Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: DoS

  1. September 18th, 2003, 05:36 PM #1
    smooth_operator
    smooth_operator is offline
    Junior Member
    Join Date
    Aug 2003
    Posts
    29

    DoS

    hey i dont know anything about a DoS attack but a server is having some problems. its a new server running win 2k, 2.4 gig intel xeon, 1 gig DDRAM. not even a month old. the problem is that interoffice email is taking 18 hours and office ping is around 4000! all workstations are new. there are 14 computers on the network. at first i thought about the NIC cards, (10/100) then maybe i thought they could be using a hub, not a switch, then i thought about cat-5, but i just cant figure out why its so slow! the workstations are running novell small business (im pretty sure) ive tried to include all information that would help you guys out, if you need to know anything you can IM me at smth op 86 or email me at erbaker@dmacc.edu thanks a lot for any help!
    Stay away from my friends, they\'re smooth operators lookin for a way in.
    Reply With Quote Reply With Quote
  2. September 18th, 2003, 06:18 PM #2
    nihil
    nihil is offline
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Hi, not my area of expertise, but your timescale tends to tie in with several worms or viruses?.........could be one of these pinging around.

    I have always been hacked off by stuff that wants to "register itself" before I even have an internet connection... I shall register when I want to...........and that will be after the AV and firewall!!! Hell................I paid for it?

    Seems you might have a malware incident, as you say it is about a month old?

    You also have an ".edu" to your e-mail.................student pranks?



    Just a couple of thoughts?

    Good luck
    Reply With Quote Reply With Quote
  3. September 19th, 2003, 05:17 PM #3
    smooth_operator
    smooth_operator is offline
    Junior Member
    Join Date
    Aug 2003
    Posts
    29
    no im asking for my mom, its at a law firm. thats just my student address.
    Stay away from my friends, they\'re smooth operators lookin for a way in.
    Reply With Quote Reply With Quote
  4. September 19th, 2003, 05:20 PM #4
    cheyenne1212
    cheyenne1212 is offline
    Senior Member
    Join Date
    Feb 2003
    Location
    Memphis, TN
    Posts
    3,747
    $100 you have the blaster worm.
    =
    Reply With Quote Reply With Quote
  5. September 19th, 2003, 05:27 PM #5
    smooth_operator
    smooth_operator is offline
    Junior Member
    Join Date
    Aug 2003
    Posts
    29
    how can i be for sure? i dont want to go around fixing the blaster worm when i dont have it...
    Stay away from my friends, they\'re smooth operators lookin for a way in.
    Reply With Quote Reply With Quote
  6. September 19th, 2003, 05:32 PM #6
    DjM
    DjM is offline
    I'd rather be fishing DjM's Avatar
    Join Date
    Aug 2001
    Location
    The Great White North
    Posts
    1,867
    If there is a firewall involved, check the logs for heavy activity on port 135. You can also download the repair tool from Symantec, it's quick and easy to use and will not only let you know if your infected, it will clean up the systems as well.


    Cheers:
    DjM
    Reply With Quote Reply With Quote
  7. September 19th, 2003, 05:36 PM #7
    cross
    cross is offline
    Senior Member
    Join Date
    Feb 2002
    Posts
    500
    Why not? Fixing vulerabilities before you get infected is called patching, and it's a very good idea. After you patch your systems up to date, you may want to run a virus scanner and/or a spyware checker: www.lavasoftusa.com
    Other then that, have you thought about installing a simple bandwidth meter on your server and workstations? This may help to find the cause of this disturbance.
    Ron Paul: Hope for America
    http://www.ronpaul2008.com/
    Reply With Quote Reply With Quote
  8. September 19th, 2003, 05:40 PM #8
    bpiedlow
    bpiedlow is offline
    Member
    Join Date
    Aug 2003
    Posts
    98
    You'll also want to make sure to download their newest 'removal' tool. It will allow you to remove any of the various versions of Blaster (including Blaster.D - Nachi worm)...

    You can get it from symantec here:
    http://securityresponse.symantec.com...oval.tool.html

    I would agree that what you've described definatly sounds like some systems have been infected with at least one version of this worm...

    RRP
    Reply With Quote Reply With Quote
  9. September 19th, 2003, 05:54 PM #9
    Maestr0
    Maestr0 is offline
    Senior Member Maestr0's Avatar
    Join Date
    May 2003
    Posts
    604
    High ping times can also indicate Welchia virus which shits ICMP packets everywhere.


    -Maestr0
    \"If computers are to become smart enough to design their own successors, initiating a process that will lead to God-like omniscience after a number of ever swifter passages from one generation of computers to the next, someone is going to have to write the software that gets the process going, and humans have given absolutely no evidence of being able to write such software.\" -Jaron Lanier
    Reply With Quote Reply With Quote
  10. September 19th, 2003, 05:59 PM #10
    dcongram
    dcongram is offline
    Senior Member
    Join Date
    Aug 2001
    Posts
    267
    You are 'asking for Mum' ..... nice gesture on your part.

    BUT.....who setup the network ? Who maintains it ? Who updates the Novell ?

    I am presuming whoever installed it also tested the network cables.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules