Virus, daarna DoS Attacks

Status
Niet open voor verdere reacties.
2

2fastTG

Nieuwe gebruiker
Lid geworden
25 dec 2008
Berichten
4
Gisteren avond is een vriend op bezoek geweest met zijn laptop, omdat hij natuurlijk ook graag wat wou gamen hebben we deze laptop voorzien van internet.
Na +- 15 minuten werd het internet merkbaar sloom aangezien ik vaker problemen heb gehad met het internet zocht ik hier niks achter, vanmorgen begon het me echter te irriteren dus even een powercycle uigevoerd. Deze powercycle v/h modem + de router hielp niks. Toen ik inlogde in de router gingen alle alarm bellen rinkelen toen ik de logs bekeek;
Code: 
[LAN access from remote] from 36.238.195.183:26480 to 192.168.1.11:60681 Tuesday, Aug 14,2012 12:01:50
[LAN access from remote] from 178.44.145.215:6881 to 192.168.1.11:60681 Tuesday, Aug 14,2012 12:01:42
[LAN access from remote] from 1.22.244.82:21893 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:58:04
[LAN access from remote] from 46.232.228.172:40206 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:57:04
[LAN access from remote] from 200.207.173.244:19493 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:56:55
[LAN access from remote] from 178.126.65.241:29554 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:56:52
[LAN access from remote] from 94.113.233.17:37302 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:56:18
[LAN access from remote] from 178.92.155.132:28620 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:56:12
[LAN access from remote] from 89.139.170.130:10183 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:55:56
[LAN access from remote] from 69.132.113.169:29814 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:55:08
[LAN access from remote] from 98.193.91.37:35774 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:55:01
[LAN access from remote] from 151.50.79.123:28477 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:54:22
[LAN access from remote] from 176.42.91.99:40476 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:54:16
[LAN access from remote] from 80.237.113.6:12545 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:54:11
[LAN access from remote] from 88.18.59.9:20583 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:54:07
[LAN access from remote] from 89.186.114.131:16314 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:53:53
[LAN access from remote] from 95.29.85.215:35691 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:53:53
[LAN access from remote] from 80.98.186.124:64560 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:53:26
[LAN access from remote] from 74.236.111.54:47424 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:53:24
[LAN access from remote] from 95.189.0.84:44850 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:53:12
[LAN access from remote] from 195.211.212.94:5340 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:56
[LAN access from remote] from 89.233.200.54:60398 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:43
[LAN access from remote] from 2.125.93.227:42408 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:41
[LAN access from remote] from 122.146.53.193:22746 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:35
[LAN access from remote] from 92.84.169.98:51186 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:35
[LAN access from remote] from 175.194.9.22:53748 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:27
[LAN access from remote] from 217.76.116.160:51054 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:22
[LAN access from remote] from 121.165.222.203:43611 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:10
[LAN access from remote] from 99.146.127.96:20632 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:52:06
[LAN access from remote] from 46.54.143.4:1050 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:52
[LAN access from remote] from 126.117.88.152:36345 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:42
[LAN access from remote] from 82.72.179.15:45080 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:32
[LAN access from remote] from 88.111.48.149:19262 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:30
[LAN access from remote] from 109.185.45.86:46058 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:30
[LAN access from remote] from 46.47.35.31:10528 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:26
[LAN access from remote] from 27.0.23.73:42258 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:24
[LAN access from remote] from 24.124.68.24:35977 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:20
[LAN access from remote] from 81.233.24.64:43666 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:06
[LAN access from remote] from 93.148.235.50:24624 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:51:02
[LAN access from remote] from 76.187.145.221:42193 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:40
[LAN access from remote] from 80.202.21.132:49288 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:30
[LAN access from remote] from 89.76.0.243:23460 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:28
[LAN access from remote] from 62.183.85.196:42586 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:21
[LAN access from remote] from 209.128.39.10:2025 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:16
[LAN access from remote] from 83.191.76.135:41756 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:16
[LAN access from remote] from 83.28.36.205:35542 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:15
[LAN access from remote] from 91.142.169.114:23591 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:13
[LAN access from remote] from 46.12.89.135:10661 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:12
[LAN access from remote] from 46.161.84.178:44613 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:11
[LAN access from remote] from 109.161.77.189:6881 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:08
[LAN access from remote] from 94.41.30.227:53786 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:08
[LAN access from remote] from 79.180.155.63:26587 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:03
[LAN access from remote] from 109.222.30.224:33404 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:50:00
[LAN access from remote] from 46.46.53.180:19294 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:56
[LAN access from remote] from 46.246.92.44:34380 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:47
[LAN access from remote] from 80.185.181.237:17788 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:46
[Admin login failure] from source 192.168.1.4, Tuesday, Aug 14,2012 11:49:43
[LAN access from remote] from 119.193.104.22:1245 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:40
[LAN access from remote] from 46.232.228.172:31336 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:37
[LAN access from remote] from 81.207.167.73:10473 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:36
[LAN access from remote] from 206.75.97.116:61168 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:34
[LAN access from remote] from 89.122.243.97:16095 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:23
[LAN access from remote] from 188.97.231.185:32968 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:22
[LAN access from remote] from 74.115.1.94:19918 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:22
[LAN access from remote] from 183.179.123.110:22505 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:22
[LAN access from remote] from 24.98.144.242:29078 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:21
[LAN access from remote] from 91.205.238.32:10949 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:21
[LAN access from remote] from 109.242.67.176:37869 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:21
[LAN access from remote] from 95.25.243.82:64569 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:20
[LAN access from remote] from 46.107.67.123:2607 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:20
[LAN access from remote] from 174.5.133.144:52238 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:18
