PLDT + Lovesan (MSBlast worm)

Another episode of my dsl woes… read ahead…

Recap : My connection was always like crap (useless). I have no problems connecting to the internet. I can surf. I can download. It looks normal.. but it only last for a short while… After a few minutes, (can reach to some hours) of being connected, I will get to the point where “I am connected but I am not getting any data” … In other words, the connection has stalled and its similar to being disconnected. So what is the solution to that? Similar too to being disconnected, I reconnect… Imagine having to do this 20 or times in just one sitting… Aint it frustrating?

Read on …

Lovesan : (see the figure first)

Ok, Let us see what we have here. There are three (3) windows open now, [1] the NETWORK ATTACK, [2] command prompt with the “ipconfig” command, and [3] the Kaspersky Anti-Virus logs of NETWORK ATTACKS.

[1] the Network attack – Oh my God, I am being attacked by Lovesan virus… ok, read it carefully, I am the one being attacked… not the other around.. In this instance, it came from the ip address of 58.69.182.102. This occurs every time i connect and after a few seconds or minutes, this will pop-up plus a horrfying shriek from Kaspersky… At first I just click that “Do not show this message again during this session” to make it quiet… But when I tried to check the logs, there are so many attacks in just one session.

Session – To kaspersky, one session is from start-up of the computer till you shut it off.

[2] this is my acquired Dynamic IP ADDRESS as of connecting earlier… I know the difference between STATIC IP ADDRESS and DYNAMIC IP ADDRESS (will rant about pldt’s crap support later) So for referrence, MY ACQUIRED DYNAMIC ADDRESS WAS 58.69.35.36 ….

Dynamic IP Address – An IP address that is assigned to a computer using DHCP. This IP address may change each time the computer connects to the network or even during the course of a network connection. (Surpac)
Static IP Address – A static IP address is where a computer uses the same address every time one logs on to the Internet. (Wikepedia)

[3] the logs, as you can see… PORT 135 is the target of the virus. The IP Address there is different than the one the alert showed me. That would mean that, the virus has spread and not only 1 has the lovesan (msblast) virus and is attacking others (like me).

So today, we called PLDT DSL … I want to report on my frequent disconnection and about this lovesan virus to them (PLDT MYDSL). So there I was, talking to a Guy and he was asking me for details and I was answering them…

For my frequent disconnection, some of the questions are the following: (I cant remember them word by word, ok?)

• What is your operating system? XP 
• Is the dsl modem on? Yes
• Are the lights of the dsl modem on? Yes, there are 3, the DSL, LAN and Power.
• Is the dsl currently in use by one pc? Yes, I connected it to my PC only.
• Does your phone have an extention? No.
• What time does your connection have this problem? Everytime I connect, from morning to evening.
• After how many minutes do you get disconnected? It is random.
• and so on…

So after a while of asking these simple questions, he told me that he would check this and they would make a report on it. Then I continued to tell him about this LOVESAN VIRUS (which I think was a big mistake) …. There I got his attention and I told him that everytime I connect I am being attacked by a network user because of LOVESAN. I said that this was reported in my logs (Kaspersky’s logs). Then guess what he told me? He told me that I should go to a private technician to have my pc checked since it has a virus. WHAT THE HELL!?!?! Can’t he understand Filipino language? Errr …..so I tried again, this time giving more details. I said, my dynamic IP address is 58.69.35.36 and the attacker’s dynamic ip address was 58.69.182.102. Then he started to explain to me that everytime I connect to their system, I am given a dynamic IP address (I already know that!!!) … So I was thinking, so what is his point? I told him my ip address and the attacker’s IP is different, but still he insisted that I should have my computer checked since it might be the reason for my frequent disconnection. I was like, WHAT THE HELL!?!?!, so I still continued to point out that I AM THE ONE BEING ATTACKED AND I DONT HAVE THE VIRUS … Still he started to explain about the dynamic ip addresses, and that they have no viruses in their network, and I should have my pc check by a private technician…. d4mN n00bz …. Why cant he get my point? Since if he admits it, it would mean they have a problem… So their solution is, WE DONT HAVE A PROBLEM, HELL WE DONT EVEN KNOW WHAT THEY ARE TALKING ABOUT SO IT IS THE PROBLEM OF THE CLIENT!!!!

anyways, after that, the connection got static blah blah and it got disconnected… I am pissed off by their pathetic support… I wasted my time to get a lecture on dynamic ip address… I dont think he(mydsl support guy) even knows the difference between BEING ATTACKED and BEING THE ONE ATTACKING. So I tried again, all i wanted is for just one of their technician to come here and see my logs so that they can understand what I am talking about!!! … ok , so I called them again now its a lady…. I was expecting something different but…. well, if you want to know what happened, basically, only the voice on the other side of the phone was different… but the questions, the lecture on dynamic ip address was still the same… After a non assuring chat, I hung the phone…. more frustrated than ever…

So what do i do now? nothing… rot… and hopefully someone from their support side will come here… bwahhah WISHFUL THINKING…

I guess I learn one of their rules, “If you dont know anything about what the client is talking about, then automatically conclude that the problem lies is in the client’s side.”

End of Rant!!!