Question about the attack....

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Sep 28, 2007 8:53 pm

swordfish wrote:

Steve Gibson has written some good stuff:

Any relation to William Gibson..?.

Posted: Sat Sep 29, 2007 12:57 am

Quote:

The next question, how can I tell I'm clean

Apart from the mentioned anti virus tests have a look at network monitor in task manager if you have windows.

If it's shows constant activity when you aren't doing anything then further investigation will be required. Shut down everything that uses the network.
browsers, mail clients etc.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

***Copied from a previous post I made in another thread.

Since we are all taking a crash course on Computer Security 101 I thought I would share this.

It is a slick (Windows) application that will tell you what open connections you have to the internet and who your computer is talking to. Nice for sniffing out nasties on your computer that scans may miss. (Good for spyware/adware/trojans) It doesn't actually "fix" anything, but should alert you to any problems, like a persistent open TCP connection to a server that is unfamiliar to you.

Edit: (It is just a nice GUI for netstat, for those that are familiar with that command)

http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx

Unzip it and run Tcpview.

Here is another good resource...

http://www.processlibrary.com/

Do a Ctl+Alt+Del and click on the "Processes" tab

Now enter some of those processes by name (in the left hand column) into the data base to find out what that particular process is doing on your computer. It will alert you to any processes that are dangerous.

Beware when disabling processes, if you nix the wrong one... well, lets just say, its not a good thing if you don't know what you are doing.

If you have any questions, feel free to ask. I will help the best I can.

Posted: Sat Sep 29, 2007 4:17 am

To answer a question way back in the thread. The bot owners operate under capitalism. The cost is not what you get. The cost is what the customer is willing to pay. Just because it takes no real work to operate the bot network or much work to distribute it, doesn't mean it isn't worth a great deal of money for criminals to employ it.

But, my theory is that this attack is not a paid-for bot attack. We are being attack by a group that owns their own botnet. And is in the scam/spam/criminal element. It essentially costs them nothing to run their own bots. This only my opinion.

Master Baiter Joined: 11 Nov 2006 Posts: 199

well even then, if it is owned by them they are losing income not being able to rent it out while attacking... so they are losing money either way I guess.

Posted: Sat Sep 29, 2007 11:45 am

^^Depends on the size of the botnet. Some run into millions of computers and they never use the full power of them. If DrWho is right then chances are it's a group using a small part of the net and renting the other machines out as per usual.

Posted: Sat Sep 29, 2007 12:31 pm

OK the worst situation is where :

10 start virus
20 don't care
30 start virus just in case
40 check if boss hog has called.
50 create new me somewhere
60 who cares if boss called
70 asshole never called
80 goto 10

Master Baiter Joined: 11 Nov 2006 Posts: 199

Wish I had a copy of this bot code... would be interesting to pick apart...

Posted: Sun Sep 30, 2007 1:44 am

Get yourself a cheap computer, install win xp, do not update it, turn off all scanners and protection, connect it directly to the internet, click on every link you find and install every helpful link sent to you. In a few days you will have all the virus and bots you could want. How to get this specific one, I don't know.

Question about the attack....	View next topic View previous topic