[LAN access from remote] from 2.35.151.180:1049 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:15
[LAN access from remote] from 46.254.97.167:63937 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:09
[LAN access from remote] from 49.244.167.46:11027 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:08
[LAN access from remote] from 87.202.179.45:28743 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:04
[LAN access from remote] from 80.174.146.172:36627 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:49:03
[LAN access from remote] from 80.202.51.2:36034 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:53
[LAN access from remote] from 69.204.115.84:27954 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:53
[LAN access from remote] from 176.52.43.144:24303 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:52
[LAN access from remote] from 209.240.33.6:52141 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:52
[LAN access from remote] from 178.122.159.24:14796 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:51
[LAN access from remote] from 178.128.173.145:59957 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:50
[LAN access from remote] from 2.98.157.248:11418 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:47
[LAN access from remote] from 213.112.14.152:56822 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:47
[LAN access from remote] from 91.182.204.107:2578 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:46
[LAN access from remote] from 84.208.255.231:28473 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:39
[LAN access from remote] from 77.85.132.235:44629 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:38
[LAN access from remote] from 188.50.218.243:64219 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:33
[LAN access from remote] from 27.110.233.67:33060 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:33
[LAN access from remote] from 2.95.108.205:22186 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:30
[LAN access from remote] from 78.165.108.65:28723 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:29
[LAN access from remote] from 2.49.234.107:33863 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:26
[LAN access from remote] from 84.49.143.27:37449 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:25
[LAN access from remote] from 176.251.82.4:52363 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:25
[LAN access from remote] from 79.140.12.6:24795 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:22
[LAN access from remote] from 221.24.110.159:47963 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:14
[LAN access from remote] from 95.105.110.30:6881 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:13
[LAN access from remote] from 109.101.60.245:1094 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:08
[LAN access from remote] from 62.253.144.140:18905 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:04
[LAN access from remote] from 218.112.132.53:32249 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:03
[LAN access from remote] from 190.213.161.163:49200 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:03
[LAN access from remote] from 101.99.11.24:63381 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:00
[LAN access from remote] from 46.72.70.238:59381 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:48:00
[LAN access from remote] from 178.95.128.249:25590 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:55
[LAN access from remote] from 115.208.173.39:11935 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:55
[LAN access from remote] from 182.68.46.54:37981 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:53
[LAN access from remote] from 124.185.191.41:32027 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:52
[LAN access from remote] from 213.89.108.7:48622 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:49
[LAN access from remote] from 84.41.95.98:60608 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:47
[LAN access from remote] from 78.26.128.183:34039 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:46
[LAN access from remote] from 41.133.91.85:80 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:46
[LAN access from remote] from 141.170.224.246:22973 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:44
[LAN access from remote] from 180.254.155.42:10056 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:44
[LAN access from remote] from 212.226.41.187:37441 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:42
[LAN access from remote] from 202.133.60.106:38697 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:41
[LAN access from remote] from 202.69.164.50:5299 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:40
[LAN access from remote] from 210.187.171.20:12148 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:38
[LAN access from remote] from 2.233.221.180:12177 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:36
[Admin login] from source 192.168.1.4, Tuesday, Aug 14,2012 11:47:33
[LAN access from remote] from 187.11.53.191:62558 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:33
[LAN access from remote] from 95.26.170.119:30968 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:31
[LAN access from remote] from 80.221.185.84:52915 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:30
[LAN access from remote] from 178.166.13.163:50025 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:29
[Admin login failure] from source 192.168.1.4, Tuesday, Aug 14,2012 11:47:29
[LAN access from remote] from 90.199.96.248:52525 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:29
[LAN access from remote] from 86.104.254.225:38818 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:27
[LAN access from remote] from 89.136.120.174:51329 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:25
[LAN access from remote] from 188.169.166.76:1038 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:22
[LAN access from remote] from 109.58.188.102:43204 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:19
[LAN access from remote] from 92.112.51.143:14300 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:19
[LAN access from remote] from 117.6.8.211:29391 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:18
[LAN access from remote] from 94.40.103.77:29335 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:18
[LAN access from remote] from 31.9.112.205:28074 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:15
[LAN access from remote] from 119.246.86.42:49278 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:13
[LAN access from remote] from 90.191.154.128:63157 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:08
[LAN access from remote] from 72.172.116.234:19430 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:07
[LAN access from remote] from 2.49.70.10:35787 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:07
[LAN access from remote] from 78.69.193.51:60068 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:06
[LAN access from remote] from 83.7.84.21:14384 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:05
[LAN access from remote] from 95.57.43.144:10015 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:47:04
[LAN access from remote] from 118.152.116.177:61850 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:59
[LAN access from remote] from 110.46.218.13:38713 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:58
[LAN access from remote] from 60.240.137.78:55011 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:58
[LAN access from remote] from 91.219.232.233:21314 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:57
[LAN access from remote] from 187.21.255.147:28203 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:56
[LAN access from remote] from 177.162.38.137:47440 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:55
[LAN access from remote] from 78.8.129.93:54187 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:51
[LAN access from remote] from 80.23.37.1:57516 to 192.168.1.11:60681 Tuesday, Aug 14,2012 11:46:44


