Spoof Attack's on HP Computer

  • Thread starter Thread starter Musicman50
  • Start date Start date
M

Musicman50

I was given a very nice HP computer with XP Media Center installed on it.
Seems there was a couple of viruses on it, but I successfully installed a
new AV and Spyware remover and got all the bugs out.
But I get this report from my D-Link Router everytime I run the new computer
on my LAN.
In fact it will get hundreds of lines like this in just a few minutes of use
if the computer is plugged directly in to the LAN.
If I use the WiFi (Wireless) connection on the computer I don't get these
errors.

Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
Target IP(192.168.0.255), Target Port(137) Packet Dropped
Apr/15/2009 18:17:31
Spoof IP(192.168.0.17), Spoof Port(137)
Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
Target IP(192.168.0.255), Target Port(138) Packet Dropped
Apr/15/2009 18:17:31
Spoof IP(192.168.0.17), Spoof Port(138)
Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect

Any ideas wher I can start to cure this problem.
The anti virus program (AVAST) has removed any viruses and no longer shows
any on the system.

Thanks, Phil
 
You shouldn't assume the PC is clean. No single Antivirus product is
100% effective. They all have varying levels of detection. You need
to use one or two online scans from alternate vendors before you can
state that the PC is free of infections.
 
I was given a very nice HP computer with XP Media Center installed on it.
Seems there was a couple of viruses on it, but I successfully installed a
new AV and Spyware remover and got all the bugs out.
But I get this report from my D-Link Router everytime I run the new computer
on my LAN.
In fact it will get hundreds of lines like this in just a few minutes of use
if the computer is plugged directly in to the LAN.
If I use the WiFi (Wireless) connection on the computer I don't get these
errors.

Apr/15/2009 18:17:31
 Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
 Target IP(192.168.0.255), Target Port(137)   Packet Dropped
Apr/15/2009 18:17:31
 Spoof IP(192.168.0.17), Spoof Port(137)
Apr/15/2009 18:17:31
 Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
 Target IP(192.168.0.255), Target Port(138)   Packet Dropped
Apr/15/2009 18:17:31
 Spoof IP(192.168.0.17), Spoof Port(138)
Apr/15/2009 18:17:31
 Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect

Any ideas wher I can start to cure this problem.
The anti virus program (AVAST) has removed any viruses and no longer shows
any on the system.

Thanks, Phil
Click to expand...

Well, let's see...

If you were to use Google to search for: Spoof Attack fromd

you will get some ideas. Many of which include Dlink wireless
routers.
 
From: "Musicman50" <[email protected]>

| I was given a very nice HP computer with XP Media Center installed on it.
| Seems there was a couple of viruses on it, but I successfully installed a
| new AV and Spyware remover and got all the bugs out.
| But I get this report from my D-Link Router everytime I run the new computer
| on my LAN.
| In fact it will get hundreds of lines like this in just a few minutes of use
| if the computer is plugged directly in to the LAN.
| If I use the WiFi (Wireless) connection on the computer I don't get these
| errors.

| Apr/15/2009 18:17:31
| Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
| Apr/15/2009 18:17:31
| Target IP(192.168.0.255), Target Port(137) Packet Dropped
| Apr/15/2009 18:17:31
| Spoof IP(192.168.0.17), Spoof Port(137)
| Apr/15/2009 18:17:31
| Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
| Apr/15/2009 18:17:31
| Target IP(192.168.0.255), Target Port(138) Packet Dropped
| Apr/15/2009 18:17:31
| Spoof IP(192.168.0.17), Spoof Port(138)
| Apr/15/2009 18:17:31
| Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect

| Any ideas wher I can start to cure this problem.
| The anti virus program (AVAST) has removed any viruses and no longer shows
| any on the system.

| Thanks, Phil


I would be wary of this report and look into what the D-Link is doing and actually
reporting. I don't think this is malware related.
 
