| Pages: [1] 2 :: one page |
| Author |
Thread Statistics | Show CCP posts - 1 post(s) |
Nova Star
   |
Posted - 2003.08.19 15:29:00 -
[1]
While we are all moaning about the CTDs (yes believe me I am too) take some time and scan your systems for Blaster and Welchia viruses.
You know, W32.Blaster was not the only one that exploits the RPC (port 135) vulnerability. W32.Welchia was discovered after that and it (although it tries to clean Blast away) also causes network lag.
I suggest that all the players (I just did, no viruses) run the following programs. Also the EVE SERVER ADMINS should run them since I have my fears (as do many other players) that the server is infected by these bastards. Besides, if the server is clean it still never hurts to be sure.
So Symantec has provided two tools to check for W32.Blast/Welchia:
W32.Welchia: http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
W32.Blaster: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
Btw, I have many friends who had this even they were running firewalls and virus scanners. They also complained about huge network lag in MMO games. In one case one machine in my company was infected even it has been running behind the COMPANY hardware firewall...
This might not solve it but as I said, it does not hurt to check your computers.
--- Director of Ni ---
Your mother was a hamster and your father smelled of elderberries!
|
Xamand
|
Posted - 2003.08.19 15:35:00 -
[2]
The default settings on most firewalls to my knowledge won't stop the rpc exploit through port 135.
I think this is the case, though I may be wrong
The best thing to do is to ensure that your OSs especially XP are fully up to date with all the latest security patches and updates
Xamand
CEO
Cirrius Technologies |
Joshua Calvert
|
Posted - 2003.08.19 15:36:00 -
[3]
Well, I followed the advice of agrizla and closed all incoming ports 0-1024.
XP was already updated and so far I've had no sign of either worm.
I just ran both tools.
LEEEEERRRRRRRRRRROOOOOOOOOYYYYYYYYYYYYYYY! |
Nova Star
|
Posted - 2003.08.19 15:37:00 -
[4]
Yeah, as I said it might not solve the problem. One of my friends had huge lag in Dark Age of Camelot. He ran the WElchia scanner and it found (and removed) the virus. After that no lag.
So it does not hurt atleast to check the systems :)
Maybe the servers are infected :)
--- Director of Ni ---
Your mother was a hamster and your father smelled of elderberries!
|
Jash Illian
|
Posted - 2003.08.19 15:38:00 -
[5]
Not necessary. The computers I play Eve on also receive the emails from my company's public email addresses.
As such, my systems run a full scan nightly and the virus definitions are checked daily.
My systems also run a full, continuous defrag from 4am to 7am daily, the drivers are updated usually within 1-2 weeks of release (dependant on reports of performance/stability/need), all security fixes and updates from MS and there's a small pagan altar on my desk just incase all of that fails to work.
And no, I'm not running logserver nor lifting a finger to send in 1 bit of data. That's their tough luck
I mean its like you want corporations to oblige each other like its sex or something. Pffft I would rather **** my enemy.- Rohann
Be careful out there. That other guy waiting in the queue for the gate MIGHT be a baby-munching frock-burner, YOU JUST DON'T KNOW!- Lallante |
Joshua Calvert
|
Posted - 2003.08.19 15:40:00 -
[6]
I just ran the Welchia tool again and it deleted 1 file!
Does that mean I had the Welchia worm or was it suspicious?
LEEEEERRRRRRRRRRROOOOOOOOOYYYYYYYYYYYYYYY! |
Nova Star
|
Posted - 2003.08.19 15:41:00 -
[7]
Edited by: Nova Star on 19/08/2003 15:41:36
Read the log file in the same directory as your welchia scanner tool. If it deletes something I believe you had the virus.
For me the Blaster and Welchia scanners log file states:
W32.Welchia.Worm has not been found on your computer.
W32.Blaster.Worm has not been found on your computer.
--- Director of Ni ---
Your mother was a hamster and your father smelled of elderberries!
|
Joshua Calvert
|
Posted - 2003.08.19 15:44:00 -
[8]
Phew!
Ran it a third time and it didn't pick anything up.
I wonder why my 2nd run picked something up?
Wierd.
Now for Blaster.
LEEEEERRRRRRRRRRROOOOOOOOOYYYYYYYYYYYYYYY! |
Gan Howorth
|
Posted - 2003.08.19 15:47:00 -
[9]
Also, latest virus alert from symantec W32.Sobig.f@mm
News just in so to speak....
|
Orestes
|
Posted - 2003.08.19 16:19:00 -
[10]
I'm giving this a sticky.
After checking for and removing Welchia, my EvE doesn't CTD anymore.
Thanks Nova Star!
Join the IC! |
Indesin
|
Posted - 2003.08.19 16:32:00 -
[11]
LOL. I only wish the CTD's were caused by something as simple as one of these worms.
