Rage Against The Isp

Printable View

June 16th, 2003, 07:03 PM
EINzTEIN

Rage Against The Isp

Hi
This thread was gonna be called Rage Against the Virus(i lov Rage Against The Machine),
but my dam ISP is more IRETATING
than the worst kind of virus(damn ISP)

It all began when i installed ZONEALARM,ZoneAlarm kept picking up Intrusions from variuas
ports mostly NetBOIS UDP,
-IT has already picked up 70 INTRUSIONS wich of 59 is HIGH rated.

So I thought i would ask my ISP,before i ask you guyz(and gulz).
My ISP wich is the "GREAT" South African ISP, M-WEB ,told me(via E-MAIL)
AND THIS IS THEIR DAMN REPLY(and I qoute):

---"
Good day
Thank you for contacting us.

I cannot give you any real advise on this as we do not support 3rd party software accept that all these calls are coming in via udp port, configer your firewall to block udp calls.
Please do not hesitate to contact us or our Technical Support Helpline on 0860 11 22 52 should you require any additional assistance. If you only have the one line you can contact us on 08216100 via your cellphone.

Kind regards

Veon Battista
M-Web Dial Services
Customer Service Representative"

So I phoned that "SUPPORT" "HELP"-line,and i was put through to the "advanced" "SUPORT"
department.
I told him that its NOT the software that is the prob(so its not a 3rd-party thing) and that
there is traffic and intrusins on my PC.

The guy said:" THERE IS ABSALUTELY NOW WAY ANYONE COULD HACK OR GAIN ACCESs TO YOUR COMPUTER,
NOT EVEN ME,BECAUSE M-WEB HAVE GOT A FIREWALL(does he think i dont know that ****) THAT PROTECTS
YOU."
He also said:"ITS YOUR FIREWALL THAT IS THE PROBLEM,YOU NEED TO INTSALL IT AGAIN(dumbass).
GOODBYE"

Now where does that leave me?->****en nowhere,so the only ones that could help me is YOU AO

HERE IS a few logs(parts only,cause putting the whole log on would be un-ending):

I am jus masking the DESTINATION(PARANOIA REASONS)

type,date,time,source,destination,transport
FWIN,2003/06/12,22:47:34 +2:00 GMT,196.7.205.238:1027,255.255.255.255:137,UDP
FWIN,2003/06/12,23:38:40 +2:00 GMT,196.7.205.238:1027,255.255.255.255:137,UDP
FWIN,2003/06/12,23:43:30 +2:00 GMT,196.7.205.238:1025,255.255.255.255:137,UDP
FWIN,2003/06/12,23:49:18 +2:00 GMT,68.75.249.230:1028,255.255.255.255:137,UDP
FWIN,2003/06/12,23:50:56 +2:00 GMT,196.7.206.59:1028,255.255.255.255:137,UDP
FWIN,2003/06/12,23:57:54 +2:00 GMT,196.7.205.238:1026,255.255.255.255:137,UDP
FWIN,2003/06/13,00:04:12 +2:00 GMT,196.7.206.59:1026,255.255.255.255:137,UDP
FWIN,2003/06/13,00:15:16 +2:00 GMT,196.7.206.59:1027,255.255.255.255:137,UDP
FWIN,2003/06/13,00:20:00 +2:00 GMT,196.7.206.59:1029,255.255.255.255:137,UDP

and another

FWIN,2003/06/14,17:07:28 +2:00 GMT,24.220.133.101:1413,255.255.255.255:139,TCP (flags:S)
FWIN,2003/06/14,17:27:14 +2:00 GMT,63.226.202.88:1025,255.255.255.255:137,UDP
FWIN,2003/06/14,17:34:00 +2:00 GMT,61.100.122.38:1029,255.255.255.255:137,UDP
FWIN,2003/06/14,17:54:34 +2:00 GMT,65.81.134.245:50023,255.255.255.255:137,UDP
FWIN,2003/06/14,18:26:14 +2:00 GMT,24.232.131.144:1038,255.255.255.255:137,UDP
FWIN,2003/06/14,18:26:44 +2:00 GMT,61.218.63.164:1026,255.255.255.255:137,UDP
FWIN,2003/06/14,18:33:12 +2:00 GMT,196.7.204.38:1057,255.255.255.255:137,UDP

Can anyone PLEASE tell me why is this happening??
Or is my ISP right??

