2

I have been experiencing DoS attacks: ack scan and rst scan.

Now I know these are supposed to be normal and the internet works that way but I experience severe internet disconnection when that happens. I tried to check all the ports I have open using curports and there were some named "EXPLORER.exe". I was not able to close them.

Is that normal?

Also I used malwareBytes to find out if there were any malware, but it did not detect any.

Is it possible my PC is still affected?

Improve this question
5
  • 5
    The "EXPLORER.exe" points to the Windows virus. It's pretty serious.
    – cutrightjm
    Commented Oct 2, 2014 at 4:38
  • 1
    I don't think it is normal that you can't close explorer.exe. Go to Task Manager > Processes tab, then on the menu View > Select Columns... check Command Line check box. Then OK, and look at the path to see if there are any processes that are suspicious. explorer.exe's command line should be C:\Windows\explorer.exe
    – nhahtdh
    Commented Oct 2, 2014 at 4:42
  • 1
    i like it when you said thats how the internet works, and its "normal", a DoS/DDoS attack is NOT normal, and illigal in most country's in the world, you should try what @nhahtdh suggested, but i also suggest notifiying your ISP about this, since in most country's too, they HAVE to help you or give advice on this, i also suggest throwing malwarebytes at it again and HitmanPro, if after all of this the problem is still there, i suggest nuking and re-install your OS and start from scratch, aren't there any "funny" things you downloaded in the last time that could've got you this problem?
    – Lighty
    Commented Oct 2, 2014 at 8:02
  • I tried what you suggested @nhahtdh. Everything seems legit. The path either refer to the program-files folder or windows and EXPLORER.exe does not show up in processes.(except for regular explorer.exe of windows). I'll try what Lighty said but reinstalling my OS right now will be a pain! Thanks guys.
    – Bharat Geleda
    Commented Oct 2, 2014 at 9:50
  • I contacted my ISP and have changed my router(though don't know what effect that had) and I am not experiencing any DOS attacks recently. 1 thing that I noticed was that I had recently started using skype when I got DOS attacks and have stopped doing that on my laptop now(Windows 8.1)
    – Bharat Geleda
    Commented Nov 29, 2014 at 14:23

1 Answer 1

Reset to default
1

It isnt normal that your are experiencing DDOS attacks. Try using Wireshark or another network sniffing tool to look for Botnet traffic. IF you boot Wireshark and use the filter

dns.flags.rcode == 3

If Wireshark is returning a lot of failures a good bet would be to set up a IDS such as Snort and create a rule to block the specific traffic.

However different botnets use different ports so this is not a sure bet. Unfortunately there is no "find all" button on Wireshark but this is a good start.

Check out HoneyNet for further info on the subject of capturing the Botnet traffic.

EDIT: Snort: https://www.snort.org/ Wireshark: https://wireshark.org/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .