Community discussions

MikroTik App
 
rooter1234
just joined
Topic Author
Posts: 7
Joined: Mon Jun 16, 2008 5:48 pm

How to stop mac address spoofing...by viruses.

Thu Jul 03, 2008 12:01 am

Im trying to stop this but no success , I need your help to stop this.
On this example you see 7 computers on LAN network, watch what hapend with ARP, last Same hapend in wireless clients. i need to find name of virus or some filter rule to stop this.
Im in trouble :S...

0 D 192.168.1.2 00:04:75:4E:B9:73 ether2
1 D 192.168.1.3 00:04:75:4E:B9:73 ether2
2 D 192.168.1.4 00:04:75:4E:B9:73 ether2
3 D 192.168.1.5 00:04:75:4E:B9:73 ether2
4 D 192.168.1.6 00:04:75:4E:B9:73 ether2
5 D 192.168.1.8 00:04:75:4E:B9:73 ether2
6 D 192.168.1.9 00:04:75:4E:B9:73 ether2
 
User avatar
jwcn
Forum Guru
Forum Guru
Posts: 1501
Joined: Sun Aug 27, 2006 6:49 am
Location: Maryland, USA
Contact:

Re: How to stop mac address spoofing...by viruses.

Fri Jul 04, 2008 3:26 pm

Use PPPoE
 
rajeshrouthu
newbie
Posts: 43
Joined: Sun Jun 22, 2008 10:30 am

Re: How to stop mac address spoofing...by viruses.

Sat Jul 05, 2008 10:11 pm

i am also suffered this problem ...it's a malware virus try antiarp.exe..when u install this software on your client computer it can communicate only gateway,so other computer cant resolve mac address...try this..
Regards,
Raj
 
User avatar
Giepie
Member
Member
Posts: 432
Joined: Mon Sep 13, 2004 12:33 pm
Location: Western Cape, South Africa
Contact:

Re: How to stop mac address spoofing...by viruses.

Sun Jul 06, 2008 9:12 am

Hi

I agree with jwcn, rather use PPPoE. This kind of problem needs to be illiminated from the ISP side. You can't expect all your clients to run 3d party software, unless you have very few clients maybe.
The only thing Mikrotik lack, is to send power to your High Sites wirelessly.....
 
rooter1234
just joined
Topic Author
Posts: 7
Joined: Mon Jun 16, 2008 5:48 pm

Re: How to stop mac address spoofing...by viruses.

Fri Jul 11, 2008 11:40 pm

I have posted an example from internet caffe where are connected 10 pc's on LAN, At the wireless network i have 120 clients , the problem persists mostly on LAN because i have secured wireless AP's i have no problem on wireless.
what i need to discover : How works this virus, name, location etc. Because in future comes and to you;I was scanned pc's with the best antiviruses and nothing yet. we can do somthing together to reslove this stupid virus because its to hard to find it, i have no idea.
 
mh7
just joined
Posts: 13
Joined: Fri Jul 11, 2008 6:13 pm
Location: Poland

Re: How to stop mac address spoofing...by viruses.

Sat Jul 12, 2008 1:34 am

I had 20 computers infected with this wirus (in my LAN network)... my RB600 and another routerboard devices gone crazy when this wirus working - becouse computers connected to the main gateway "thoguht" that the main MAC address of the gateway is the MAC of computer which is infected with that wirus - MAC address of the gateway interface didn't exist :/ . When i discover that MAC adres masking my routerboard devices and another computers (wirus is working) I'm disconnecting it from network and the problem is disappearing (people with this wirus have to reinstall windows...)

/sorry for my english/
 
alternativi_boy
Frequent Visitor
Frequent Visitor
Posts: 53
Joined: Tue Apr 01, 2008 8:39 pm

Re: How to stop mac address spoofing...by viruses.

Sat Jul 12, 2008 11:31 am

try static arp, and the interface client make ARP reply- only ..it will work:D:D
 
rooter1234
just joined
Topic Author
Posts: 7
Joined: Mon Jun 16, 2008 5:48 pm

Re: How to stop mac address spoofing...by viruses.

Sun Jul 13, 2008 10:00 pm

try static arp, and the interface client make ARP reply- only ..it will work:D:D
I know that and allready i done this before but im curious to find this stupid virus.
 
User avatar
Giepie
Member
Member
Posts: 432
Joined: Mon Sep 13, 2004 12:33 pm
Location: Western Cape, South Africa
Contact:

Re: How to stop mac address spoofing...by viruses.

Sun Jul 13, 2008 10:31 pm

If you really wish to find the virus, I might have a good suggestion.

If not already using the world's best antivirus (Avast), install it on a PC connected to the backend of your network (ie, the PC is not behind it's own NAT firewall or something). Disable al Windows firewalls on that PC so the there's nothing blocking the wurm.

Make sure Avast is set to defaults, as the defaults will enable the network shield. The network shield will notify you immediately when a worm or the like is trying to copy itself to that PC. Avast free Home edition is more than enough for this purpose.

You could also setup Avast notifications so Avast will MSN or Mail each and every threat to you. Avast will also tell you what kind of virus/worm is infecting your PC (TRJ, WRM etc where TRJ is a trojan, WRM is a worm etc).

90% of our clients are now running Avast, and such problems are really limited.
The only thing Mikrotik lack, is to send power to your High Sites wirelessly.....
 
rajeshrouthu
newbie
Posts: 43
Joined: Sun Jun 22, 2008 10:30 am

Re: How to stop mac address spoofing...by viruses.

Mon Aug 04, 2008 11:32 am

to stop mac virus n find infected clients with antiarp
You do not have the required permissions to view the files attached to this post.
Regards,
Raj
 
User avatar
balimore
Forum Veteran
Forum Veteran
Posts: 892
Joined: Mon Apr 10, 2006 3:38 am

Re: How to stop mac address spoofing...by viruses.

Mon Aug 04, 2008 2:07 pm

-----
yup . . yup . . , hello friends

as far as i understood, unwanted files or programs . . . . will comming everytime and anywhere with new technologies. . . . :wink:
i never think about it. and i think this link same problem http://forum.mikrotik.com/viewtopic.php?f=13&t=22822

regards
Hasbullah.com
-----

Who is online

Users browsing this forum: anav, Bing [Bot], dchepishev, Jez, lozio84, sindy, Urajmal and 170 guests