computer question

[gimp]

All right, my friend keeps getting this error message on her computer. I think it happens every time she tries to access the internet. A message says 'Socket error #1104' She says the message keeps popping up. I think she's using windows 98. The problem started when she went to a link on the internet it was something like http://xxx.xxx.xxx.xxx:xxxx Any clue what this might be?

[FordPrefect]

Maybe some connection isn't working well somewhere in the electrics...

[boss_automager]

Probaly a link to a virus which downloaded onto her computer when she visited the site.

[gimp]

that's what she thought. I thought it was some stupid thing that just changed a setting somewhere. I just can't figure out where it is.

[SlipknotX556]

WHAT! thats the exact same error I have sometimes. But I have alot more errors then anyone. If the ThePatriot sees this post he might be able to help. Hes a computer freak.

[MiCRoFooL]

http://xxx.xxx.xxx...

what, were you kids lookin for porn or somethin?

[lopxtc]

Well a socket error, if used in the normal sense, means that her computer is having trouble making a connection to the other. A socket is nothing more then the port on the other computer that your computer tries to connect to so they can talk. Example, when you visit any almost any webpage you are trying to connect to port 80, whose socket would looklike http://page.youareconnection.to:80 <-- note the 80 after the colon. What could be happening is that either that socket is busy and cannot accept anymore connections, or that the computer you are connecting to is denying or stopping any connections to that port.
I would doubt this is a virus or something like that, unless we are dealing with w trojan horse or worm that is trying to make a connection through your web browser whenever you try anything. Its possible.

Judging by the fact that you actually include the port portion of the url on your xxx example, I am guessing that you were trying to target a specific port??? If you want to share which port # that was I can try to help you more.


Anyone want to venture another guess?

Aaron

[gimp]

ah geez, she doesn't remember the number, she says she's pretty sure it started with 81 though. I'll try to get more information. Man, I used to know all these network things. Did you get your CCNA? Cause I almost got that about a year ago.

[lopxtc]

No I am a Unix System and Network geek ... I hold two linux certifications and I am currently working on a Solaris Certification.

Aaron

[ThePatriot]

Well, hopefully you could help me later there lopxtc, i am dl'ing some slackware linux as we speak(total linux n00b) and would really like to get into it more. Maybe you could say if slackware is good or bad? I was going to get FreeBSD maybe, but i have heard things about slackware's easyness, also i am not sure as to what to do with the files once i dl them(about 650 megs each.) I think i am supposed to burn them onto CD's, some more clarification would be nice, ANYWAY.

Gimp, perhaps...did she recently install a firewall or something like that? Because i have known firewalls that block off EVERY PORT, so nothing, i mean nothing can get into your computer, even a website trying to send you information. The other case could be a trojan that is currently occupying that port, so she cannot use it, question is, is it only webpages? Like does other online stuff work, perhaps downloading things? Because if only internet explorer wont work, its probably something i mentioned, but i could be VERY wrong.

*EDIT* ANy responses to the questions i asked can be put in the *nix thread in the friendly corner, thnx..

[Zumina]

s

[gimp]

http://whoops, this is bad That was the link she clicked on, and she says thats when she started having problems. Every time she uses AIM, it automatically sends the link to people.

[lopxtc]

Worm!!!

Its a well known worm, once you said the port I pretty much figured it.

Details;

http://vil.nai.com/vil/content/v_99437.htm

Aaron

[dave_p]

crap lopxtc, you beat me to it!!!

1 55 ms 14 ms 14 ms 10.186.128.1
2 14 ms <10 ms 14 ms r1-fe6-1.bb.nrwlct.cv.net [167.206.254.65]
3 14 ms 13 ms 42 ms r2-pos8-0-622M.bb.hcvlny.cv.net [167.206.108.241
]
4 14 ms 14 ms 69 ms r1-ge11-0.in.hcvlny.cv.net [167.206.13.17]
5 55 ms 55 ms 14 ms sl-gw27-nyc-9-0.sprintlink.net [144.223.37.233]

6 14 ms 27 ms 14 ms sl-bb23-nyc-15-1.sprintlink.net [144.232.7.21]
7 14 ms 68 ms 14 ms sl-bb21-nyc-8-0.sprintlink.net [144.232.7.110]
8 69 ms 14 ms 13 ms pos4-3-622M.br2.NYC2.gblx.net [208.51.134.25]
9 14 ms 55 ms 27 ms pos3-0-2488M.cr1.NYC2.gblx.net [208.48.234.189]

10 68 ms 28 ms 14 ms pos5-0-2488M.cr1.BOS1.gblx.net [64.212.165.130]

11 14 ms 27 ms 55 ms so1-0-0-622m.ar2.BOS1.gblx.net [206.132.247.70]

12 82 ms 110 ms 41 ms 208.51.142.110
13 55 ms 41 ms * 158.65.224.2
14 42 ms 123 ms 137 ms bluto.keene.edu [158.65.4.57]
15 41 ms 41 ms 55 ms core-g.keene.edu [158.65.5.20]
16 55 ms 27 ms 41 ms JGASCO [158.65.197.71]

Trace complete.

C:\WINDOWS>

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
JGASCO <00> UNIQUE Registered
USA <00> GROUP Registered
JGASCO <03> UNIQUE Registered

MAC Address = 00-04-76-B8-D3-5A

that is all the info i got so far about the origin,a whois on the domains turn up nothing here is what i found out about the port # http://osborne.com/virus_alert/ but lopxtc already got it, its a worm that serves itself from that port

[dave_p]

oh yeah, remove that link!!

now that we know