Please Is there a way to stop the program netcut [INACTIVE]

[the.mummy_3]

Please Is there a way to stop the program netcut
please i need to help

[the.mummy_3]

where are you friends

[cmartin]

Be more specific, I cant understand what are you trying to do.

what is netcut? did you loaded it? where it runs?


[]'s

[El guapo Dan]

I think that netcut (at least is what google says) is a windows tool kit for arp spoofing...

But mummy, is some one in your network using it?
It is a wireless network?

More information can help us to help you...

[the.mummy_3]

This program is to cut off communication to the LAN users Is there a file can be added to brazilfw to prevent the work of this program

[the.mummy_3]

[bobbb]

An access rule will cut off the user but then he uses another IP/MAC or whatever.

BFW or any other router in the world knows nothing of what application is generating traffic.

This is obviously rogue software because arcai.com gets you yahoo.com

From what I can find on the net it sits there and cuts people off.

From what I can figure out from your image it is the whole BFW (WAN side) that is getting cut. Is this correct? If so describe the network that BFW is connected to.

[the.mummy_3]

Means there is no way within the BFW
To stop this program please, I am in dire I need of your help
DOWNLOAD NETCUT AND TRY http://www.megaupload.com/?d=HA9352GP

[bobbb]

I just need to know how it works, and what it does to get an idea. Start by replying to my 2 questions above.

There no way I will download and run rogue software that seems to be in the malware category.

OK I have an idea how it works. It is as I thought. Now we need a plan.

For information:
Do we have an idea who is doing this? and why?
If you do go over there and break his arms and legs and computer and never mind why. (This is a joke)
Does everyone on the LAN get hit or just you?
Who can touch BFW PC? (Physical access)
Who can control BFW? (root password access)
AS ABOVE: Is the LAN side affected or the WAN side?

I know English is not your native language but you must make an effort to answer ALL the questions.

[bobbb]

When you do get hit I need the output of the command arp -a from the Windows PC.

The reply is like:

Código: Selecionar todos

Interface: 192.168.1.13 --- 0x3
  Internet Address      Physical Address      Type
  192.168.1.1          00-40-f4-2b-bd-7f     dynamic

and I need you to confirm that the MAC is or is NOT the MAC of BFW.

If you know the MAC of BFW
Then issue the command arp -d *
then arp -s 1.2.3.4 NN-NN-NN-NN-NN-NN where NN-NN-NN-NN-NN-NN is the MAC of BFW and 1.2.3.4 is the IP address of BFW

Now report if it is OK?

I wish I could beam down to your location. This sounds like fun.

My plan is to find and isolate the Netcut-er

[El guapo Dan]

The topology of your network can stop the user with netcut.
You can isolate the user in a subnetwork...
But first you need to answer the questions of bobbb, please explain how is your network, where is the user in the network, how he gets his IP, how he access to your network, did you know him?... etc.

By the way, there is an anti netcut in windows, that means that there is a way to stop it...


Daniel.

[bobbb]

did you know him?

You forgot about breaking the legs and arms

Well I guess just the fingers will do.

[El guapo Dan]

did you know him?

You forgot about breaking the legs and arms

Well I guess just the fingers will do.

Ahaha, that can help...

[the.mummy_3]

thank you for you help . and efforts to explan to you ,
i control BFW and through it many people are conncted to it
i give each user a specific ip and MAC adress where the users can not change thier ip but through me only . like that

i do not know who is cutting the connection of net from other users
is there anything that can be added to BFW to stop the action of this cutting programe( netcut) automatically
note: i do not know which of the users is cutting the net from the network that i run
although breaking his arms sounds to be a good idea

[bobbb]

Just to be sure we are on the right track we need you to run that test above when someone gets cut. My plan is long and will require extra equipment like a NIC and another switch.

If only you are the only target then I presume the person is trying to get at the router by somehow getting at the password if that is not already done.

I presume that all users are connected to switches and all these switches are connected to the switch to which the BFW LAN port is also connected.

You need to schedule downtime for "maintenance" or invent whatever excuse you want. Now you put in an extra NIC in BFW using another network address range (different from 10.0.0.0). If you used the mask 255.0.0.0 for the current 10.0.0.0 then we will change it to 255.255.255.0. I presume you have less than 255 users.

We will start with you, the administrator, on the second network and slowly migrate others to that network until it (cutting) starts on that network too then move those last users back to the original network. Now we will will have the cutter down to just a few users. At this point the person will know that someone is hunting him and may stop for a while before he starts again. If that person can move his connection to any switch it will make it harder. Where are these switches located?

If you want to be super safe you can add a third NIC just for you alone.

I need to plan how to work the rules and stuff so only you can administrate.

Am I correct about the user switches all connecting to the switch to which BFW is connected?

[the.mummy_3]

please i need to help i want stop the program
can you give my to find away to stop the program
the program still working i need to help please
i want stop the program from inside THE BFW
I AM control BFW (root password access)
PLEASE FIND AWAY TO Solution THE PROBLEM

[bobbb]

You need to start co-operating. People trying to help you here ask diagnostic questions and never get a reply all we get is something like this:

please i need to help i want stop the program
can you give my to find away to stop the program
the program still working i need to help ..........................

On every thread I have worked on with you it has been the same. No answers to diagnostic questions and no results for tests. I ended my last post April 07 (and a few others) a with question. That was about 6 days ago. I need help too. To figure out what is going on.

I asked for a test above and a bunch of questions. I had to assume the answers from your replies.
I mentioned extra hub and NIC.