KymcoForum.com
General => General Discussion => Topic started by: zombie on August 24, 2012, 06:57:22 PM
-
About a month ago my security pointed out I have an ARP cache poisoning. I've used my computer carefully, and have no issues. What this is , is a Man in the Middle attack. It's very rare on home computers as it is difficult to establish, and you really don't know what gain it will provide till you start reading packets. Anyway I have been trying to delete the ARP entry but it persists on start up. It's a web based attack. So what I did was turn the tables... Here is a screen shot of the attackers info I pulled last night.
(http://i1264.photobucket.com/albums/jj492/zombiemaking/untitled-2.jpg)
(http://i1264.photobucket.com/albums/jj492/zombiemaking/untitled-1.jpg)
I'm not gonna tell you what I did with the user names, and pass codes. I am on a dynamic ISP so I need to stay dynamic. I just need to block this ARP entry... Any Ideas?
-
I should know about this kinda sh** but you lost me at ARP bro...
I like to pretend to my 15 yr old son that i know wtf im talking about but as soon as he mentions Virtual Drives and sh** i just laugh and walk away muttering "i paid for your bloody virtual drive you little......" under my breath :D
Think he thinks im retarded and he feels sorry for me so cut me some slack. He knows if its mechanical or requires some kinda hand or power tool then im his man tho.
-
save all the info you need on your pc and try doing a factory reboot .sometimes that well take care of everything . you may have to redown load a few things your self after that but you should be all good.
you said you us your computer saftly..... Dont beleave that man sorry you already showed us some of your monkey porn.................
-
Which version of Windows and what are you using for a firewall? (PM answer to second part if you don't want it shared to public)
-
this is why i absolutely hate any thing microsoft;;;;the same scammers and hackers who create the problems are the very same ones selling you downloads to remove the problems.....i had a very similar registry error issue which would cause an image on my pc makeing it virtually impossible to use the computer...mine was an xp problem....you may try re-booting ......to a prior date (previous to when the problem emerged) or do what i did.....purchased "stopzilla"....which actually worked.....good luck....
-
..if you can save all your valued data, then yeah a factory reformat of your drive(s) will eliminate the issue...
..and, it may be possible to restore your machine to an earlier date as well..
..just dont forget to save any potentially lost data before...
-
..have you ever expanded peerblock's database?
-
I'm just curious as to why someone would ask this question, here. Not that there aren't IT folx who hang out, here (I'm a former one, myself, w/20+ years experience), but... it just seems a bit like asking about a computer problem in a scooter forum, to me. ;)
.
-
it just seems a bit like asking about a computer problem in a scooter forum, to me. ;)
.
..umm..yeah, i think that's about right...
:-\
-
General Discussion
Feel free to talk about anything and everything in this board.
;D
-
General Discussion
Feel free to talk about anything and everything in this board.
;D
Agreed. You saw the topic. You don't have to read it. You don't have to make smart ass comments.
-
I'm just curious as to why someone would ask this question, here. Not that there aren't IT folx who hang out, here (I'm a former one, myself, w/20+ years experience), but... it just seems a bit like asking about a computer problem in a scooter forum, to me. ;)
.
GENERAL DISCUSSION!!!!! GE-NE-RAL DIS-CUS-SION!!!! HELLO!!!!! NEWBIE!!! (http://th181.photobucket.com/albums/x317/geminiinsight/th_hilarious-2.gif)
Same like you talk about your Honda on a Kymco Forum....... geeez...
-
Which version of Windows and what are you using for a firewall? (PM answer to second part if you don't want it shared to public)
XP Pro SP-3 Eset smart security firewall. I've tried several apr blockers but they are not the answer. I tried assigning a static arp but it gets overridden by the dynamic one. I know the source computer, and have sniffed a few packets to get the mac address. I have the same access as he has on mine but I cant break his connection. I'm beginning to think a re install of the OS is easier. Even that takes me 8-12 hrs of reinstalling software/correcting settings ect.
Any suggestions are welcome. I learn quickly...
-
this is why i absolutely hate any thing microsoft;;;;the same scammers and hackers who create the problems are the very same ones selling you downloads to remove the problems.....i had a very similar registry error issue which would cause an image on my pc makeing it virtually impossible to use the computer...mine was an xp problem....you may try re-booting ......to a prior date (previous to when the problem emerged) or do what i did.....purchased "stopzilla"....which actually worked.....good luck....
[/quotStopzilla is a ZGRthis is why i absolutely hate any thing microsoft;;;;the same scammers and hackers who create the problems are the very same ones selling you downloads to remove the problems.....i had a very similar registry error issue which would cause an image on my pc makeing it virtually impossible to use the computer...mine was an xp problem....you may try re-booting ......to a prior date (previous to when the problem emerged) or do what i did.....purchased "stopzilla"....which actually worked.....good luck....
e]
Stopzilla is a GREAT idea. It has a root kit scanner, and has helped me in the past. I'd forgotten about them. This is something harder to find than a virus by far. I know it's in MY system. I should have just run in VM ware like a ten year old would have done... I get lazy sometimes.
-
WTF?????
