Re: IP Flooding

From: StarScripter (me_at_privacy.net)
Date: 08/19/03


Date: Tue, 19 Aug 2003 09:53:21 -0400


==> *Hamish* from: hamish2444@yahoo.com
==> scribbled in: rup0b.46046$bo1.8283@news-server.bigpond.net.au

> I have a Win2K server that is demonstrating signs of IP spoofing and
> Denial of Service. The server connects to the internet via a DUN
> connection shared using ICS. In the last two days the network has slowed
> to nothing and several network apps including mail and web access have
> failed while trying to access resources on the server or on the external
> network.
>
> I have noticed that while the DUN connection is active the modem and DUN
> properties indicates a constant stream of data being uploaded from the
> server. The network functions normally when the DUN connection is
> disabled.
>
> The problem is not ISP specific as I have tried alternates. There is no
> firewall present (please no lectures, its not my network).
>
> Can anyone help me to isolate the cause of this problem?

Hi,

It's probably the w32.welchia worm looking for the msblaster worm to try and
remove
it. So the whole planet is being scanned, it's like the blind leading the
blind.
More info here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
and here:
http://vil.nai.com/vil/content/v_100559.htm

HTH

-- 
Cheers,
           Star
-- 


Relevant Pages

  • Re: Outgoing POP3 email missing/lost/not received
    ... Funny thing is that I have had this ISP for 8 years and it has always been ... It looks like when you last ran CEICW, you set the ISP's mail server to: ... Internet Connection Wizard. ... After the wizard completes, the following network connection ...
    (microsoft.public.windows.server.sbs)
  • Re: Outgoing POP3 email missing/lost/not received
    ... ISP's mail server instead of the domain name on the ... SUMMARY OF SETTINGS FOR CONFIGURE E-MAIL AND INTERNET ... Internet Connection Wizard. ... After the wizard completes, the following network connection ...
    (microsoft.public.windows.server.sbs)
  • RE: Problems with Permissions
    ... And SBS server is only take ... the role of an internal server. ... they are all configured to connected to internal network. ... g. Run the Configure Email and Internet Connection Wizard on SBS server. ...
    (microsoft.public.windows.server.sbs)
  • Re: Connection from remote computer to network SQL Server
    ... There is no firewall on the W2K machine acting as the SQL server. ... I tried making the SQL machine a "trusted" on the router. ... connection works. ... To find the IP address of your computer inside the network, ...
    (microsoft.public.access.adp.sqlserver)
  • Re: Networking Question - VLANs on SBS 2003 Premium SP1
    ... be sure you do not enable any DHCP server in internal network. ... You do not get any issue when you connect the SBS to the old router, ... On the Connection Type page, click Broadband, and then click Next. ...
    (microsoft.public.windows.server.sbs)