Waarschijnlijk een virus dus, toen on middelijk virusscanners laten lopen, vonden een paar virusjes op een vrijwel ongebruikte computer in het netwerk, de rest van de computers bevatte geen noemenswaardig virus. Na dit te hebben uitgevoerd verdwijnen de LAN acces from remote logs maar komt er dit voor in de plaats;
Code: 
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [217.110.97.194], Tuesday, Aug 14,2012 13:32:59
[DoS attack: RST Scan] attack packets in last 20 sec from ip [217.110.97.194], Tuesday, Aug 14,2012 13:32:53
[LAN access from remote] from 197.0.49.208:35782 to 192.168.1.11:60681 Tuesday, Aug 14,2012 13:29:47
[Admin login] from source 192.168.1.5, Tuesday, Aug 14,2012 13:28:09
[DoS attack: RST Scan] attack packets in last 20 sec from ip [217.110.97.194], Tuesday, Aug 14,2012 13:25:38
[DoS attack: RST Scan] attack packets in last 20 sec from ip [217.110.97.200], Tuesday, Aug 14,2012 14:17:58
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [217.110.97.200], Tuesday, Aug 14,2012 14:17:58
[DoS attack: RST Scan] attack packets in last 20 sec from ip [217.110.97.200], Tuesday, Aug 14,2012 14:17:53
[DoS attack: RST Scan] attack packets in last 20 sec from ip [217.110.97.194], Tuesday, Aug 14,2012 14:10:04
[DoS attack: ACK Scan] attack packets in last 20 sec from ip [217.110.97.194], Tuesday, Aug 14,2012 14:09:59


Juist, een bepaalde computer in het netwerk wordt aangevallen, internetten op deze computer is onmogelijk geworden.
Als ik de logs van de firewall van f-secure bekijk constateer ik dat in 1 minuut wel 44 verschillende verbindingen opgezet proberen te worden met mijn computer dit is een van de vele waarschuwingen die ik van de firewall krijg;
Beschrijving: Inbound TCP connection attempt
Actie: verkeer geblokkeerd door firewall
tijd: 14-8-2012 18:01:45
richting: inkomend
protocol: tcp
services: TCP High ports in
extern adres 217.110.97.194
externe poort: http(80)
lokaal adres: 192.168.1.4
lokale poort 50517
dns-naam de dns-naam kan niet worden gevonden


Wat kan ik nog doen om dit te stoppen ? Ziggo kan niks voor me betekenen, in de router kan ik ook geen ip adressen blokkeren.
Ook heb ik geen flauw idee wie of wat op het interne adres 192,168.1.11 zit, ik heb altijd gekeken naar attaced devices op de router en dit device staat er simpelweg nooit tussen.

Wat ik al gedaan heb;
Op alle computers in het netwerk een volledige scan uitgevoerd, met oa f-secure en hitmanpro.
Op alle computers gescand met Mbam.
Alle virussen die gevonden werden verwijderd.
De firewalls op niveau strikt gezet.
 
Laatst bewerkt door een moderator:
dit topic mag door de admins verplaats worden naar geinfecteerd!
 
Daar hebben we moderators voor en een "Meld misbruik" functie. Deze kun je ook gebruiken om een verzoek te doen een topic te verplaatsen. Bij deze de topic verplaatst.
 
die ACK en RST scans komen van f-secure
vul ip adres hier maar in

en wat je kan doen is de pc's een statisch (vast) ip adres te geven in je netwerk..
zo weet je precies welke pc voor de problemen zorgt.

kan zomaar zijn dat hij een torrent aangezet heeft of inderdaad online aan het gamen geweest is
bij dit laatste zou het vaak over moeten zijn na het afsluiten van de game maar met torrentverkeer wil het nog wel eens gebeuren dat de router aardig blijft hangen...
 
Installeer een firewall programma, daarmee kun je IP adressen blocken.
Zelf gebruik ik ZoneAlarm, prima tool naar mijn ervaring.

Tardis
 
Status
Niet open voor verdere reacties.
                    Steun ons                    

Nieuwste berichten

Terug
Bovenaan Onderaan