- Test - lists.nanog.org

New Computer? Six Steps to Safer Surfing
by Sean Donelan 24 Dec '04

24 Dec '04

A better than average news article helping people keep their new computers secure. It is much easier to prevent your computer getting infected, than it is curing your computer afterwards. http://www.washingtonpost.com/wp-dyn/articles/A9658-2004Dec18.html I wouldn't rely on software firewalls. At the same store you buy your computer, also buy a hardware firewall. Hopefully soon the motherboard and NIC manufacturers will start including built-in hardware firewalls. But sometimes, such as dialup modems, software firewalls are the only alternative.

22 37

The Cidr Report
by cidr-report＠potaroo.net 24 Dec '04

24 Dec '04

This report has been generated at Fri Dec 24 21:44:23 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 17-12-04 149025 102505 18-12-04 149174 102508 19-12-04 149122 102507 20-12-04 149153 102620 21-12-04 149262 102676 22-12-04 149326 102669 23-12-04 149426 102720 24-12-04 149588 102702 AS Summary 18576 Number of ASes in routing system 7585 Number of ASes announcing only one prefix 1412 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90548992 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 24Dec04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 149103 102680 46423 31.1% All ASes AS18566 756 7 749 99.1% CVAD Covad Communications AS4134 821 197 624 76.0% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 819 230 589 71.9% TWTC Time Warner Telecom AS721 1074 653 421 39.2% DNIC DoD Network Information Center AS27364 442 34 408 92.3% ARMC Armstrong Cable Services AS22773 417 24 393 94.2% CXA Cox Communications Inc. AS7843 482 100 382 79.3% ADELPH-13 Adelphia Corp. AS7018 1412 1045 367 26.0% ATTW AT&T WorldNet Services AS6197 819 457 362 44.2% BNS-14 BellSouth Network Solutions, Inc AS17676 388 69 319 82.2% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS1239 934 625 309 33.1% SPRN Sprint AS6478 467 163 304 65.1% ATTW AT&T WorldNet Services AS9929 341 40 301 88.3% CNCNET-CN China Netcom Corp. AS22909 419 120 299 71.4% CMCS Comcast Cable Communications, Inc. AS4355 383 99 284 74.2% ERSD EARTHLINK, INC AS4766 536 270 266 49.6% KIXS-AS-KR Korea Telecom AS14654 264 7 257 97.3% WAYPOR-3 Wayport AS9443 366 121 245 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS21502 235 3 232 98.7% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS2386 857 627 230 26.8% ADCS-1 AT&T Data Communications Services AS6140 372 142 230 61.8% IMPSA ImpSat AS25844 244 17 227 93.0% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6198 446 224 222 49.8% BNS-14 BellSouth Network Solutions, Inc AS4814 223 6 217 97.3% CHINA169-BBN CNCGROUP IP network¡ªChina169 Beijing Broadband Network AS3602 318 113 205 64.5% SPCA Sprint Canada Inc. AS22291 290 85 205 70.7% CC04 Charter Communications AS9583 580 377 203 35.0% SIFY-AS-IN Sify Limited AS15270 239 42 197 82.4% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS701 1083 889 194 17.9% UU UUNET Technologies, Inc. AS5668 424 231 193 45.5% CIH-12 CenturyTel Internet Holdings, Inc. Total 16451 7017 9434 57.3% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.206.52.0/22 AS701 UU UUNET Technologies, Inc. 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.72.240.0/20 AS24320 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of Sky Internet - BAYANTEL Inc. - Philppines 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.253.190.0/23 AS19942 RTL-16 A Reality Technologies, LLC 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.17.80.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

Re: More undersea cable wars brewing in India
by Fergie (Paul Ferguson) 24 Dec '04

24 Dec '04

I think everyone has pretty much known that the international cable companies are basically cartels -- leaking bandwidth into the market at a rate sufficient enough to keep prices artificially high enough to (at the very least) sustain fiscal margins. This has been going on for years. - fergie -- Adrian Chadd <adrian(a)creative.net.au> wrote: On Thu, Dec 23, 2004, Suresh Ramasubramanian wrote: > > .. and meanwhile, the best part of 32 STM-1s worth of fiber is lying dark ... If they lit /all/ of the fibre, don't you think it'll all be used very very quickly? What will they do then? Lay more fibre next year? :) -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