I got ZoneAlarm's link here on AO so YOU guyz oughta know more,
and if this is NORMAL.
None of my other firewalls picks it uo and i have re-installed ZoneAlarm
and oh-yeah My CONECTION is slower(that i know is always a BAAAAAD sign)

*************************AO VIRUS WARNING************************
*In the SECURITY TOOLS in VIRUS-SCANNERS there is a scanner *
*named *
* BACK-WORK- IT is a TROJAN *
* *
* *
* *
* *
*****************************************************************

Thank You for reading this post,if you need more details ->I'll gladly supply.
And PLEASE DO ENJOY YOUR DAY.
June 16th, 2003, 07:10 PM
nebulus200

Actually, their response is quite adequate. A quickie investment in a linksys or dlink or any of the many other brands of router/dhcp server/firewall combos (40 to 50 dollars US) would instantly take care of the traffic you are seeing. ISP's will almost never block anything, with an exception when you are experiencing the effects of a DoS or DDoS attack and need to limit the traffic upstream from your connection.

An ISP's role is no different than a telephone companies. They are there to ensure a stable connection between you and the outside world, that is their primary concern, which is why you may or may not get tons of telemarketing calls (I don't know if it is as bad in South Africa as US, but I would assume so), they are just providing the service, not regulating it.

/nebulus
June 16th, 2003, 07:22 PM
bballad

I am amazed that none of the other firewalls you have tried picks this up (what sle have you tried). Unfortunitly this is probably normal...welcome to this wounderful new world broadband has opend us up to, every moron with a zombied machine scanning the web for new systems to infect, drop zonealarms into stealth mode, scan your system for viri and torjans that may be anounceing your address then get your IP rotated.
June 16th, 2003, 07:24 PM
Zonewalker

[edit] heh I really will have to stop being so verbose won't I... people just keep getting in there whilst I'm typing - thanks nebulus and bballad :) [/edit]

Can we at least spell words properly - it makes things easier to read.

Yes it is quite normal to have this many attempts to connect to your computer... not all of these are going to be hack attempts incidentally... some, if not the majority, of them will just be other machines pinging you to say 'hello' (as it were)

This IP for example 196.7.205.238 according to ARIN is

OrgName: UUNET Internet Africa
OrgID: IAFR
Address: P.O. Box 44633
Address: CLAREMONT
City: CAPE TOWN
StateProv: WCAPE
PostalCode: 7735
Country: ZA

NetRange: 196.7.0.0 - 196.7.255.255
CIDR: 196.7.0.0/16
NetName: NETBLK-TICSA-BLK1
NetHandle: NET-196-7-0-0-1
Parent: NET-196-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.IAFRICA.COM
NameServer: NS2.IAFRICA.COM
NameServer: AUTH200.NS.UU.NET
NameServer: AUTH210.NS.UU.NET
Comment:
RegDate: 1993-10-14
Updated: 2003-03-13

TechHandle: UIA-ORG-ARIN
TechName: UUNET SA
TechPhone: +27.21.658.8585
TechEmail: [email protected]

OrgTechHandle: UIA-ORG-ARIN
OrgTechName: UUNET SA
OrgTechPhone: +27.21.658.8585
OrgTechEmail: [email protected]

which accounts for the majority of the attempts in the first section -looks like your ISP (or at least the people who run your ISP) is pinging you to make sure you are still there.

68.75.249.230 is Ameritech Electronic Commerce.. the others look relatively harmless but you can check them out using ARIN (http://www.arin.net) if you don't have a tool like Sam Spade (available for free from http://www.samspade.org/) or something. Zone alarm tends to be relatively 'vocal' about alerting you to connection attempts - most of the time it's not anything to worry about. I should point out that you haven't been hacked ZA is just telling you that an attempt to connect to your PC was made.... it's outgoing connections you really have to worry about.

