problem with my PC - could this be a virus? - GoFuckYourself.com

MarcS · 09-29-2003, 05:36 AM

Last night my computers CPU usage started to fluctuate between 20% and 80%. It goes up to 80% exatly every second.
When it goes up my mouse gets stuck.
I just found out that this all shit stops when I unplug my network cable from my PC. When I plug it back in it start again.
The lights on my network adapter also show real high activity.

Did anyone ever experience a similar problem?
Does anyone have an idea how to fix that?

keyDet79 · 09-29-2003, 05:48 AM

Sounds like ddos attack, did you insult a script kiddie on IRC? Hit Ctrl+alt+del in Windows and check which process causes it. Also check networking (same place).

MarcS · 09-29-2003, 06:01 AM

didn't insult anyone
I went to see the F1 race yesterday and when I came back my machine did that.
Maybe it doesn'T like Schumacher?

I checked the processes tab in the task manager but it doesn'T show the process that takes that much CPU usage. Maybe it'S because it only happens for such a small period of time (half a second max) and then it starts again 1 second later.

When I click on the networking tag the task manager crashes.

This all happens even if I'm not connected to the internet. I unplugged my router and it still happens.
As soon as I connect my networking calbe to the hub this shit starts

RedBumper · 09-29-2003, 06:04 AM

Quote:

Originally posted by MarcS
didn't insult anyone
I went to see the F1 race yesterday and when I came back my machine did that.
Maybe it doesn'T like Schumacher?

I checked the processes tab in the task manager but it doesn'T show the process that takes that much CPU usage. Maybe it'S because it only happens for such a small period of time (half a second max) and then it starts again 1 second later.

When I click on the networking tag the task manager crashes.

This all happens even if I'm not connected to the internet. I unplugged my router and it still happens.
As soon as I connect my networking calbe to the hub this shit starts

Sounds to me that your computer gets a bunch of unused information thruw your LAN (like an attack). Can you change your ip?

MarcS · 09-29-2003, 06:07 AM

my IP is dynamic so I get a new one each time I turn my computer on.
But as I said .. this also happens when I'm not conncted to the internet.
I have the DSL router plugged into my hub and the computer plugged into my hub.
When I unplug the DSL router it still happens.
But as soon as I unplug the networking cable from my hub it stops happening

RedBumper · 09-29-2003, 06:11 AM

Quote:

Originally posted by MarcS
my IP is dynamic so I get a new one each time I turn my computer on.
But as I said .. this also happens when I'm not conncted to the internet.
I have the DSL router plugged into my hub and the computer plugged into my hub.
When I unplug the DSL router it still happens.
But as soon as I unplug the networking cable from my hub it stops happening

hhhmmmmm try to narrow it down... plug your dsl router directly to your card without the hub (although i don't see how a hub could do this but you never know). Doesn't seem like a virus to me but you might wanna do some heavy virus scanning also. Last it also could be your dsl router wich keeps sending huge datablocks to your LAN.
Don't know what else it could be, never seen anything like it.

MarcS · 09-29-2003, 06:26 AM

well I tried connecting the DSL router directly to my PC but the same thing happened.
I connected antoher computer to the DSL router and everything was fine.

After restarting I was also able to access the networking tab and it showed no unusual activity

RedBumper · 09-29-2003, 06:27 AM

Quote:

Originally posted by MarcS
well I tried connecting the DSL router directly to my PC but the same thing happened.
I connected antoher computer to the DSL router and everything was fine.

After restarting I was also able to access the networking tab and it showed no unusual activity

Only three options remain then:
- Network card problem (hardware acceleration?)
- Virus
- LAN soft problem

raceman · 09-29-2003, 06:52 AM

I had a similar problem, and it was a hacker leaving stuff on my PC so he/she could use it for ddos attacks on IRC, I finally found the files in my route and the system32 folder, just check some of the date stamps on the files you might be supprised at what you find...... only a suggestion.

