Achtung! Snort Cyberkit alert!!!

St. George · Sep 18, 2003, 07:22 AM

Hi there.

I noticed my G4 iMac running a little slow the other day - plus expolrer and safari were both acting odd - not loading 40% of sites. This could be a fault with my ISP of course but I started checking about.

"I'm now running Snort/HenWen/Letterstick and keep getting this:

A new alert has been issued...
The alert contents: "ICMP PING Cyberkit 2.2 Windows"

The alert was triggered by an ICMP packet
Source..." etc

I'm getting hit by this every 5 seconds - non-stop.

Any clues anyone?

rainman::|:| · Sep 18, 2003, 08:15 AM

I'm not quite sure what that is, you should use a utility to get more info Who's There is compatible with most firewall log formats, works great. I'm having a similar problem with a particular trojan horse trying to access my machine, connections from around the world... weird. My cable modem never stops blinking, there's always someone trying to access something on my machine.

pnw

St. George · Sep 18, 2003, 08:33 AM

Thanks
Tried looking at opendoor.com for 'who's there.' I'm not getting into 40% of sites at the moment (which I suspect has something to do with the continued pinging) and keep getting the message box:

"Could not open the page

Could not open the page "http://
www.macupdate.com/info.php/id/5321" because the
network connection was reset. This sometimes
occurs when the server is busy."

I have a cable connection as well but NTL say the network is ok at the moment.
(note- the above www.macupdate... is an example url)
-----

For anybody that can help with the cyberkit 2.2 windows pinging I've got the following explanation - which means little to me

http://www.snort.org/snort-db/sid.html?sid=483

Rower_CPU · Sep 18, 2003, 01:14 PM

I know that the Nachi virus causes a lot of extra network traffic due to ICMP pings. It could be that there is/are infected machine/s on your local network (home or ISP) and that is causing all the extra traffic.

St. George · Sep 18, 2003, 01:22 PM

Rower-CPU - I believe you are correct.

Just called NTL and the chap on the line admitted that there is either a new virus or the old ones (msblast et al) were still causing havoc.

I've changed my proxy settings so I'm sitting on a different server in the country - this is much better for the above browser problems... still getting pinged - most probably by infected ms machines.

My firewall's up in anycase...

Regards.

Sep 18, 2003, 07:22 AM	#1
St. George macrumors member Join Date: May 2003 Location: England	Achtung! Snort Cyberkit alert!!! Hi there. I noticed my G4 iMac running a little slow the other day - plus expolrer and safari were both acting odd - not loading 40% of sites. This could be a fault with my ISP of course but I started checking about. "I'm now running Snort/HenWen/Letterstick and keep getting this: A new alert has been issued... The alert contents: "ICMP PING Cyberkit 2.2 Windows" The alert was triggered by an ICMP packet Source..." etc I'm getting hit by this every 5 seconds - non-stop. Any clues anyone?
	0

Sep 18, 2003, 01:14 PM	#4
Rower_CPU Demi-God (Moderator) Join Date: Oct 2001 Location: San Diego, CA	I know that the Nachi virus causes a lot of extra network traffic due to ICMP pings. It could be that there is/are infected machine/s on your local network (home or ISP) and that is causing all the extra traffic. __________________ Join MacRumors.com - Team Folding!
	0

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
thread	Thread Starter	Forum	Replies	Last Post
Alert after App is "closed" (Home button pressed)	bmcgonag	iPhone/iPad Programming	8	Nov 1, 2011 08:13 PM
Rumour Alert. Rumour Alert.	JohnnySmacker	Wasteland	3	Feb 29, 2008 05:25 PM
Keith Richards: `I snorted my father'	obeygiant	Current Events	24	Apr 11, 2007 04:25 AM
iCal Alerts No Longer ..Alerting	Coolnat2004	Mac Applications and Mac App Store	5	Apr 29, 2006 04:50 AM

Sep 18, 2003, 08:15 AM	#2
rainman::\|:\| macrumors 601 Join Date: Feb 2002 Location: iowa	I'm not quite sure what that is, you should use a utility to get more info Who's There is compatible with most firewall log formats, works great. I'm having a similar problem with a particular trojan horse trying to access my machine, connections from around the world... weird. My cable modem never stops blinking, there's always someone trying to access something on my machine. pnw
	0

Sep 18, 2003, 08:33 AM	#3
St. George Thread Starter macrumors member Join Date: May 2003 Location: England	Thanks Tried looking at opendoor.com for 'who's there.' I'm not getting into 40% of sites at the moment (which I suspect has something to do with the continued pinging) and keep getting the message box: "Could not open the page Could not open the page "http:// www.macupdate.com/info.php/id/5321" because the network connection was reset. This sometimes occurs when the server is busy." I have a cable connection as well but NTL say the network is ok at the moment. (note- the above www.macupdate... is an example url) ----- For anybody that can help with the cyberkit 2.2 windows pinging I've got the following explanation - which means little to me http://www.snort.org/snort-db/sid.html?sid=483
	0

Sep 18, 2003, 01:22 PM	#5
St. George Thread Starter macrumors member Join Date: May 2003 Location: England	Rower-CPU - I believe you are correct. Just called NTL and the chap on the line admitted that there is either a new virus or the old ones (msblast et al) were still causing havoc. I've changed my proxy settings so I'm sitting on a different server in the country - this is much better for the above browser problems... still getting pinged - most probably by infected ms machines. My firewall's up in anycase... Regards.
	0


MacRumors Forums > Archive > Archives of Old Posts > General Mac Discussion