Z
June 16th, 2003, 08:48 PM
EINzTEIN

Thank you for putting me at rest;)

My other firewalls include Sygate Personel Firewall ; RatScan and a few others that arn't any
good.
i have run an WhoIs on these guyz but it really didn't matter to me from where it was coming
just the fact that there is constantly a ZoneAlarm pop-up every 5min.

Here in the RSA we dont really get that many TeleMarketing calls, about 2calls a month.
!!!Hey i found one thing in wich we are better than da US of an A-> people dont bug us as much here,damn we're good;) ,he he he.Jus kidding america you know i lov ya.

Thankz for the help, and advice.
June 16th, 2003, 08:57 PM
nebulus200

Quote:

Here in the RSA we dont really get that many TeleMarketing calls, about 2calls a month.

*drool* My god that would be wonderful...I probably get oh I don't know an average of five calls a day? Our state finally adopted a no-call list that starts July 1st...*fingers crossed*

EinzTein, netbios is by nature a very chatty protocol, and when you factor in all the problems with worm infections running rampant, there really isn't much of a point trying to track them all down...those people are having those kind of problems because of a lack of attention to their servers in the fist place...

You really should get a good hardware firewall to filter out all the nasty stuff before it ever makes it to your PC's...(We block tcp/139 and probably get oh I dunno, 1.3M hits a day? :P )

/nebulus
June 16th, 2003, 09:12 PM
FrameWork

Quote:

*drool* My god that would be wonderful...I probably get oh I don't know an average of five calls a day? Our state finally adopted a no-call list that starts July 1st...*fingers crossed*

I don't want to dash your hopes nebulus, but we signed up to that list in my state over a year ago, and we still recieve around 5 a day. I think its time i get the The TeleZapper from walmart. I wonder if that thing really works or not, cause the sign-up list were on is not doing the trick.
June 16th, 2003, 10:32 PM
EINzTEIN

DAMN 5 a DAY!!! gee

I would go mad jus absalutely MAD.
Here we dont have that kind of money to spend for Telemarketing-> phone calls are really expensive ->about 1DOLLAR for an hour, but there is this service where you(Residential line only) pay 7RAND (just under a DOLLAR) per call then from 7PM to 7AM you can talk/surf
as long as you want to.
How much do you USA'ers pay for a Phone call??
June 16th, 2003, 11:07 PM
nebulus200

Hmmm...depends heavily on your service...

For example, MCI's The Neighborhood, you can get local and long distance service with alot of bells and whistles (caller id, call blocking, call forwarding, etc) for a flat rate of 60 dollars / US month. No long distance charges, no local charges...period. Great if you make alot of long distance calls (which even at cut rates are still minimally 3 cents/minute ).

Then you kinda have to flip around and look at things, you can usually get some combination of a fixed amount charged a month and then a low per call charge (for example, 20 dollars month, + 3 cents minute).

These are however, just for local residences. When you start talking about businesses that have high call volumes, then they start getting significant discounts for their services. I am not familiar with what the charges are...it might be a high dollar amount but when you consider what it is per call...it is trivially small.

/nebulus

Quote:

I don't want to dash your hopes nebulus, but we signed up to that list in my state over a year ago, and we still recieve around 5 a day. I think its time i get the The TeleZapper from walmart. I wonder if that thing really works or not, cause the sign-up list were on is not doing the trick.

The telemarketers have already found ways around it. The way the telezapper works is to send a number disconnected tone when it detects the connection. It used to work to screw up the automated dialers that go around and find active numbers; however, last I read, they had made adjustments to it to where it didn't work anymore...

/nebulus
June 16th, 2003, 11:38 PM
EINzTEIN

Well lucky you guyz.W cant choose ,pay a fixed national rate (+1$ an hour) and an international rate
wich i am not to sure about cause last time i phoned international i didn't have any money
left to spend on luxeries for a month;) its about 5$ a minute-no thats not a typing error
its 5$ p/minute.
Here we only pay our only Provider(TELKOM) 59rand (about 7 $) p/month to get
those Identicall etc. gadgets.I always thought those gadgets r toooo expensive
but you just proved me wrong(I think i should go get me one now;))
June 17th, 2003, 02:35 AM
cdkj

Don't need the telezapper i got my son (Hello click mom the damn telemarkers again)and he be doing this now for a few months now