Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Fatman]

/. had a post today on a cornflicker eye chart that I found amusing.  It would be interesting to see what results you get on it from an infected host.  The theory seems sound given what little I know of cornflicker.  As always it would be at your own risk.

[suprra_girl]

I did a scan with mcaffee's conficker scanner and it searched ips from 1 - 254 and nothing. Is there another one you want me to try? Have a link? I couldn't really find info/scanners? related to antiroot detecter for conficker

[Fatman]

I was referring to a http://slashdot.org post this morning (april fools day is a constant affair there) showing a eye chart to detect cornflicker installations.

The links was

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

That said while it appears sound based on what little I know of cornflicker, I am not the person to run to for security advice, and I can't confirm that this is an effective test.

[suprra_girl]

My computer appears fine so far... I did find obfuscated.A trojan on my mums pc which is now cleaned, it ended up in a file called torrent101.exe which neither of us recall downloading :/

My scanner is at 99% with nothing detected yet
My mums pc however is finding a few little trojans, they appear to be related to games but I've deleted them anyway

[Lycan]

none the less, my guess is the firewall is simply doing it's job. blocking unwanted traffic, it could be as simple as those IP were part of the swarm you were a member of last and are simply not ack'ing your disconnected status. Unless you see breaches, I wouldn't sweat it.

[suprra_girl]

Yep, I can see that it's blocking it so that's great, I was just curious as to what these constant listings were but am glad that the router is doing it's job well

Thank you all for your help, I appreciate it alot

[SouthPawn]

I think Lycan is right,

I saw your other post: http://forums.dlink.com/index.php?topic=2954.0

Where you state you're using the DGL-4100 and 502t together. I'm gonna guess that the 502t is natting the connections to the dgl-4100 and what you're seeing is a connection state the 502t has established that the dgl-4100 has already timed out.

Whenever you run two gateways in-line with each other you're going to see an uptick in blocked connections, this doesn't mean you're getting hacked it just means the state tables aren't synced 100%, which is mostly likely due to the state timing out on the dgl-4100 before the 502t.

[suprra_girl]

Err, I appreciate the response but you should have read my last post
http://forums.dlink.com/index.php?PHPSESSID=ab4e031ed8bdf7803598305245cf07ab&topic=2954.msg15976#msg15976

The purpose of that thread was to get bridge mode working correctly. As posted in that thread I noted that the 502T with isp firmware is a pos. And that's all I can say about it LOL.
If you had read a litltle further you would have seen that I wrote up a solution for NZ users.

Thanks for your reply.

[SouthPawn]

I did read the rest of your forum post, the most logical explination lies in how a half-bridge setup works.

if you run a trace route from you system you'll see a hop in there, the ip address of the modem, because in half-bridge mode it still working similar to a router.

Having said that, I stand by my answer, you're likely seeing connections that have expired on the dgl-4100 but have yet to expire on the modem itself.

Check out http://www.dslreports.com/forum/remark,14201975, it's quite insightful.

[suprra_girl]

The modem is not using nat at all (the dynalink) I turned it off so it's just a modem and nothing else.

I'll read your link

Cheers

[suprra_girl]

Omg, they have some horrible tracert results!

40ms ping to their modems!!!! They need to sort the network out I think haha.

Thanks for the link, it was interesting seeing other peoples connections. I like mine