Author Topic: Am I infected? (Read 725 times)

Saintaw · « **on:** May 31, 2005, 11:58:38 AM »

I've had the same packet loss for the last two weeks. I rand Adaware, Norton AV and found nothing...

Target Name: [url]www.hitechcreations.com[/url]
IP: 216.91.192.19
Date/Time: 31/05/2005 18:55:49

1 * 9 ms 8 ms 8 ms 11 ms 7 ms 8 ms 10 ms 14 ms 12 ms 8 ms 8 ms 8 ms 8 ms 7 ms 7 ms 9 ms 8 ms 8 ms 17 ms [10.12.0.1]
2 9 ms 9 ms 9 ms 8 ms 7 ms 10 ms 9 ms 9 ms 8 ms 8 ms 9 ms 156 ms 9 ms 10 ms * 8 ms 10 ms 7 ms 10 ms 9 ms ge-0-0.kirchberg.online.lu [195.218.2.21]
3 15 ms 11 ms 9 ms 10 ms 11 ms 11 ms 10 ms 9 ms 10 ms 10 ms 10 ms 11 ms 11 ms 109 ms 13 ms 10 ms 11 ms 9 ms 11 ms 11 ms [62.72.104.242]
4 14 ms 15 ms 13 ms 13 ms 17 ms 16 ms 15 ms 15 ms 14 ms 15 ms 14 ms 15 ms 15 ms 16 ms * 22 ms 14 ms 19 ms 15 ms 18 ms pos4-0-cr2.BRU.router.colt.net [212.74.68.1]
5 19 ms 18 ms 17 ms 18 ms 18 ms 18 ms 20 ms 18 ms 20 ms 17 ms 21 ms 21 ms 19 ms 18 ms 20 ms 18 ms 20 ms 20 ms 19 ms 18 ms pos0-0-0-pr1.AMS.router.colt.net [212.74.66.146]
6 99 ms 98 ms 99 ms 100 ms 99 ms 98 ms 98 ms 99 ms * 99 ms 100 ms 97 ms 99 ms 98 ms 102 ms 97 ms 99 ms 100 ms 99 ms 98 ms acr1-ge-5-3-0.Amsterdamamx.savvis.net [195.69.145.60]
7 98 ms 99 ms 98 ms 98 ms 98 ms 104 ms 99 ms 99 ms 106 ms 98 ms 98 ms 98 ms 107 ms 99 ms 98 ms 98 ms 99 ms 97 ms 99 ms 99 ms bcs1-so-1-2-0.Londonlnx.savvis.net [204.70.193.146]
8 98 ms 99 ms 98 ms 99 ms 98 ms 100 ms * 99 ms 97 ms 100 ms 102 ms 97 ms 100 ms 100 ms 98 ms 98 ms 98 ms 99 ms 99 ms 99 ms bcs2-so-0-0-0.NewYork.savvis.net [204.70.192.121]
9 101 ms 101 ms 101 ms 102 ms 102 ms 101 ms * 102 ms 101 ms 103 ms 101 ms 103 ms 110 ms 107 ms 102 ms 101 ms 101 ms 102 ms 102 ms 103 ms bcs2-so-4-0-0.Washington.savvis.net [204.70.192.1]
10 113 ms 115 ms 114 ms 115 ms 114 ms 191 ms 113 ms 113 ms 114 ms 112 ms 113 ms 114 ms 114 ms 114 ms 191 ms 114 ms 116 ms 114 ms 119 ms 113 ms dcr2-so-7-1-0.Atlanta.savvis.net [204.70.192.61]
11 113 ms 114 ms 114 ms 114 ms 114 ms 113 ms 113 ms 116 ms 116 ms 114 ms 114 ms 114 ms 114 ms 113 ms * 114 ms 114 ms 114 ms 115 ms 115 ms acr1-so-1-0-0.Atlanta.savvis.net [208.172.67.78]
12 155 ms 144 ms 173 ms 173 ms 164 ms 170 ms 155 ms 154 ms 162 ms 143 ms 137 ms 144 ms 148 ms 146 ms 149 ms 159 ms 150 ms 153 ms 172 ms 164 ms scr1-at-1-2-0-960.dlls2.savvis.net [208.172.67.158]
13 154 ms 147 ms 177 ms 173 ms 166 ms 171 ms 155 ms 154 ms 153 ms 143 ms 136 ms 143 ms 149 ms 148 ms 147 ms 163 ms 151 ms 152 ms 174 ms 164 ms usdlls2-01-bsn.cntx04.savvis.net [64.241.96.94]
14 156 ms 154 ms 177 ms 179 ms 174 ms 179 ms 163 ms 159 ms 192 ms 154 ms 147 ms 149 ms 154 ms 153 ms * 164 ms 162 ms 160 ms 180 ms 167 ms hitech-1.savvis-internet.usdlls2-bsn.savvis.net [216.90.2.66]
15 157 ms 154 ms 175 ms 176 ms 177 ms 174 ms 160 ms 155 ms 166 ms 148 ms 143 ms 149 ms 150 ms 156 ms 153 ms 162 ms 153 ms 155 ms 174 ms 165 ms alt.flyaceshigh.com [216.91.192.19]

StarOfAfrica2 · « **Reply #1 on:** May 31, 2005, 12:23:55 PM »

Infected with a bad route maybe. Almost every single one of those timeouts was Savvis, in one city or another.

