Why I'm Banned EVERYDAY !

[urmans]

My Computer is well protected, I believed my anti virus Symantec Endpoint Protection did a good job...
BUT Until Now from time to time am still doing Old Fashion Ways to Removed a Viruses..
Especially the Virus that Can Not Detect by anti virus and There are viruses tight-knit each other,
when you removed, automatically the virus appears again and again or re-established on start up....

If you experience with viruses like this just follow these steps
Open Windows explorer >Tools >Folder Options >View tab
checked Hidden file and folder (see pic.1)
unchecked Hide protected operating system files (see pic.1)
unchecked Use simple file sharing (see pic.2)
Apply >Ok

Now you can start looking for suspected files in your USER NAME folder
C:\Documents and Settings\USER NAME\Local Settings\..\...\Content.IE5\..
or
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\..
or
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\..
Nevertheless check also in System Folder for suspected Hidden files.

When you find the suspected files/viruses Don't Forget to removed the file name string from the Registry entry
usually in this string
[HKEY_CURRENT_USER\Software\Microsoft\Win dows\CurrentVersion\Run]
[HKEY_CURRENT_USER\Software\Microsoft\Win dows\CurrentVersion\Run_Hidden]
[HKEY_CURRENT_USER\Software\Microsoft\Win dows\CurrentVersion\RunOnce]

When you infected you Should Give-Up All Files in System Restore
sooooooooooo.... Removed all files in System Volume Information (Leaved the files that Can't be remove).
C:\System Volume Information\_restore{090030........}

Restore point will established again after you restart the PC
DO NOT REMOVE: NTLDR file, NTDETECT, Boot.inf

(Sometime I do all this in Save Mode)

Zip or Rar the Virus (if you found one) before deleted and send to MF (that what he said )


Best Regards,
urmans.

[Sat-TV]

In this case the virus is a custom made ddos zombie bot.
No anti-virus will pick it up because it's custom made and not many people are infected so it's not yet reported.
You most likely downloaded the virus from this site or any other sat site, the first time it showed you a fake warning or it didn't show anything at all, but it did copy itself into your system.
Most likely it's hidden somewhere on the system you normally don't look and it will run on startup.
If you click ctrl+alt+del and view your currently running process it will most likely be there consuming some cpu resources every second.
To check for programs to run on startup go to start > run > and type "msconfig" without the quotes. You will find everything that runs when your computer starts on the "startup" tab. (maybe you can post a list of everything you have in here)

Regards,
Danny

[rchoual]

hello everyone

I got the same message yesterday a my formatted PC.
I believe that there is a small bug in the system. Yesterday I have been banned for 24hours (but I managed to logg on again )
MainFrame, check that please

regards

[Sat-TV]

The 24 hours is just something that sounded good to me in the warning message, the system actually bans people untill the list is full, then it keep someone banned untill that place in the banlist is needed again. can be 48 hours but can also be 1 hour.
There is no bug in the system, it will only display that message when your ip is on the blacklist > http://www.satsupreme.com/blacklist.txt

However when you got banned once it's possible your system stores that page in cache and displays it again.

It seems that Algeria is working with a very small number of ip addresses sharing them between customers. If your from Algeria it's possible someone before you used your ip and got banned. To verify this just visit www.whatsmyip.org and lookup your current ip with the blacklist.

[-magnum-]

moi aussi pour 24 heures avant hier 'jai oublie' de le mentionne' j'ai toujour ete' bannis j'ai habitude , je crois, supposition? que le serveur est loin a scraton penssylvanie ca fait une trotte et le mauvais temps on a pas des grand debit128ko/s et plus telechargement, les emails a verifier ,skype telephonner a sa copine, et pas vos 30 MEGABITE chez alice ou neuf box ou bbox et encore mieux fibre optique.
sincerement mag

[CR9]

i ave same problem my host was banned 24 h thsi 2 day i dont knwo why pz mainfrime try to find solution and thank u

[Sat-TV]

i ave same problem my host was banned 24 h thsi 2 day i dont knwo why pz mainfrime try to find solution and thank u

Hi kader2007,

The problem is not on my side..
Here's are some pieces I took out of the logfile to better explain the situation

23-04-2009 / 00:49:14 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:19 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:20 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:25 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:29 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:34 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:41 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:44 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:49 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:51 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:49:58 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:50:03 - 189.30.64.157 - /ulc_download.php
23-04-2009 / 00:50:05 - 189.30.64.157 - has been banned!

As you can see this user has requested the same page 13 times within 50 seconds..

23-04-2009 / 00:36:01 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:02 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:04 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:05 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:05 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:10 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:10 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:13 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:14 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:16 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:17 - 41.201.99.63 - /ulc_download.php
23-04-2009 / 00:36:21 - 41.201.99.63 - has been banned!

And this one got banned for 12 hits all within 20 seconds!

23-04-2009 / 00:23:50 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:23:52 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:23:54 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:23:56 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:23:58 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:00 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:02 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:03 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:06 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:07 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:12 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:14 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:16 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:17 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:20 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:21 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:22 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:23 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:25 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:27 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:28 - 189.76.190.245 - /ulc_download.php
23-04-2009 / 00:24:30 - 189.76.190.245 - has been banned!

And this is going on and on, all day long, thousands of infected users who don't even know they are attacking us..

So please understand that if you see the message "Your host has been banned for 24 hours" and you did not rapidly refresh our site yourself, This means you or someone using exactly the same ip address as you is attacking our server.
The banlist is constantly refreshing and ip addresses are rarely banned longer than 60 minutes so if you see that message it's 99% sure you are infected and part of the botnet yourself. There's absolutely no way you get on that banlist due to something else!

Regards,
MainFrame

[CR9]

okay thank u u do good job but i try to not down on this mistake

[Sat-TV]

hello everyone

I got the same message yesterday a my formatted PC.
I believe that there is a small bug in the system. Yesterday I have been banned for 24hours (but I managed to logg on again )
MainFrame, check that please

regards

Hi rchoual,

I've been reading trough the logfiles for hours.
The firewall is banning a lot of people every day but it never makes mistakes, all of those ip adresses are banned for rapidly requesting pages faster than any human would. When the banlist is full, after +/- 1 hour it starts again replacing the currently banned with the new attackers so if you see the message "your host has been banned for 24 hours" your originating ip has been attacking very recently, no question about it.. maybe another computer in the network? or a neighbour stealing your wifi?

Regards,
Danny

[rchoual]

Hi dear MF,

Everybody on the site can tell you that I click faster than my shade ....maybe it's caused because I open many pages at the same time
PS: I'm not using any WIFI routers or modems

regards.