Compromised Computers

[Giles102]

Hello, I'm a student at BCU studying Computer Forensic.

For one of my coursework I have to research into want ISP do when customers computers become compromised (Viruses, Malware, Adware) and want they should do. To do this I need to look on forums to seek advice from professionals and user who may know about want they do.

So can anyone tell me want they do? and want you think they should do?

Any information would be great , thanks Giles102.

 

[Mark.J]

I think your best bet is to contact the big ISPs like BT, Virgin Media and maybe also get some insight from smaller providers like AAISP and Zen Internet; both are quite technically minded and should be able to offer a more viable insight for coursework stuff.

We know that Virgin Media have, in the past, suspended some connections and or contacted customers to warn them above compromised computers. However there are many problems and complications, not least with detection, which can make it hard to take action.

 

[LeeH]

Hello, I'm a student at BCU studying Computer Forensic.

For one of my coursework I have to research into want ISP do when customers computers become compromised (Viruses, Malware, Adware) and want they should do. To do this I need to look on forums to seek advice from professionals and user who may know about want they do.

So can anyone tell me want they do? and want you think they should do?

Any information would be great , thanks Giles102.

I know we actively do this so if you want to pm me for my email address feel free to and I will pass your request on to the relivent people.

 

[Giles102]

Thanks for your replies. I know a friend who going to book an appointment with a BT tech so that should be great, just wanted to see want other help I can get out there.

Cheers Alan

 

[Mark.J]

By the way it would be fun to let us know what you learn afterwards as this is an interesting topic.

 

[Captain_Cretin]

And do not rely on spell checkers for your essay, there are several incorrect (but correctly spelt) words in your opening post.
(been there, done that).

 

[Giles102]

I be happy to let you know. I have untill march to get it done.
O spell checker my life line , i cant spell at all.

And if anyone else has any information or you know anyone that can help, if you don't mind will you let me know.

Thanks Alan

 

[Glovepup]

I used to work for an ISP and during my time there the abuse department was well just there, it did a role but no one really gave a damn about it. They would deal with the notifications that thet recieved from various bodies about illegal filesharing and so forth.

Over time it got more involved and more recognition of the role it played within the company, I for one got involved at some point as they were trying to better understand how to deal with compromised machines and other threats to the network.

The networks team had a big part to play in this. They had always had a 3 strike rule for customers, it surprised me when the news made a big deal about this but I am sure they were not the only ISP to have already have that kind of system in place.

I do have contacts back at my old work place, I'll touch base with him and see if he can spare some time for you. Don't hold your breath though, he can be bit of a moody git at times and very busy.

 

[Giles102]

Hi if any of you still have any information or help you can give me, then please do.

I'm looking for information about how ISP detect if customers computers do have virus?

I would also like information about scripts they use to detect Spam?

Thanks Giles102

 

[Mark.J]

I think one ISP told us that they only really detect compromised computers through third party information from traffic that has left their network, such as spam block lists or others reporting compromised computers back to them. Sadly you usually have to be sending out a lot of viruses or spam for that to work.

 

[Giles102]

Just to keep you updated, been awhile i got 85% for my project turns out that ISP don't really do that mush :smilet:

 

[LeeH]

Did our service support team leader or support manager get back to you on this?

 

[Giles102]

Nop. I emailed the people. But no reply. O well. Cheers anyways mate

 

[LeeH]

Nop. I emailed the people. But no reply. O well. Cheers anyways mate

Do you still need the info or is it too late now? I will chase it up again for you if needed.

 

[truth4free]

What they do ISP to ISP i suspect will vary....

What i think they should do....... Nothing.

I could not care less if every other customer of my ISP has a computer infested with poopware, just as long as mine is not, which it isn't

 

[sentup.custard]

Hmmm... I will, of course, bow to the superior knowledge of the various ISP reps if they tell me I'm talking twaddle, but...

While I do think that it's basically the responsibility of the customer, not the ISP, to ensure that their machine is clean, I would think that if every other customer of your ISP had an infected PC, there is a possibility that the massive amount of endless garbage they'd be spewing out could well clog up the network to the extent that *your* service would be affected.
Personally, I think it's in everyone's interest to kill the stuff, and if you're aware of someone gullible who has swallowed the bait and had something nasty dumped on them without realising it, it's not a bad idea to let them know, and if they a little on the clueless side (which, if their PC is infected and they didn't realise, is quite likely) point them in the right direction for getting rid of it.

 

[truth4free]

Hmmm... I will, of course, bow to the superior knowledge of the various ISP reps if they tell me I'm talking twaddle, but...

While I do think that it's basically the responsibility of the customer, not the ISP, to ensure that their machine is clean, I would think that if every other customer of your ISP had an infected PC, there is a possibility that the massive amount of endless garbage they'd be spewing out could well clog up the network to the extent that *your* service would be affected.

In speed terms for the users then yep it could affect the people who are NOT infected, the zombie computers would likely be constantly trying to spread their poop and thus eventually congest the network.

However thats another matter and discussion entirely now, and id file any action an ISP takes over that as protecting THEIR product and service not the sheep that got infected.

Personally, I think it's in everyone's interest to kill the stuff, and if you're aware of someone gullible who has swallowed the bait and had something nasty dumped on them without realising it, it's not a bad idea to let them know, and if they a little on the clueless side (which, if their PC is infected and they didn't realise, is quite likely) point them in the right direction for getting rid of it.

Agreed if you have a friend or family member and they need help or educating they have a rogue zombie infected machine then steer them in the right direction. Don't see why an ISP should have to do that though or have systems in place to stop the sheep and zombie machine....... Extra expense that makes the service for people with common sense more expensive in the long haul.

 

[Giles102]

Nar it to late now mate cheers anyways.
And yer i think the same in the end of the day ISP give you the internet connection, it should be up to the person how they deal with the spam etc.. if you buy a car u don't expect the dealer to stop you from crashing.
2bh all i found out was that most ISP block a number of ports and that they use filters to block packets etc..
They only really help customers if they are business
Cheers to you all for your help, most forums just ignore you or except you to already know it.

 

[Giles102]

Hi Guys,

I've created a torrent tracker server for my final year porject at university.

The website is in the beta stage

Could you try it out for me, add some of ur own torents and download some ect.. Comment on any ideas you have or any trouble you may be having.

www.torrentchain.com

Cheers Alan

 

[truth4free]

Ill try your tracker when im at a wifi hotspot next, you can harvest that IP instead