Virus Source

[John Musselwhite]

At 11:03 AM 02/11/02 -0800, Joe wrote:

>I think I found the Virus source, that infected my machine and is continuing
>to "attack" my machine. Everytime I log on to the Starlink Pianotech Chat
>line, my firewall alarm goes off. It seems to be coming from the same
>source, EVERY TIME! I've tried to contact the Starlink Security, but can't
>get through. Any one know how to navigate this and get them on to the
>intruder?

Starlink-IRC does a "port sweep" on every computer attached to it as a 
security precaution. The Message Of The Day (MOTD) as you log on has warned 
of that for quite a while now, though most people don't even know it's 
there. This is not a virus or an actual attack on your computer, but rather 
an attempt by the IRC "cops" at preventing the spread of viruses over their 
IRC circuits by letting people know their computers are at risk. Your 
firewall will complain all the time that you're "under attack", but if they 
come from the same or similar address these probes are harmless and you can 
ignore them. Once you've logged on, read the MOTD for more information as 
it may even give you the IP address range that the pseudo-attacks use. If 
you're not running a firewall the status window during your session should 
tell you that you should install a firewall for your own protection.

I urge *everyone* who is using the internet in any way to visit 
http://www.grc.com and use the "Shields Up" test to see if their computer 
is  properly protected. Even those with dial-up connections should be 
running ZoneAlarm or a similar freeware firewall.

As to the actual source of your virus, it could be a number of things other 
than IRC. It's a lesson to all of us to use a really good virus checker 
(like Norton for $20 over the WWW or the freeware program that has been 
mentioned here) and keep your definitions updated regularly.

Hope to see you tomorrow night, Joe! Email me if you have more questions.

                 John


John Musselwhite, RPT    -     Calgary, Alberta Canada
http://www.musselwhite.com  http://canadianpianopage.com/calgary
Pianotech IRC chats Tuesday and Thursday nights and Sunday Mornings
http://www.bigfoot.com/~kmvander/ircpiano.html