-
I'm just curious as to why someone would ask this question, here. Not that there aren't IT folx who hang out, here (I'm a former one, myself, w/20+ years experience), but... it just seems a bit like asking about a computer problem in a scooter forum, to me. ;)
.
I trust the people here. Welcome back!
Any idea how to change this arp entry? I don't mind re working the registry. I just don't know where to find the key(s)
-
General Discussion
Feel free to talk about anything and everything in this board.
;D
The local nail salon doesn't have a sign on the front door, saying, "Please! No neurosurgical consultations available!" either. Yet I suspect most nail salons hear few requests for second opinions on gliomas.
.
-
WTF?????
What? You don't automagically want to take personal computer security advice from scooterists? WTF is wrong with YOU, my friend?! :)
.
-
I'm just curious as to why someone would ask this question, here. Not that there aren't IT folx who hang out, here (I'm a former one, myself, w/20+ years experience), but... it just seems a bit like asking about a computer problem in a scooter forum, to me. ;)
.
Hey, Jpres is back!
-
..have you ever expanded peerblock's database?
I update Peer Block every time I use it. Peerb;ock firewalls the IP but the ARP is on a lower level, and slips past most firewalls. At the risk of sounding "paranoid" I believe the attack is based on my use of this computer, and my ISP is pinging my computer non stop with this entry to re route/read my data. Casa systems is an it tech company that is legit. They are either reading my data or are a pawn in a zombie chain. (proxied, linked, computers). It's a stout attack but on the wrong target. There's nothing to gain in my computer. (casa is the source computer)
-
I trust the people here. Welcome back!
Any idea how to change this arp entry? I don't mind re working the registry. I just don't know where to find the key(s)
I really don't, and unfortunately my time's pretty well spoken for with issues I DO know more about, these days. Network security was always a passing interest/NEED-to-know for me.
.
-
I update Peer Block every time I use it. Peerb;ock firewalls the IP but the ARP is on a lower level, and slips past most firewalls. At the risk of sounding "paranoid" I believe the attack is based on my use of this computer, and my ISP is pinging my computer non stop with this entry to re route/read my data. Casa systems is an it tech company that is legit. They are either reading my data or are a pawn in a zombie chain. (proxied, linked, computers). It's a stout attack but on the wrong target. There's nothing to gain in my computer. (casa is the source computer)
Have you perhaps done anything to piss off the ISP (breach of ToS, for example, like downloading the entire Internet on the weekends)?
.
-
The local nail salon doesn't have a sign on the front door, saying, "Please! No neurosurgical consultations available!" either. Yet I suspect most nail salons hear few requests for second opinions on gliomas.
.
Funny you should mention that... Just yesterday I was indeed looking for a nail salon so I could find out what size my front wheel bearings are. I figured they MUST have a relative who works in a scooter factory. I don't know any reason to think they would know biology/medicine tho. That's just silly.
-
The local nail salon doesn't have a sign on the front door, saying, "Please! No neurosurgical consultations available!" either. Yet I suspect most nail salons hear few requests for second opinions on gliomas.
.
You hear a little talk about nails in a nail salon... My barber and I talk about car engines all the time while he trims my hair.... ;D
-
Have you perhaps done anything to piss off the ISP (breach of ToS, for example, like downloading the entire Internet on the weekends)?
.
Uh no. Then they could just shut me off. That's why I think I'm on a "hit" list. I do leave some of the Internet there on weekends. I just have alot of traffic for a home computer. It's always dloading something. I like to play w/ programs. Any idea where I could look for an answer? I've read dozens of hours of PDF's, web sites, Dloading software. I have the computer in my pocket but really just want to avoid the rest of the drama. The last ditch cure is a wipe n nuke. I don't want any legal bothers if I do that. I'm really not 100% sure that Casa is the end link. When I call my ISP they admit I have multiple packets emitting on my data transfers (piggy backs) but they said it is NOT them redirecting my data. BUT immediately after my call my IP changed back to Florida from Media com Iowa. Instead of being on a 172.000.00 I am on a 173.000.00. That's a network range.
-
4 days of Dloading software, and I got it. This turned out to be a "net" born issue. I have a dynamic IP that is assigned as IP's become available. The root of this was in the ARP cache. This is a way of making a computer "trust" its source, and using its server. My ISP was sending never ending arp responses to my ip "claiming" to be a standard server but in fact it was a data trace route. Thank GOD for google... I now live in Spain, and have permanently blocked this sort of attack. It took several "hacker" programs, a new VPN, and some new software in my computer to end this but it's done. I can HIGHLY recommend Comodo's firewall as well. It has an ARP protection module that blocks these repeated responses but you have to kill the source first. I also found the Reg entry that allowed this to go unnoticed. It's a DARK world we live in when your PAID ISP plants Root hooks in your equipment.
I have called MediaCom HQ in London (+44 (0)20 7158 5500) to inform them I will be seeking damages for my time, and expenses in this "game". Of course I cannot PROVE it was them but bad press is bad press.
Either way I can go back to posting my ambitions/plans for Global Domination with out worries, and "Angel Wings" now has 17,000 frequent flier miles (anonymous donor).