouble is that today's kit is so "over gunned" for average use that most people don't notice or care. I guess the guys you are referring to need re-education?..............I have a nice collection of old 286's and 386's.....they would care then :D
Guus has made the major point though, in that these things evolve. A lot of malware starts as some technically competent but morally bankrupt dude's "proof of concept", and does not have a malicious payload as such. It is usually not long before some script kiddie jumps on the bandwagon and changes all that.
If your machine is vulnerable FIX IT before something malicious comes along.
This may not be a virus............if you have always on broadband and someone puts a trojan on your PC, then downloads a shed full of kiddie porn, then overwrites the trojan program 32 times and deletes it. Then makes an anonymous phonecall to the FBI??????????????
I would not like to be your defence lawyer :)
You might like to point these scenarios out to your "cavalier" neighbours?
I think that the little banner at the bottom of TampaBay420's post says it all :)
Cheers
Some of us are charged by the Mb that is sent to our machines.. most of the port 135 weighing in a a mear 60 or so bytes it isn't a problem for one or two of these in a hour.. But when you may be connected 24/7 and the rate is >1000 per hour this could just tip you over on these download limited accounts.. not to mention the extra load it puts on a heavily used service..
Please note I don't believe that the ISP should act as a Firewall for their users, it is the users responsability to secure their own machine..
But the ISP need to action against the continuance of this abuse.,..
Cheers
As usual Und3ertak3r has made a couple of excellent points:
1. It is the responsibility of the owner to contol the dog...........that is, you are responsible for your own PC, and its security.
2. The Service Providers also have a duty (apart from collecting our cash), they have the financial resources to pursue these matters where us mere mortals cannot afford to tread. They can collaborate with government agencies and such.............politicians might even listen to THEM :rolleyes:
Cheers
Well unfortunately, a lot of the above info is correct about my neighbors, they use their machine mainly for e-mail/word processing, and they use it very lightly, so they don't notice anything wrong with it. They've got just the cable modem with no protection (other than McAfee :rolleyes: ), and they don't do windows updates either. I've tried telling them how serious it is but they don't want to listen... That's why I'm hoping whatever variation they have disables itself soon, cause my bandwidth is really hurting. I'm not even sure how many other people in my community may be infected and not aware...
At least I'm smart enough to spend some money on a router and good AV (avp), and most importantly, update my software/firmware. :D
Hey,
You gotta go for the child pornography thing..................It might just scare them enough to wake up............afterall if you get the Feds and your local cops suddenly turn up and take away equipment.............the neighbours might talk?
And even if ther isn't a successful prosecution................the smell still sticks around?
Pretty crude social engineering, but.....................
Good Luck...and don't do anything illegal in either of our countries :)
Doing anything illegal is too easy to get caught nowadays...except trojaners...they still managae to stay "safe"...
But maybe I'll send an anonymous e-mail saying blaster can get you "kiddie pr0n'd"...thats somewhat legal... :cool:
Viper2026,
You said it here..
The comments I have heard time and time again, and more often in the last few weeks.Quote:
They've got just the cable modem with no protection (other than McAfee ), and they don't do windows updates either.
1/ But I have an Antivirus program.. Why didn't that stop it?..
2/ Windows Update.. I thought that was incase you had a problem..
3/ Virus Updates?? I thought all you needed was the program
4/ But my computer came with a Nortons when I bought it 3 years ago
5/ Me mate Bill the Butcher reckons that Anti virus programs are a con, and we don't need them.. so why are you telling me I need a firewall as well.. are they a bigger con?
There you go some regulars and a couple of new ones..
Here is a trick.. Messenger..
they have xp they are not protected.. then they most likley have the NetSend/messenger Service turned on!..
find out their IP's and say g'day.. you are infected!!!.. I would recommend doing this through a couple of proxies.. or get a dumb friend to do it for you incase it backfires..
I think this legal.. that is to pop a warning in via messenger.. The spammers can and do.. so why not a friendly warning??
hmm what do ya think.. only questionable act I see is getting their IP addy..
Cheers
Ahaahaaaha!! :D :D
Well said Und3ertak3r!
Actually, if you are getting that much traffice on your local cable connection, a good personal firewall (I'm using McAfee, BTW, and it is working fine) will identify the IPs of the systems that have the infections. Backtrack to make sure, then Net Send their IP with a message. Provide a URL for help, removal tools and whatnot.
If that doesn't help, contact your provider and make a lot of noise. Check your contract. Being a good net-neighbor is likely in there.
Provide your ISP with the IPs of the offending machines and they will lock them out, if they are a responsible ISP.
I just cleaned up a system on campus here that had the Welchias worm. Something got in, probably via the RCP and killed our Symantec AV installation on that box. Then the Welchias showed up. I caught this by seeing the odd outgoing traffic on the router. It accounted for about half-a-meg worth of bandwidth going out.
A scan didn't find anything else there.
In response to undertaker, I can't believe I forgout about net send...lol I'll just send them a link sayng here's what can happen if you don't have a good av blah blah. I'll just move it over to my host and put an IP tracker script on it. And they've got XP so I assume messenger hasn't been turned off.
And also, they aren't on my local network, its the neighborhood section of broadband for my isp, some of my other [clean] neighbors have noticed slower speeds also.
Had to change to proxy server.
Quote:
What in the hell are you talking about?
Anyway, getting the IP shouldnt be to hard, also, you may want to call up the ISP and tell them whats going on. Mine listens to me :)