Musicman50 said:
I was given a very nice HP computer with XP Media Center installed on it.
Seems there was a couple of viruses on it, but I successfully installed a
new AV and Spyware remover and got all the bugs out.
But I get this report from my D-Link Router everytime I run the new computer
on my LAN.
In fact it will get hundreds of lines like this in just a few minutes of use
if the computer is plugged directly in to the LAN.
If I use the WiFi (Wireless) connection on the computer I don't get these
errors.

Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
Target IP(192.168.0.255), Target Port(137) Packet Dropped
Apr/15/2009 18:17:31
Spoof IP(192.168.0.17), Spoof Port(137)
Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
Target IP(192.168.0.255), Target Port(138) Packet Dropped
Apr/15/2009 18:17:31
Spoof IP(192.168.0.17), Spoof Port(138)
Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect

Any ideas wher I can start to cure this problem.
The anti virus program (AVAST) has removed any viruses and no longer shows
any on the system.

Thanks, Phil
Click to expand...


As you're learning, with second-hand computers, especially if acquired
from strangers but perhaps even if acquired from a family member or
friend, your wisest course of action would definitely be to format the
hard drives and start fresh. You don't want to get in trouble because
the original owner may have filled the hard drive with kiddie porn, or
have problems because the original owner downloaded/installed viruses or
other malware.


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot
 
Musicman50 said:
I was given a very nice HP computer with XP Media Center installed on it.
Seems there was a couple of viruses on it, but I successfully installed a
new AV and Spyware remover and got all the bugs out.
But I get this report from my D-Link Router everytime I run the new
computer on my LAN.
In fact it will get hundreds of lines like this in just a few minutes of
use if the computer is plugged directly in to the LAN.
If I use the WiFi (Wireless) connection on the computer I don't get these
errors.

Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
Target IP(192.168.0.255), Target Port(137) Packet Dropped
Apr/15/2009 18:17:31
Spoof IP(192.168.0.17), Spoof Port(137)
Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect,
Apr/15/2009 18:17:31
Target IP(192.168.0.255), Target Port(138) Packet Dropped
Apr/15/2009 18:17:31
Spoof IP(192.168.0.17), Spoof Port(138)
Apr/15/2009 18:17:31
Spoof Attack fromd MAC(00-18-F3-88-0D-4E) Detect

Any ideas wher I can start to cure this problem.
The anti virus program (AVAST) has removed any viruses and no longer shows
any on the system.

Thanks, Phil
Click to expand...

Does the MAC address corespond to your computer by any chance?

This thread http://forums.speedguide.net/showthread.php?t=240039 might
provide an insight.

It could also be this;
http://www.symantec.com/security_response/writeup.jsp?docid=2004-042717-4012-99

You might try TCPView
http://technet.microsoft.com/en-us/sysinternals/default.aspx which shows TCP
and UDP endpoints on your system, including the owning process name, remote
address and state of TCP connections.

Some router firewalls report any more than a few attempts as some kind of
attack, smurf stc..

I was testng a net work connection on a new machine, and pinged it about
three times. When I went to check the other PC, a message from the third
party firewall told me it had intercepted a "ping attack!".

Don't get too concerned when you read these messages from router, AV etc.
 
you can try do a scan with good malware scanner.
but i think it's better if you secure your router through a password
and disable all the forwarded ports and try and install a good
firewall on your pc.
 
From: <[email protected]>

| you can try do a scan with good malware scanner.
| but i think it's better if you secure your router through a password
| and disable all the forwarded ports and try and install a good
| firewall on your pc.

I was wrong. This is a used PC and should have been summarily wiped and the OS
reinstalled from scratch upon recipt.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

BSOD by atapi.sys , process_name: Idle 5
Computer Security Information (Free Articles and eBooks) 1
Faillure of Windows Backup of C: to other hard drive 6
Is my network getting attacked? 3
Windows Explorer Error 8
IE7 keeps crashing 3
Looking for comparable sound card 2
dwwin.exe fails to initialize due to shutdown 4

Back
Top