Topic: DDOS'd? :(

[davey_wavey]

Hi guys,

Its been a while since i visited these forums (3 years:x) and its great to see theyre still going!

Today I was playing a game of warcraft 3 and all of a sudden i started to lag really badly. Eventually I disconnected and wondered what was going on, so i opened up cmd and netstat. I've only used to once before and there was 2 things yesterday, but when I looked tonight it had thousands just keep popping up one after the other. Here is an example:

 TCP    davidspc:34452         200-44-244-43.genericrev.cantv.net:2938  TIME_WA
IT
  TCP    davidspc:34452         host152.200-45-177.telecom.net.ar:1644  TIME_WAI
T
  TCP    davidspc:34452         200.48.26.166:61893    TIME_WAIT
  TCP    davidspc:34452         200.48.78.221:10313    TIME_WAIT
  TCP    davidspc:34452         193-40-50.adsl.terra.cl:1164  TIME_WAIT
  TCP    davidspc:34452         50-104-206.adsl.cust.tie.cl:18786  TIME_WAIT
  TCP    davidspc:34452         50-116-239.adsl.cust.tie.cl:3531  TIME_WAIT
  TCP    davidspc:34452         customer-MZT-static-220-65.megared.net.mx:55202
 TIME_WAIT
  TCP    davidspc:34452         customer-MZT-221-124.megared.net.mx:3935  ESTABL
ISHED
  TCP    davidspc:34452         int-200-55-41-129.intercity.net.ar:3139  TIME_WA
IT
  TCP    davidspc:34452         200-55-97-175.dsl.prima.net.ar:3006  TIME_WAIT
  TCP    davidspc:34452         200-55-105-238.dsl.prima.net.ar:3184  TIME_WAIT
  TCP    davidspc:34452         200-55-121-60.dsl.prima.net.ar:3238  TIME_WAIT
  TCP    davidspc:34452         customer-HMO-134-75.megared.net.mx:3200  TIME_WA
IT
  TCP    davidspc:34452         customer-HMO-134-81.megared.net.mx:2625  ESTABLI
SHED
  TCP    davidspc:34452         customer-MZT-143-226.megared.net.mx:2556  TIME_W
AIT
  TCP    davidspc:34452         customer-VER-154-192.megared.net.mx:1908  TIME_W
AIT
  TCP    davidspc:34452         customer-CLN-173-61.megared.net.mx:4961  TIME_WA
IT
  TCP    davidspc:34452         customer-CLN-173-175.megared.net.mx:2485  TIME_W
AIT
  TCP    davidspc:34452         customer-CLN-173-248.megared.net.mx:1846  TIME_W
AIT
  TCP    davidspc:34452         customer-TEP-175-193.megared.net.mx:62395  TIME_
WAIT
  TCP    davidspc:34452         unknown.bestel.com.mx:4581  TIME_WAIT

I'm not a complete computer novice but I really dont know whats going on

Thanks a lot

Dave

[Sandra]

Welcome back Davey  

I am not sure whats going on exactly but it reminds me of someone who had a problem some months back with multiple TCP connections caused by an unnecessary wi fi connection on her pc, she was actually connected by ethernet to her wi fi adsl/modem router but pc world had told her she needed a usb wi fi in her pc too  :shock:

I will try and find out more about it tomorrow after I get up  

[davey_wavey]

Hahaha Sandra your still here! Thanks for the welcome.

Well I should have told you some specs about my pc really

Windows XP sp2, Athlon 2800+, 1024mb ram
Windows Firewall :x, Norton 2005 full updated, and ive deffo not got spyware

I've just signed up to internet and am using an adsl usb router so there is no other wi fi connection. there was no programs that i could see using the internet when i checked my taskbar + littlebar at bottom + taskmanager

It seems to have stopped after about 5 - 10 minutes, so maybe its a sort of attack / hack that a player can do to disconnect you and get the win... but i dont know

thanks for the replies, much loveeeeeeeeeeee dave

[sam]

do u have all the latest patches to warcraft / have any game mods installed?

[davey_wavey]

Ye its all updated and no mods. Like I said once i'd disconnected and quit warcraft, I looked at netstat and then closed all programs using net but it was still streaming down that list! There was some brazilian ips in there too :S

[sam]

have you scanned for spyware / do you have up-to-date antivirus / firewall software installed?

[davey_wavey]

Windows Firewall :x, Norton 2005 full updated, and ive deffo not got spyware

[sam]

probably wouldnt hurt to run spybot or something.

[Simon]

Yes, Windows Firewall and / or Norton won't stop you getting spyware, but Spyware Blaster will.   Links below.  

Ad Aware
Spybot S&D
Spyware Blaster