[gentoo-user] Strange traffic says I am using windoze and have a bug.

[Dale]

Hi guys, and Holly,  :D

I'm on dial-up and try to watch my traffic and every once in a while I 
see a little blip on gkrellm.  I fired up ethreal and started to sniff 
around.  Parden the pun there.  LOL  This is what it says though which 
is strange.  It's really the last two lines that matter but I am putting 
the whole thing here just in case.  Sorry so long.

> No.     Time        Source                Destination
> Protocol Info
>       1 0.000000    215.146.157.191       205.208.159.31
> Messenger NetrSendMessage request
>
> Frame 1 (710 bytes on wire, 710 bytes captured)
>     Arrival Time: Dec 25, 2005 22:50:19.101533000
>     Time delta from previous packet: 0.000000000 seconds
>     Time since reference or first frame: 0.000000000 seconds
>     Frame Number: 1
>     Packet Length: 710 bytes
>     Capture Length: 710 bytes
>     Protocols in frame: sll:ip:udp:dcerpc
> Linux cooked capture
>     Packet type: Unicast to us (0)
>     Link-layer address type: 512
>     Link-layer address length: 0
>     Source: <MISSING>
>     Protocol: IP (0x0800)
> Internet Protocol, Src: 215.146.157.191 (215.146.157.191), Dst:
> 205.208.159.31 (205.208.159.31)
>     Version: 4
>     Header length: 20 bytes
>     Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
>         0000 00.. = Differentiated Services Codepoint: Default (0x00)
>         .... ..0. = ECN-Capable Transport (ECT): 0
>         .... ...0 = ECN-CE: 0
>     Total Length: 694
>     Identification: 0x7411 (29713)
>     Flags: 0x00
>         0... = Reserved bit: Not set
>         .0.. = Don't fragment: Not set
>         ..0. = More fragments: Not set
>     Fragment offset: 0
>     Time to live: 53
>     Protocol: UDP (0x11)
>     Header checksum: 0x2ce4 [correct]
>         Good: True
>         Bad : False
>     Source: 215.146.157.191 (215.146.157.191)
>     Destination: 205.208.159.31 (205.208.159.31)
> User Datagram Protocol, Src Port: 44356 (44356), Dst Port: 1026 (1026)
>     Source port: 44356 (44356)
>     Destination port: 1026 (1026)
>     Length: 674
>     Checksum: 0x0000 (none)
> DCE RPC Request, Seq: 0, Serial: 0, Frag: 0, FragLen: 583
>     Version: 4
>     Packet type: Request (0)
>     Flags1: 0x78 "Broadcast" "Idempotent" "Maybe" "No Fack"
>         0... .... = Reserved: Not set
>         .1.. .... = Broadcast: Set
>         ..1. .... = Idempotent: Set
>         ...1 .... = Maybe: Set
>         .... 1... = No Fack: Set
>         .... .0.. = Fragment: Not set
>         .... ..0. = Last Fragment: Not set
>         .... ...0 = Reserved: Not set
>     Flags2: 0x00
>         0... .... = Reserved: Not set
>         .0.. .... = Reserved: Not set
>         ..0. .... = Reserved: Not set
>         ...0 .... = Reserved: Not set
>         .... 0... = Reserved: Not set
>         .... .0.. = Reserved: Not set
>         .... ..0. = Cancel Pending: Not set
>         .... ...0 = Reserved: Not set
>     Data Representation: 100000 (Order: Little-endian, Char: ASCII,
> Float: IEEE)
>         Byte order: Little-endian (1)
>         Character: ASCII (0)
>         Floating-point: IEEE (0)
>     Serial High: 0x00
>     Object UUID: 00000000-0000-0000-0000-000000000000
>     Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
>     Activity: 00000000-0000-0000-0000-000000000000
>     Server boot time: Unknown (0)
>     Interface Ver: 1
>     Sequence num: 0
>     Opnum: 0
>     Interface Hint: 0xffff
>     Activity Hint: 0xffff
>     Fragment len: 583
>     Fragment num: 0
>     Auth proto: None (0)
>     Serial Low: 0x00
>     Authentication verifier
> Microsoft Messenger Service, NetrSendMessage
>     Operation: NetrSendMessage (0)
>     Server
>         Max Count: 10
>         Offset: 0
>         Actual Count: 10
>         Server: Microsoft
>     Client
>         Max Count: 35
>         Offset: 0
>         Actual Count: 35
>         Client: inform you about a virus detection
>     Message
>         Max Count: 497
>         Offset: 0
>         Actual Count: 497
>         Message [truncated]: Windows has detected a virus on your
> system. In order to remove it please follow this steps:\n\n1. Start
> Microsoft Internet Explorer or your default web browser.\n2. Type into
> the navigation bar: http://www.cleanmyreg.


What is this?  Is this some spam and it pops up a window if I were using 
windoze?  I went to the site and it looks like they want to sell 
something, which I ain't buying by the way.  ;-)   How can I tell them 
to stop this?  Oh, only my main rig does this.  My three servers which 
have no GUI stuff or browsers installed do not get this, that I can see 
anyway.

Another thing a bit off topic.  I noticed earlier that there was a post 
in some foreign language, looked like Japaneese or Chinese and looked 
like spam to me.  Later I got one in my personal email.  Can someone get 
my email address from this list?  I have got a few emails from people, 
which is OK as long as it is not spam.  Just curious.  I like the list 
but I didn't know my private email would become public, if this is true.

Thanks for any light you can shed on this.

Dale
:-)

-- 
To err is human, I'm most certainly human.

I have four rigs:

1:  Home built; Abit NF7 ver 2.0 w/ AMD 2500+ CPU, 1GB of ram and right now two 80GB hard drives.
2:  Home built; Iwill KK266-R w/ AMD 1GHz CPU, 256MBs of ram and a 4GB drive.
3:  Home built; Gigabyte GA-71XE4 w/ 800MHz CPU, 128MBs of ram and a 2.5GB drive.
4:  Compaq Proliant 6000 Server w/ Quad 200MHz CPUs, 128MBs of ram and a 4.3GB SCSI drive.

All run Gentoo Linux, all run folding. #1 is my desktop, 2, 3, and 4 are set up as servers.  

-- 
gentoo-user@g.o mailing list