I only wish.
It's a nice try to blame it on the worm fiasco, but I seriously doubt this is the case. It would be nice if it was, because fixing it would be easy as a-b-c 1-2-3.
|
Viceroy
|
Posted - 2003.08.19 16:32:00 -
[12]
Can i have a battleship if i optimize your internet connection for 2x better speed? 
-
|
t00r
|
Posted - 2003.08.19 16:47:00 -
[13]
Every 10 mins i am CTD'ing, the lag is astronimical, imo the cluster cant handle the amount of ppl on it, the database is forever going down, Weapons, mods droners are unresponsive, im unable to turn on/off guns/modules a lot of the time, it takes me at least 20-30 seconds somedays to move 1 thing from 1 hanger to another. Could someone please help me further understand why this is happening.
Thank you.
If i added up all the time i have lost due to server faults it would be a lot of time.. imo, u should give all ever players at least 1 free month beacuse its sucking. Oh.. maybe i should clear my cache?
>There's a thread about this. Please add your comments to that one.
Check the sticky on top of the page too, killing Welchia might help<
Sorry i dont have the virus, i checked with the tools anyway just to humour u. Please dont lock out my topic without giving me some decent answers or until 'MY' support matter is resolved.
>The cluster is fine and has handled many more people than its had on it lately without nearly as many CTD's.<
Who the blazes r u? Who cares? Then why is it so bad now then? Sorry i have to disagree with u there, everyone i have spoken too is having real bad problems with more and more ctd's & server nodes going offline, please admit, its starting to get annoying.
Another thing, why lock my post? How come some other 'person' can reply. Whats going on?
I 'DONT' have a virus .. and i 'DO' have a well looked after system. There is 'NOTHING' wrong with my system. Why wont someone for once be honest & own up to stuff. Ive asked GM's for answer before & i ahve to laff, when all i get is.. ' Have u cleared ur cache? " I asked a GM about the "known" capacitor bug which became apparent in the last patch, i was told.. "clear ur cache" LOL... cmon ppl, im not a bad person just asking for "SUPPORT" now am i.
|
Nova Star
|
Posted - 2003.08.19 17:03:00 -
[14]
Well, I scanned my Eve computer and no Welchia or Blaster, but my laptop had it (both in the same network with Internet connection).
However, my Eve is still CTDing. 3 times now during last 30 minutes.
--- Director of Ni ---
Your mother was a hamster and your father smelled of elderberries!
|
Nova Star
|
Posted - 2003.08.19 17:11:00 -
[15]
I understand that it might not be so simple that a worm in your computer would affect this much and cause lag on your side. However, SIMPLE WORM like these can cause this kind of problems if thousands of computers are affected by it.
The fact is that Eve is unplayable now. And hopefully a fix is found sooner than never. However, the first step is to scan your own computers. Even my laptop was infected with Welchia even I have a firewall, updated viruscanner and NAT router!
--- Director of Ni ---
Your mother was a hamster and your father smelled of elderberries!
|
Erty
|
Posted - 2003.08.19 17:41:00 -
[16]
Edited by: Erty on 19/08/2003 17:48:50
t00r the servers can handle the players perfectly well. If this isn't something with the whole internet it's a server side issue. But that doesn't mean that the servers (the hardware and the connection) can't handle the players. It means that there's a bug or something like that, or that something in the software is messed up.
This is my signature. |
Drefsab
|
Posted - 2003.08.19 17:45:00 -
[17]
Add another to the no virus but still CTDing all the time list. Just a note I get my CTD's when selecting a station to warp to.
"Death Before Dishonor" |
Erty
|
Posted - 2003.08.19 17:51:00 -
[18]
"[19:50:14] *** [#eve-online] topic- 'NEWS: Internet problems in London causing most of the CTD's "
From the IRC-channel.
This is my signature. |
t00r
|
Posted - 2003.08.19 18:08:00 -
[19]
 Quote:
Edited by: Erty on 19/08/2003 17:48:50
t00r the servers can handle the players perfectly well. If this isn't something with the whole internet it's a server side issue. But that doesn't mean that the servers (the hardware and the connection) can't handle the players. It means that there's a bug or something like that, or that something in the software is messed up.
Brilliant, thanks everso much for clearing that up for me. Im not talking about now this minute, im talking of all time. The servers rock with less that 3.5k ppl on, any more and lag issues seem to arise more often, this tells me theres traffic problem somewhere, therefore imo... the cluster cant handle the amount of data. I did not specify whether the problem was hardware/software related, i said 'cluster' meaning the item as a 'whole'. There 'should' not be any internet lag because EVE is designed from the ground up as a massively Multi-Player Game, most of the game systems are devised to minimize network traffic and the effects of lag. This high level approach makes EVE relatively unaffected by Internet latency.