Clifra Jones · « **Reply #2 on:** May 31, 2005, 03:40:44 PM »

IT PROOF! SAVIS is a virus!

Saintaw · « **Reply #3 on:** May 31, 2005, 04:39:44 PM »

What's weird is I get between 5-20% PL on every hop (Doesn't show on this trace up here & my intardnet too fu**ed up to upload a pic right now)

That means even on the 1st hops I get packet loss.... that's my own puter, the modem and the ISP... I'm smelling something bad here, but I can't get hold of it...

What's driving me mad is I've just started playing AH again aftem months.... and this mostly makes it unplayable

Skuzzy · « **Reply #4 on:** May 31, 2005, 05:23:23 PM »

Woah folks. You have to interpret the data correctly. Upon the first sign of packet loss, all bets are off.

This occurs at colt. It would not matter who else follows in that trace.

Star, I know you hate Savvis, but you have been saying some things which are largely incorrect hereof late. Like the one about the routers in St. Louis.
I do not call 2) Juniper M80, and 2) Juniper M60 routers old tech or useless tech.

I am not defending Savvis, but I do not think passing incorrect information about is appropo either. With Savvis being the second largest ISP/backbone in the U.S., there is a very good chance most everyone will have a route through them. It is getting unavoidable.
Large ISP's are always in the problematic paths simply due to being so big. This weekend was Memorial weekend and the kids are all out of school. Problems with the Internet *always* happen this time of year. Always.

StarOfAfrica2 · « **Reply #5 on:** May 31, 2005, 06:34:17 PM »

Yer right. I get carried away when I see them having problems.

Sorry. I shouldnt be so happy at someone else's expense, the bad karma is going to get me eventually.

Its just.........you ever meet someone that makes the hair stand up on the back of your neck and you instantly dislike, no matter what? Imagine a company like that. Ah well.

Saintaw · « **Reply #6 on:** June 01, 2005, 01:26:42 AM »

Here's the screenie from yesterday (works fine today...)

Skuzzy, I can take the "bad intardnet week", but what I don't understand is the PL on the 1st hops...

StarOfAfrica2 · « **Reply #7 on:** June 01, 2005, 01:41:14 AM »

Ok. I shouldnt even be posting an answer to this right now, brain is fried from a very long and very bad day. But I'm not sure that packet loss at your first hop (which should be your network router) is unusual. Mine always shows 100% packet loss at the first hop on pingplotter, tracert shows a timeout there. Its due to the way my network is setup. The router doesnt send anything back, show it shows 100% loss.

I usually hide the first hop when I use pingplotter, it gives you that option because it expects to see packet loss there I think. Thats just a guess.

Saintaw · « **Reply #8 on:** June 01, 2005, 02:43:46 AM »

that not my case Star, No router here, just a cable modem, and it usualy doesn't show PL.

I'm going to bomb my ISP

Schutt · « **Reply #9 on:** June 01, 2005, 03:44:31 AM »

Is 10.12.0.1 your cable modem?
There seems to be a packet loss on the way to it. So my bet would be you have a faulty network cable between your pc and your cable modem?
Do you have a spare cable to replace that one for a test, is it a bought network cable or did you put on the plugs yourself?

Saintaw · « **Reply #10 on:** June 01, 2005, 04:22:07 AM »

It's working on & off (depends of the days). But I will try that when I get home this evening, I have a few spare network cables.

Skuzzy · « **Reply #11 on:** June 01, 2005, 06:36:49 AM »

That is definately either the cable modem, a local network cable, some issue with the physical line to the cable modem, some type of DOS attack on your node, or you have spyware problems with your local computer.

214thCavalier · « **Reply #12 on:** June 01, 2005, 08:06:52 AM »

Ha !

Saw's an FDB of course he's gonna be infected, you can't have access to all the err images and not be at risk

Saintaw · « **Reply #13 on:** June 02, 2005, 12:09:08 AM »

Changed the local network cable, and it's working fine this morning. Yesterday the modem wasn't even connecting to the intardnet... luxembourgonline (my ISP) hasn't yet answered my emails... and their phone support is from 9 to 5.

Someone, please invade this country!

OOZ662 · « **Reply #14 on:** June 02, 2005, 05:04:42 PM »

Quote

Originally posted by Saintaw
Someone, please invade this country!

The next Bush just might...