- Joined
- 28 May 2004
- Posts
- 10,841
- Reactions
- 5,195
Yes, changes have been made. I'd be interested in hearing from those who were previously having access difficulties.
Apparently ASF is one of a number of websites that has been under attack by a botnet for several months now. This poses absolutely no threat to any ASF user. However, our host has been blocking both the requests to ASF's server and the IP addresses sending them as they happen.
There is one of two reasons why people may have been blocked:
(1) You have downloaded an infected app or have browsed a web page that is infected and your PC has been compromised; or
(2) You are using dynamic IP addresses.
Apparently it can only be one of the two reasons above. I am not a technical person so I can only rely on information that is being conveyed to me by the host's techs.
This is directly from the host, word for word:
"Once a PC is infected you start sending "POST /?ptrxcz_xxxxxxxxxxxxx" to a bunch of different web servers. Most of them are decoys like ASF, but at least one is the real deal, and this is how the drones communicate with the hive. ptrxcz_ is how the drone identifies the request is for the hive, and everything after that is a message or command of some type. So all we are seeing is communication in one direction. We don't see what the hive is sending back to the drones."
If you are using dynamic IP addresses you may be blocked because someone who has used the same IP address has an infected PC that has been sending requests to ASF's server.
The reason access has been restored to those who were previously blocked is because the firewall table has been cleared out and has begun re-populating. Some of the host's tech's were not aware that this was occurring and this is why I was also unaware that IP addresses were being blocked.
This is an article that explains the situation further: http://www.theregister.co.uk/2012/09/19/pushdo_spews_fake_traffic/. In ASF's situation, it is not Pushdo but a variant on that botnet.
Apparently ASF is one of a number of websites that has been under attack by a botnet for several months now. This poses absolutely no threat to any ASF user. However, our host has been blocking both the requests to ASF's server and the IP addresses sending them as they happen.
There is one of two reasons why people may have been blocked:
(1) You have downloaded an infected app or have browsed a web page that is infected and your PC has been compromised; or
(2) You are using dynamic IP addresses.
Apparently it can only be one of the two reasons above. I am not a technical person so I can only rely on information that is being conveyed to me by the host's techs.
This is directly from the host, word for word:
"Once a PC is infected you start sending "POST /?ptrxcz_xxxxxxxxxxxxx" to a bunch of different web servers. Most of them are decoys like ASF, but at least one is the real deal, and this is how the drones communicate with the hive. ptrxcz_ is how the drone identifies the request is for the hive, and everything after that is a message or command of some type. So all we are seeing is communication in one direction. We don't see what the hive is sending back to the drones."
If you are using dynamic IP addresses you may be blocked because someone who has used the same IP address has an infected PC that has been sending requests to ASF's server.
The reason access has been restored to those who were previously blocked is because the firewall table has been cleared out and has begun re-populating. Some of the host's tech's were not aware that this was occurring and this is why I was also unaware that IP addresses were being blocked.
This is an article that explains the situation further: http://www.theregister.co.uk/2012/09/19/pushdo_spews_fake_traffic/. In ASF's situation, it is not Pushdo but a variant on that botnet.