MetaChat REGISTER   ||   LOGIN   ||   IMAGES ARE OFF   ||   RECENT COMMENTS




artphoto by splunge
artphoto by TheophileEscargot
artphoto by Kronos_to_Earth
artphoto by ethylene

Home

About

Search

Archives

Mecha Wiki

Metachat Eye

Emcee

IRC Channels

IRC FAQ


 RSS


Comment Feed:

RSS

24 April 2007

I have a botnet on my computer Apparently it's usually spread via IRC[More:]

I just got back from class to find that my campus internet had been shut off. I called the help desk and they told me that it was due to the fact that I had a "botnet" on my computer, and asked if I used IRC.

According to wiki and the help desk dude, that's most likely the way I got it. Considering I only go to #bunnies, I would think (unless I'm very mistaken) that there is a good chance some of y'all also have this "botnet" thingy, so here I am on my roomie's computer letting you guys know.

I have to go get this thing cleaned off my computer tonight. Though if any of you smart bunnies want to send me an email telling me how I could do it myself, that'd be pretty nifty.

In other news, I'm SO GLAD that the multitudes of virus and spyware protection programs my college made me install on my computer caught this. It's SO WORTH all the RAM it takes up.
Ugh.
CitrusFreak12, bots don't come from your irc chats unless you are using irc for file transfers. Most likely it got to you from a website you visited that hosted it. You may have picked it up from a zip file or program file you downloaded.
posted by arse_hat 24 April | 11:39
The irc part of a bot net is the fact that bot talk to other bots and servers via the irc protocol.
posted by arse_hat 24 April | 11:55
Ah, the dark side of file sharing rears it's ugly head. Thanks for the tip, arse_hat.
posted by CitrusFreak12 24 April | 12:14
Lot more info here. What protection software do you have?
posted by arse_hat 24 April | 12:29
You can't have a botnet on one computer.

Your computer may be a zombie, and part of a botnet, listening for commands on what to do via IRC.

/nitpick
posted by dabitch 24 April | 13:22
Ah, the dark side of file sharing rears it's ugly head.

Virus and spyware programs typically only catch 75-80% of the malicious things in programs you get via file sharing. If someone writes a virus with a signature that isn't in your machine's antivirus database, it might just pass on through. Keep that in mind.
posted by cmonkey 24 April | 13:42
What they probably meant, was that you've been trojaned, and that your PC silently connects to a certain channel on some obscure IRC network to wait for some spammer/scammer/cyberthug's commands.

Unless you've been accepting strange DCCs of executables and running them, it's fairly unlikely that #bunnies was the root of your problems.

As for "fixing" the problem -- a compromised machine can never be trusted, no matter how much cleaning or scanning is done. The only safe thing to do, is to back up your data (NOT executables, though), wipe the hard drive, and start fresh.
posted by NucleophilicAttack 24 April | 14:01
Fie, dabitch! Be kind to the man, a botnet just got on his computer.

Citrus, download a free anti-virus like avast or AVG and use ad-aware. Because some trojans are super-smart you may need to install it in safe mode. If you find something, reboot into safe mode and run the software again. If you don't turn up anything you probably need more help than you can get online.

If you are on a campus network it is very likely that somebody else on the network got into your computer. I would say it's the most likely route, actually. Make sure you have all the latest security updates installed and that you have a firewall and that it is turned on.
posted by stilicho 24 April | 14:03
Oh, and you should change all of your passwords right now from a machine that isn't compromised. Websites, your email server, whatever. All of them.
posted by cmonkey 24 April | 14:32
:(
God damnit.
Thanks for the clarification, dabitch. I'll bring that up when I meet with them and ask them to explain again what's "wrong" with my computer.

I have McAfee (school made me download it), but I scan using Ad Aware. Ad Aware found nothing major, but I'll reboot and try again. I do have a firewall and such. I'm usually very good about preventing and dealing with viruses/trojans, and this is the first time I've ever had a problem. I bet $20 it was a false positive on the network's side. Any takers?

And a big "fuckity fuck fuck" to the password changing thing. That's a giant pain in the ass. Idk what to change them all to. Fooey. I'll change all my mail passwords right now, though, but I'll wait until a little bit to change my various website passwords.

If it was someone else on the network who got onto my computer, is there any way they can find out if A. That's the case, and if yes, B. Who it was?

I'll save the "nuke and reboot" option as a last resort. I find it strange that all of this happened while I was away at class... what could have changed or happened that could have caused them to blow my internets up?
posted by CitrusFreak12 24 April | 14:57
You do that CitrusFreak12! Nothing more annoying than help desk muddying the waters by throwing terms around incorrectly.

Anyway, sure, you might have caught something. Could have happened anywhere, some of these things spread via innocent webpages (hosted on vunerable servers) and could get picked up when you browse with vunerable browsers. (This used to mean IE only, but I'm not caught up on my readings lately, probably affects all sorts of browsers these days.) But sure, if you download stuff this is the most likely culprit.

Or, help desk who claims your one single computer is a botnet might be talking out of their ass.
posted by dabitch 24 April | 17:20
Get a port number from them.
posted by arse_hat 24 April | 17:42
I've run into idiotic policies (and the admins that love them) that classify my laptop has joined a botnet just because I dare to use IRC.

Definitely exercise due dilligence and scan update scan scan update (or was it update update scan scan scan?). But I'd be very curious how they detected your computer's bot-netty-ness.

Wireshark can be educational if you've been zombiefied. Capturing a few minutes of network traffic from your system just sitting there with no programs running can illustrate the problem if there is one. What you would be looking for is your computer attempting to talk to irc networks all on its own without a chaparone.
posted by mochicrunk 24 April | 19:48
Sakura DVD project update || I was watching people's kids when a meeting was on.

HOME  ||   REGISTER  ||   LOGIN