*most of the game systems are devised to minimize network traffic and the effects of lag*
Yeah, sure.
OT: Did u know that EVE is designed to run on a 33.6 Kbps modem.
-= Whatever happened to that design? =-
|
Melchar
|
Posted - 2003.08.19 18:15:00 -
[20]
Ran both tools, no virus's here but still CTD 3 times in 30 minutes, then to cap it off, stuck coming out of a station.
I think that the more people that run these tools will prove that it's not these virus's on peoples systems but either
a. Problem with a server (already hinted at elsewhere)
b. The latest patch is to blame, my own theory,before 1165 in 2 and a half months I had about 3 CTD's, since the patch, I get 3 CTD's in 30 mins
|
annoing
|
Posted - 2003.08.19 18:21:00 -
[21]
Found the Welchia virus so thx for that. Even though I update my anti-virus software every day this still got me.
Havent been able to get the Blaster tool though and even though i have patched from MS and my anti-virus software provider I cant help feeling paranoid that i might have this virus too
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
The Inquisition
Long live the Inquisition
Long live the Emperor
Long live Amarr!
>>>>>>>>>>>>>>>>>>>>>>>>>>>>> |
annoing
|
Posted - 2003.08.19 18:21:00 -
[22]
Edited by: annoing on 19/08/2003 18:21:56
ooops double post
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
The Inquisition
Long live the Inquisition
Long live the Emperor
Long live Amarr!
>>>>>>>>>>>>>>>>>>>>>>>>>>>>> |
Alpha
|
Posted - 2003.08.19 18:24:00 -
[23]
As a network admin, I have dealt with this biatch of a virus for the last few days patching and updating clients and servers the last few weeks,,, I would reccomend all users going to www.windowsupdate and downloading all the critical updates ASAP, which will fix the vulnerability, and also keep your damn viruscheckers up to date ;) both the mentioned viruses create a lot of network traffic, and could pssibly be causing all the CTD's or at least increasing the occurances of them....
I would think that CCP has already patched their servers (well i hope so) so take care fellow EVE'rs and see you all ingame when things return to normal ;)
|
Alpha
|
Posted - 2003.08.19 18:28:00 -
[24]
that url shoulda been
www.windowsupdate.com
|
Roulette
|
Posted - 2003.08.19 18:42:00 -
[25]
Quote:
As a network admin, I have dealt with this biatch of a virus for the last few days patching and updating clients and servers the last few weeks,,,
Quote:
that url shoulda been
www.windowsupdate.com
A *real* network admin who has been dealing with this 'virus' would know that www.windowsupdate.com was a target of the worm and has been disabled by microsoft for a number of days now..
the correct URL is http://windowsupdate.microsoft.com/
BTW, In-game Polaris has verified that CCP realizes this is a server-side problem and they're apparently working to fix it... Shame on the Polaris members here on the forum contributing to the FUD about "viruses" causing all these CTDs
|
Alpha
|
Posted - 2003.08.19 18:43:00 -
[26]
incorrect Roulette,, the site redirects anyway,,, well, at least it does from the UK... ive been using it all day
|
Alpha
|
Posted - 2003.08.19 18:45:00 -
[27]
lol actually my appoligies,,, ;) just checked it and you are correct ;) but there is still a link to the site ;) heh better watch out,, u'll be after my job soon ;)
|
t00r
|
Posted - 2003.08.19 18:45:00 -
[28]
Nice inputs, i also dont think that the crashes/node drops are anything to do with our hardware/drivers when playing the game. My theorey behind this is... i use an eve monitor to tell me if i have a connection to the server or not. Now since my ctd's/node drops earlier, i havnt been playing cause its useless, yet... the monitor has flagged 2 connection losses in the past 10-15 minutes.
nothing to prove, just additional info. |
NeoMorph
|
Posted - 2003.08.19 18:56:00 -
[29]
I dont think these CTDs are anything to do with your client... it's all down to the lousy packet loss at CCPs end... it's looking more and more like a duff router.
Network Status Graph
As you can see the last hop is causing a 23% loss of traffic which will cause the problems you are seeing.
-------------------------------------------
<Stavros> the first motor bike i ever rode
<Stavros> was a honda gold wing
<Ak-Gara> hah
<Stavros> |
Tabitha Delzoun
|
Posted - 2003.08.19 19:41:00 -
[30]
I found the welchie worm, removed, but still CTD.
Thanks though as at least I removed the worm.
Tab.
'Now if that doesn't prove I'm a bird I don't know what does lol'
|
| |
|
| Pages: [1] 2 :: one page |
| First page | Previous page | Next page | Last page |