3 2

Re: More undersea cable wars brewing in India
by Adrian Chadd 24 Dec '04

24 Dec '04

On Thu, Dec 23, 2004, Laconsults(a)aol.com wrote: > this already doubles TCP throughputs over inter-continental cables/ > satellites/ WAN links, just one-click install ( all window platforms TCP upgrade > downloads to follow within a month ) . > the cable link utilisation & also end user TCP throughput graphs will both > show constant 95%-100% levels, cf existing saw-tooths. Its not increasing the bandwidth of a fibre, its just allowing TCP streams to use more bandwidth. Hacks to do this have been popping up here and there for a number of years. So how is it relevant to the international cable company practice(s) of artifically limiting bandwidth to limit growth? Adrian -- Adrian Chadd "You don't have a TV? Then what's <adrian(a)creative.net.au> all your furniture pointing at?"

1 0

Anycast 101
by Iljitsch van Beijnum 23 Dec '04

23 Dec '04

I got some messages from people who weren't exactly clear on how anycast works and fails. So let me try to explain... In IPv6, there are three ways to address a packet: one-to-one (unicast), one-to-many (multicast), or one-to-any (anycast). Like multicast addresses, anycast addresses are shared by a group of systems, but a packet addressed to the group address is only delivered to a single member of the group. IPv6 has "round robin ARP" functionality that allows anycast to work on local subnets. Anycast DNS is a very different beast. Unlike IPv6, IPv4 has no specific support for anycast, and the point here is to distribute the group address very widely, rather than over a single subnet anyway. So what happens is that a BGP announcement that covers the service address is sourced in different locations, and each location is basically configured to think it's the "owner" of the address. The idea is that BGP will see the different paths towards the different anycast instances, and select the best one. Now note that the only real benefit of doing this is reducing the network distance between the users and the service. (Some people cite DoS benefits but DoSsers play the distribution game too, and they're much better at it.) Anycast is now deployed for a significant number of root and gtld servers. Before anycast, most of those servers were located in the US, and most of the rest of the world suffered significant latency in querying them. Due to limitations in the DNS protocol, it's not possible to increase the number of authoritative DNS servers for a zone beyond around 13. With anycast, a much larger part of the world now has regional access to the root and com and net zones, and probably many more that I don't know about. However, there are some issues. The first one is that different packets can end up at different anycast instances. This can happen when BGP reconverges after some network event (or after an anycast instance goes offline and stops announcing the anycast prefix), but under some very specific circumstances it can also happen with per packet load balancing. Most DNS traffic consists of single packets, but the DNS also uses TCP for queries sometimes, and when intermediate MTUs are small there may be fragmentation. Another issue is the increased risk of fait sharing. In the old root setup, it was very unlikely for a non-single homed network to see all the root DNS servers behind the same next hop address. With anycast, this is much more likely to happen. The pathological case is one where a small network connects to one or more transit networks and has local/regional peering, and then sees an anycast instance for all root servers over peering. If then something bad happens to the peering connection (peering router melts down, a peer pulls an AS7007, peering fabric goes down, or worse, starts flapping), all the anycasted addresses become unreachable at the same time. Obviously this won't happen to the degree of unreachability in practice (well, unless there are only two addresses that are both anycast for a certain TLD, then your milage may vary), but even if 5 or 8 or 12 addresses become unreachable the timeouts get bad enough for users to notice. The 64000 ms timeout query is: at what point do the downsides listed above (along with troubleshooting hell) start to overtake the benefit of better latency? I think the answer lies in the answers to these three questions: - How good is BGP in selecting the lowest latency path? - How fast is BGP convergence? - Which percentage of queries go to the first or fastest server in the list?

18 35

Re: More undersea cable wars brewing in India
by Suresh Ramasubramanian 23 Dec '04

23 Dec '04

On Thu, 23 Dec 2004 09:40:24 EST, Laconsults(a)aol.com <Laconsults(a)aol.com> wrote: > Yes, you may be interested to know there is a very much easier immediate > solution : [lots of capitals] [strong odor of snake oil] If it is that easy, trot it out ... on nanog. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

