2

I have been experiencing DoS attacks: ack scan and rst scan.

Now I know these are supposed to be normal and the internet works that way but I experience severe internet disconnection when that happens. I tried to check all the ports I have open using curports and there were some named "EXPLORER.exe". I was not able to close them.

Is that normal?

Also I used malwareBytes to find out if there were any malware, but it did not detect any.

Is it possible my PC is still affected?

  • 5
    The "EXPLORER.exe" points to the Windows virus. It's pretty serious. – cutrightjm Oct 2 '14 at 4:38
  • 1
    I don't think it is normal that you can't close explorer.exe. Go to Task Manager > Processes tab, then on the menu View > Select Columns... check Command Line check box. Then OK, and look at the path to see if there are any processes that are suspicious. explorer.exe's command line should be C:\Windows\explorer.exe – nhahtdh Oct 2 '14 at 4:42
  • 1
    i like it when you said thats how the internet works, and its "normal", a DoS/DDoS attack is NOT normal, and illigal in most country's in the world, you should try what @nhahtdh suggested, but i also suggest notifiying your ISP about this, since in most country's too, they HAVE to help you or give advice on this, i also suggest throwing malwarebytes at it again and HitmanPro, if after all of this the problem is still there, i suggest nuking and re-install your OS and start from scratch, aren't there any "funny" things you downloaded in the last time that could've got you this problem? – Lighty Oct 2 '14 at 8:02
  • I tried what you suggested @nhahtdh. Everything seems legit. The path either refer to the program-files folder or windows and EXPLORER.exe does not show up in processes.(except for regular explorer.exe of windows). I'll try what Lighty said but reinstalling my OS right now will be a pain! Thanks guys. – Bharat Geleda Oct 2 '14 at 9:50
  • I contacted my ISP and have changed my router(though don't know what effect that had) and I am not experiencing any DOS attacks recently. 1 thing that I noticed was that I had recently started using skype when I got DOS attacks and have stopped doing that on my laptop now(Windows 8.1) – Bharat Geleda Nov 29 '14 at 14:23
1

It isnt normal that your are experiencing DDOS attacks. Try using Wireshark or another network sniffing tool to look for Botnet traffic. IF you boot Wireshark and use the filter

dns.flags.rcode == 3

If Wireshark is returning a lot of failures a good bet would be to set up a IDS such as Snort and create a rule to block the specific traffic.

However different botnets use different ports so this is not a sure bet. Unfortunately there is no "find all" button on Wireshark but this is a good start.

Check out HoneyNet for further info on the subject of capturing the Botnet traffic.

EDIT: Snort: https://www.snort.org/ Wireshark: https://wireshark.org/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.