-2

Pardon my lack of security savvy- I dont know all the terminology. I've taken the comment below and updated. I get nightly DOS (browser) - this means I see the following attached picture on any browser - server not found or DNS not found. this usually lasts for hours. This happens for all browsers I use and all 3 pcs. I do get port scans also but i'm not as concerned about those, except they do happen very frequently for a non-wifi network. I hope this is clear enough re the symptoms. Here is a photo of what happens enter image description here

i have completely bypassed wifi and even the router- I'm connecting straight to NBN cable (australian broadband fibre) so don't have wifi security issues. I have done some hardening of the pc but notice that ipv6 keeps reappearing after I remove it. However, even when ipv6 is off, there is disconnection.

Background: I have hardened my PC as much as I can ie removed unnecessary services such as fax and have bitdefender installed, but it doesn't report on the issue (and sorry to say their helpdesk customer service isn't the greatest so no help there).

What is the logical next step in troubleshooting this? I've spent many many days and weeks training my meager security knowledge up to deal with this. I feel I've reached as far as I can go on my own. I even have contacted a security expert to help but his services (2000 and no guarantee of success) are way beyond my budget, especially this time of year!

One of the commenters pointed out that I'm not likely important enough to be attacked and dismissed it as a non-attack. Ok, well, all I can say is that on a daily and nightly basis, I have no access to any pc for long periods of time (on all 3 of them) intermittently, though the problem starts usually after 730pm. I also more likely to get disconnected in evenings if I'm going to security related sites. I am not a celebrity or anyone important, but the fact is this is happening to me every day. I don't know why.

I only recently removed my router. It doesn't matter if I have a router or not, or if I have antivirus or not. The same thing happens.

Help would be appreciated

closed as too broad by Anders, Xander, grochmal, kasperd, Rory Alsop Dec 29 '16 at 13:35

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    You need to be much more specific for anyone to be able to help you. Why do you think you are under DOS attack? What kind of DOS attack is it? What do you mean with "internet disconnection attacks"? What do you mean with "IPv6 keeps reappearing"? Describe the symptoms you are experiencing. – Anders Dec 28 '16 at 16:02
  • Thanks, ok. Please see update above. Ive put in a photo. it's simply that i have no access to internet. I get disconnected or dns not found type errors. It is not a fault with my ISP because the technicians have already checked the line multiple times. – karen popper Dec 29 '16 at 0:20
  • If it is all 3 PCs, the more likely scenario is a network misconfiguration. I'd start with looking at your DNS settings, and perhaps changing them to more reliable options. – schroeder Dec 30 '16 at 7:39
  • the next time this happens, I'd try doing some basic network troubleshooting, like running pings, traceroutes, and specifically checking the connectivity to the configured DNS servers. – schroeder Dec 30 '16 at 7:40
  • 1
    BTW - the title now has no relation to your question – schroeder Dec 30 '16 at 7:41
3

It's kind of hard to tell from your description if you have a malware infection, or if you're constantly being attacked over the network.

Network DDoS attacks are extremely difficult to deal with on your own; your ISP might be able to give you some advice or assistance. Professional mitigation services work by rerouting traffic to their servers, which filter out most of the attacks and act like a giant sponge, and they try to pass only legitimate traffic to your site; these would likely be cost-prohibitive for a very small site.

If these attacks are just crashing your router, consider installing a different operating system on your router (OpenWRT, tomato, or dd-wrt), shopping for a different router, or perhaps adding a separate firewall appliance between the cable modem and your router/network. With attacks like this, you definitely want to keep a firewall between the internet and your network. Exposing your computer directly to the attackers traffic could certainly cause some of the instabilities you're seeing. It's always better to let the cheap network devices bear the brunt of the attack, rather than your valuable computer and data.

Of course, you've also said that a malware infection may be the possible source of your problems. The problem is that once you have malware, there is no way of knowing what it's infected, or when you've successfully removed it all. The strategy that most of us recommend is to save a copy of all your data files from the computer, then reformat the drive and reinstall the operating system and your applications. $2000 AUD seems like a very high price for this service. If possible, seek another quote.

  • Thanks very much! I keep rebuilding my windows from scratch ie factory reset but the same things happens within hours even when I put the firewall and antivirus on before going online. I also appreciate your answer re the quote. many people are away but I will follow that up. Regarding the router, I don't have one - but the same thing happened when i did. It makes no different from what I can see. It also happens on multiple devices - 3 difference windows 10 pcs. Also prevents me from opening sites or downloading upgrades. Can I reroute traffic myself somehow? I'll follow this up also – karen popper Dec 28 '16 at 14:02
  • A sustained DDoS attack will certainly keep your legitimate traffic offline, including software updates. The fact that it's constantly happening on 10 machines probably indicates external attack; again, I would be sure to keep a firewall in place between the internet and your other machines. Again, contact your ISP; they probably don't want all that DDoS traffic on their network, either. – John Deters Dec 28 '16 at 14:09
  • @karenpopper, how can you not have a router? How are you connected to the Internet? – Julian Knight Dec 28 '16 at 17:42
  • I should say I connect to the nbn box default router. it was a box in the wall that came with apartment. I meant I did not add a router on top of that one. – karen popper Dec 29 '16 at 0:23
  • Thanks for your help. This is my first question on this forum and I've got to say some of the more experienced folk are not as welcoming on newbies as I'd like. I will take your advice @john Deters and follow this up. I did edit my question so that it's more specific, and i have done a lot of homework before going on this site. I'm simply not a security expert. Thanks again. appreciate your time for those who did respond. – karen popper Dec 30 '16 at 4:11
2

Update: Just noted that you are not using a router. I assume this means that you are connected directly to an ethernet outlet from your cable supplier? This is REALLY DANGEROUS - I strongly recommend that you don't do that. Any home router will have a firewall that will (should) prevent all incoming connections before they hit your PC.


I think the obvious thing to do here is to totally rebuild the PC offline using a copy of Windows 10 downloaded from Microsoft via an independent route (e.g. a friend or family PC on a different network).

Don't connect your PC to your network. Connect via an alternative such as 3G or a work Wi-Fi in order to get clean updates. Immediately run checks for any root/boot-kits. Install/configure security software including Microsoft EMET and create a second user (on W10, the first user is always an admin). Use the second user when you retry on your own network.

Before reconnecting to your own network, firstly contact your ISP and get them to change your IP address - this should stop the DDOS attack unless the whole ISP is being attacked. Then, again using a different network as above, download the latest firmware for your router, upload it and reset to factory settings. Check for any known vulnerabilities on your router and if there are any unpatched ones, buy a more secure router or, as John suggest and if you can, install alternative firmware.

If after all that, you are still seeing issues, you probably missed a rootkit or there is something else on your network that is causing issues.


You should also note that really odd happenings that may seem to be malware or a "ghost in the machine" are generally hardware issues. Really persistent and difficult to eradicate malware is very rare for the average user.

  • I like the fact you mentioned connecting directly to the modem isn't a good idea, and should be connected via the router. +1. Does this matter if the user has a built in firewall via an anti-virus/protection program? – XaolingBao Dec 28 '16 at 22:10
  • Yes it matters because you want all the protection you can get, especially if you think you are being attacked. A PC has a massive attack surface, a single error may be enough to expose it to attack. Why take the risk? Especially as many people leave their PC's on 24x7. – Julian Knight Dec 28 '16 at 23:06
  • Your router may also contain some limited anti-DOS and other attack mitigation features being able to drop packets from known attack types for example. Your PC won't have that. – Julian Knight Dec 28 '16 at 23:14
1

Your self-diagnosis is all over the place. I will address a few things for you though:

I get nightly DOS (browser) and internet disconnection attacks, as well as port scans.

I am curious how you came to this conclusion. How do you know this? Most consumer routers falsely report unknown traffic as being anomalous. Just another form of pretending to do something useful :)

If you have a public IP address (which you do, by virtue of the fact that you're connected to the internet) you're going to be on the receiving end of exploratory port scans. They're harmless in themselves, but they are ordinarily mitigated by...

i have completely bypassed wifi and even the router- I'm connecting straight to NBN cable (australian broadband fibre) so don't have wifi security issues.

Don't do this. Let your router function as your first layer of defense; it's the 12-foot fence around your compound. If your router's firewall is configured properly, any exploratory port scans or attempts at communication with anything on your LAN should not be responded to at all. Attackers should be led to think nobody is home.

Never connect your PC directly to the internet. While Windows et al. do have firewalls and antivirus, they are often easily compromised since they are such well-known targets. It's like if only a single brand of lock existed-- once somebody figures out how to pick it, all locks can be opened. But if someone develops a unique lock and places it in front of the pickable one, they have to spend time figuring out how to get past it-- or just move along to an easier target.

I have done some hardening of the pc but notice that ipv6 keeps reappearing after I remove it. However, even when ipv6 is off, there is disconnection.

Not sure what's going on here, sorry.

I keep rebuilding my windows from scratch ie factory reset but the same things happens within hours even when I put the firewall and antivirus on before going online.

If you're connecting your fresh Windows install directly to the internet, I'm not surprised. Stop doing that. Rebuild your PC, fully update it and keep it protected behind a router. If you don't have one, get one and make sure its firewall is enabled.

What is the logical next step in troubleshooting this? I've spent many many days and weeks training my meager security knowledge up to deal with this. I feel I've reached as far as I can go on my own. I even have contacted a security expert to help but his services (2000 and no guarantee of success) are way beyond my budget, especially this time of year!

(Speculation) Honestly these symptoms sound to me more like your problem is internal rather than external. Unless you're a controversial figure or business I don't see why anybody would waste the resources targeting you with a DoS for weeks on end.

My advice to you would be to first put your router back in play and make sure its firewall is enabled. Keep all PCs disconnected and reformat one of them. Connect it to the router. Do not install any third party software or import your old data (no PDF readers, no screensavers, nothing). Keep this computer completely sterile for now.

Call your ISP and ask them how to go about getting a new IP address. If the problems persist immediately after getting a new IP address and using your protected, sterile PC, then you should engage your ISP to do something about this. Don't muddy the waters by saying anything about DDoS; just say your connection sucks and you want them to do something about it. Let them troubleshoot it; might cost you $60 USD or so.

If the problems stop after changing IPs, then you probably have/had a malware infection on either one of your other machines or within some software or data you keep reinstalling. Start doing whatever you want to do with the sterile PC. Install your software, restore your data. Use it for a few days.

If nothing happens, connect each machine over a period of days and see when the problems start again. If they do, assume you have malware. Malware remediation services should run around $200 USD (not 2000).

Not the answer you're looking for? Browse other questions tagged or ask your own question.