RACEMAN

MarcS · 09-29-2003, 07:36 AM

thanks for the tip raceman
unfortunatly I didn't find any file that might have caused this

this is really starting to piss me off

keyDet79 · 09-29-2003, 07:53 AM

Quote:

Originally posted by MarcS
thanks for the tip raceman
unfortunatly I didn't find any file that might have caused this

this is really starting to piss me off

Open the command prompt and type netstat. If you see there is an active connection with an irc server (usually port 6666, 6667 or 7000) you have an IRC trojan.

MarcS · 09-29-2003, 08:11 AM

I have 2 open connections
localhost:3306
localhost:3008
shouldn't be anything wrong with that

one thig I have just noticed ...
I wanted to make sure that this is not the msblaster virus again and checked the Remote Procedure Call service.
it says it is started but I can't stop it nor restart it. Those options are gray.
But I did a virus scan earlier today and it didn'T find anything

09-29-2003, 05:36 AM	#1
MarcS Confirmed User Join Date: Aug 2002 Posts: 139	problem with my PC - could this be a virus? Last night my computers CPU usage started to fluctuate between 20% and 80%. It goes up to 80% exatly every second. When it goes up my mouse gets stuck. I just found out that this all shit stops when I unplug my network cable from my PC. When I plug it back in it start again. The lights on my network adapter also show real high activity. Did anyone ever experience a similar problem? Does anyone have an idea how to fix that?

09-29-2003, 05:48 AM	#2
keyDet79 Confirmed User Join Date: Feb 2003 Location: Netherlands Posts: 1,109	Sounds like ddos attack, did you insult a script kiddie on IRC? Hit Ctrl+alt+del in Windows and check which process causes it. Also check networking (same place). __________________ Multihomed quality BW for less ICQ 51034232 - MSN [email protected] - Email keydet(at)vibehosting.com

09-29-2003, 06:52 AM	#9
raceman Confirmed User Join Date: Jul 2003 Location: Now offshore on an island paying a heluva lot less tax than you suckers Posts: 1,064	I had a similar problem, and it was a hacker leaving stuff on my PC so he/she could use it for ddos attacks on IRC, I finally found the files in my route and the system32 folder, just check some of the date stamps on the files you might be supprised at what you find...... only a suggestion. RACEMAN __________________ "ILLEGITIMIS NON CARBORUNDUM" <-- "DON'T LET THE BASTARDS GRIND YOU DOWN" General Joe Stiwell ICQ: 213-684-158

09-29-2003, 06:01 AM	#3
MarcS Confirmed User Join Date: Aug 2002 Posts: 139	didn't insult anyone I went to see the F1 race yesterday and when I came back my machine did that. Maybe it doesn'T like Schumacher? I checked the processes tab in the task manager but it doesn'T show the process that takes that much CPU usage. Maybe it'S because it only happens for such a small period of time (half a second max) and then it starts again 1 second later. When I click on the networking tag the task manager crashes. This all happens even if I'm not connected to the internet. I unplugged my router and it still happens. As soon as I connect my networking calbe to the hub this shit starts

09-29-2003, 06:07 AM	#5
MarcS Confirmed User Join Date: Aug 2002 Posts: 139	my IP is dynamic so I get a new one each time I turn my computer on. But as I said .. this also happens when I'm not conncted to the internet. I have the DSL router plugged into my hub and the computer plugged into my hub. When I unplug the DSL router it still happens. But as soon as I unplug the networking cable from my hub it stops happening

09-29-2003, 06:26 AM	#7
MarcS Confirmed User Join Date: Aug 2002 Posts: 139	well I tried connecting the DSL router directly to my PC but the same thing happened. I connected antoher computer to the DSL router and everything was fine. After restarting I was also able to access the networking tab and it showed no unusual activity

09-29-2003, 07:36 AM	#10
MarcS Confirmed User Join Date: Aug 2002 Posts: 139	thanks for the tip raceman unfortunatly I didn't find any file that might have caused this this is really starting to piss me off

09-29-2003, 08:11 AM	#12
MarcS Confirmed User Join Date: Aug 2002 Posts: 139	I have 2 open connections localhost:3306 localhost:3008 shouldn't be anything wrong with that one thig I have just noticed ... I wanted to make sure that this is not the msblaster virus again and checked the Remote Procedure Call service. it says it is started but I can't stop it nor restart it. Those options are gray. But I did a virus scan earlier today and it didn'T find anything