Virus issue

**PanFrie** · Apr 17th, 2008, 01:50 AM

this most likely isnt the best spot to be asking for help on this... but maybe by some crazy chance someone will actually post something helpful and not completely random (yes, i realize by saying that im pretty well ASKING for it... :-P )

so, were having a bit of a problem at the gaming centre (me and my bro run a gaming centre in windsor ontario). Every once in a while (like, 2 times within an hour), all the connections on our router are filled up, and the internet runs slow for any new connections that are trying to be made. looking at the router info, on average, about 100-200 connections are in use... well, the fucker gets up to 95% (of 2048) when this happens. I've tried my usual Spybot and AdAware scans, AVG virus scans, HijackThis scans... NOTHING seems to be working... i've reformatted one of them, however i need to connect it to the network to install / update games, so im assuming that it spread through the network when i connected it, making the reformat useless. We have also gotten a call from our ISP saying that were sending spam emails out in massive ammounts. anyone got any idea exactly what it could be, or a way to get rid of it?

Stephenson · Apr 17th, 2008, 02:21 AM

Can't help you their mate. Usually when I have this happen I reboot my computer to the beginning, but don't do that.

But, reading the thread title, while watching 28 Days Later adds to the imagination.

**Liebgott** · Apr 17th, 2008, 04:38 AM

Are you sure its not some kid who does it? Is it every hour or just certain hours?

**PanFrie** · Apr 17th, 2008, 04:59 AM

randomly throughout t he day. even when theres no one here. i dont know how anyone would force it to happen, when, like i said, on average use its only at 200 connections, 500 TOPS, and thats with EVERY computer in use, and people playing online games. They dont have access to the C drive (which has deep freeze on it), no ctrl-alt-del, no cmd. there pretty well cut off from everything.

oh, and my computer was doing it earlier. (we share our innertubes with a guy across the street, he knows how to check which computer is causing the problems.)

**RichyCunningham** · Apr 17th, 2008, 05:17 AM

seems like the computers at your LAN center may have been compromised by hackers and are now being used as "bots".

With them as bots, they can be accessed at any time by said hacker and retrieve information, or can be used to do DDoS attacks on people and such.

I would personally reformat all of them. And then starting making a copy of Windows in a fully updated state so in case this happens again, you can just ghost the windows image onto it.

Also there is a software out there for LAN centers that focus on gaming. It doesnt really let you browse the web or anything but its sort of like Windows Media Center edition. You can choose to have xfire/ventrilo running and it gives you a nice little list of the games that are installed on the computer itself.

**Liebgott** · Apr 17th, 2008, 09:43 AM

You could close all ports and see if that stops it, then just keep opening them up, and only open the ones you need, and if it stops then you know what is happening.

I agree with Ricky that it sounds like a bot, my suggestion i gave is if you don't want to reformat them all, but then again, you should reformat every now and then just to clear out random shit thats been left over.

**PanFrie** · Apr 17th, 2008, 10:23 AM

yea, well, i did reformat the one, then tossed deep freeze and everything on it (makes no need to ever have to reformat, unless the drive itself gets effed up), then make an image of the drive and put that on all the other computers. Thing is, earlier today MY computer (i use my computer as the frontdesk / business computer) was doing it earlier. i did a virus scan and got about 350 entries for Gaelicum.A, but ALL the entries for that were on my D drive (my XP partition, which i no longer use)... im guessing from when i was using XP. i just got that all cleaned out and its not there anymore. im REALLY hoping i dont have to redo the computers AGAIN... (it was a royal pain in the ass)

as for software for gaming centres, were using Smartlaunch

and for the ports, its all usually goin out on port 80, which we kinda need to have opened :-P