More undersea cable wars brewing in India
by Suresh Ramasubramanian 23 Dec '04

23 Dec '04

.. and meanwhile, the best part of 32 STM-1s worth of fiber is lying dark ... srs http://www.indianexpress.com/full_story.php?content_id=61366 > Flag, VSNL spar over bandwidth > > Posted online: Thursday, December 23, 2004 at 0046 hours IST > > MUMBAI, DECEMBER 22: TATA group company VSNL, one of the original > investors in the Flag Cable Systems in 1995-1996, has been > accused by Flag Telecom Ltd, a Reliance company, of artificially > restricting access on Flag Europe Asia (FEA) cable and preventing > the ability to respond to market demand. as another article points out, they're invoking WTO GATS provisions on this - > http://economictimes.indiatimes.com/articleshow/968127.cms > VSNL violates WTO norms > > PTI[ WEDNESDAY, DECEMBER 22, 2004 07:38:18 PM] > MUMBAI: VSNL has been accused of restricting access on Reliance > group-owned FLAG Europe Asia cable, which is in direct violation > of WTO's General Agreement on Trade in Services (GATS). and then, REACH, seconded by VSNL, stirs the pot a bit more .. http://www.hindustantimes.com/news/181_1159772,0003.htm > FLAG partner calls for meet on cable upgrade > Press Trust of India > Mumbai, December 19, 2004|16:45 IST [...] > The global carrier wants to discuss "unauthorised upgrade of FEA > cable between UK and UAE" as it did not get approval from all 12 > landing signatories, which is required under the Construction and > Maintenance Agreement (C&MA), REACH said in a letter to FLAG Telecom > Ltd's management committee. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

3 5

Agenda so far for NANOG33
by Susan Harris 22 Dec '04

22 Dec '04

Greetings - here are some of the talks we've lined up so far for the Las Vegas meeting (Jan. 30 - Feb. 1): SUNDAY TUTORIALS ---------------- - Build for Success--How to Use Network Design Principles to Differentiate the Good, the Bad, and the Ugly Level: Introductory/Intermediate Barry Greene and Dave Meyer, Cisco - Understanding MPLS OAM Capabilities for Troubleshooting MPLS Networks Level: Introductory/Intermediate Moiz Moizuddin and Mukhtiar Shaikh, Cisco - BGP Troubleshooting Techniques Level: Introductory/Intermediate Philip Smith, Cisco GENERAL SESSION --------------- - A Day in the Security Life of a Service Provider--Qwest Don Smith, Qwest - Team Cymru Bogon Route Servers Dave Deitrich, Team Cymru - IGP Tuning in an MPLS Network Martin Horneffer, Deutsche Telekom - IP Fast-Reroute: An Analysis of Applicability to a Core Network Alia Atlas, Avici, and Gagan Choudhury, AT&T - Panel: Network-based Layer 2/3 VPN Deployment Danny McPherson, Arbor, moderator Ted Seely, Sprint Shane Amante, Level(3) Shankar Rao, Qwest - Implementation of Modern L2 VPNs Scott Gross, MCI - IETF Update Leslie Daigle, Verisign, and Alex Zinin, Cisco - Panel: A Look at the IP Multimedia Subsystem (IMS) Dave Meyer, Cisco, moderator - Looking Glasses--What's In It for You? Steve Gibbard, Packet Clearing House - Experience With In-bailiwick Nameservers Masato Minda, JPRS BOFs ---- - ISP Security and NSP-SEC BOF VIII Danny McPherson, Arbor, and Merike Kaeo, Double Shot Security, moderators - Peering BOF VIII Bill Norton, Equinix, moderator

1 0

Sanity worm defaces websites using php bug
by Fergie (Paul Ferguson) 22 Dec '04

22 Dec '04

These people don't waste much time when a new exploit found, do they? Geez. http://isc.sans.org/diary.php?date=2004-12-21 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

6 7

Israeli ISP's experience broadband dialer malware outbreak
by Gadi Evron 22 Dec '04

22 Dec '04

I received several notices today from fellow ISP's, originally from an Israeli ISP's security information sharing mailing list, that several large Israeli ISP's experience an outbreak that cause tech support lines to overflow. Basically, this malware appears to change dialer configuration for broadband users. "Advanced" setting is turned back to "Basic", Local Area Connection is being played with, the user name is changed to <random number>username, etc. The users get the following errors: 734 ,769, 789 or 800. On the press, several rumors are circulating: 1. This thing is from Kazaa. 2. Process names are: chksp2.exe, sp2ctr.exe and glwgmgeb.exe. 3. Also, this link has been provided: http://www.sophos.com/virusinfo/analyses/trojdlucam.html We haven't yet got my hands on a sample, but I hope to have one soon. I haven't seen any chatter about this in AV forums.. and for now it seems to be limited to Israel unless someone can inform me differently? Gadi.

1 0