what is dynamicnet.ath.cx?

[Invisible Man]

When I booted up my computer for the first time this morning, I got a
system message like "System Shutdown, ... NT AUTHORITY/SYSTEM, ...
Remote Procedure Call termination..., computer will restart in 60
seconds"

Then a connection box appeared saying that "dynamicnet.ath.cx" is
trying to connect to the internet.

All I could do was to use system restore to remove whatever it was.
But I would like to know exactly what caused this and if it was
dynamicnet.

[@micro$oft.com]

Invisible Man wrote:
> When I booted up my computer for the first time this morning, I got a
> system message like "System Shutdown, ... NT AUTHORITY/SYSTEM, ...
> Remote Procedure Call termination..., computer will restart in 60
> seconds"
>
> Then a connection box appeared saying that "dynamicnet.ath.cx" is
> trying to connect to the internet.
>
> All I could do was to use system restore to remove whatever it was.
> But I would like to know exactly what caused this and if it was
> dynamicnet.

If you've noticed my sig, you'll see the ath.cx domain. What it really
is, is a way to assign a static name to a dynamic IP #. The service is
provided by www.dyndns.org, a legit company I have used for almost a
year now. This service is provided free of charge (they pay ones too.)
Most likely if you are seeing "ath.cx" domain, someone has assigned
their dynamic IP address (possibly a dial-up PPP user) to a static
domain name. The client picks the top most part, in this case
"dynamicnet" and the system assigns the "ath.cx" part. A quick whois
confirms this, but with the registrar listed www.NetDNS.cx. However, the
Nameservers are listed the same as mine, dyndns, NS.DYNDNS.ORG,
NS2.DYNDNS.ORG.
This method is neat, because both your IP and domain name can change
overnight, so tomarrow my site could be xyz.ath.cx, asdf.something.else
(they have other domains than just ath.cx) with a different IP besides.
The bad side is it is a little harder to setup network services. My
guess is this dynamicnet.ath.cx is a fly-by-night, here-today,
gone-tomarrow kinda operation, or they're too poor (like me!) to get a
real domain. The reason it says "blah,blah- try to connect TO THE
internet" is more complex. Do you use a hosts file? I did in the past
(when I used windows) and I got seemingly backwards messages ( your
machine seems to think that IT is dynamicnet.ath.cx: > a connection box
appeared saying that "dynamicnet.ath.cx" is
> trying to connect to the internet. ) like that, but in a slightly different situation.
It's not much help, but maybe sheds some light.
--
-=-=-=-=-=-=-=The Even Newer Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-=-=
- jayjwa Mod-SSL / PGP Key / CA Onsite
Was I helpful?: https://atr2.ath.cx/affero.php
What Windows' users need: https://atr2.ath.cx/pub/pic.gif
Enough Ads! https://atr2.ath.cx/pub/no-ads.html
Spam: listme@listme.dsbl.org Mail: /cgi-bin/ping-jay.cgi
=-=-=Linux Tough.Powered By Slackware=-=-RLF#37=-=-=-=-=-=-=-=

[Bart]

"@micro$oft.com" <""billyboi\"@micro$oft.com"> wrote in message
news:vq7pde4sqph8d3@corp.supernews.com...
> Invisible Man wrote:
> > When I booted up my computer for the first time this morning, I got a
> > system message like "System Shutdown, ... NT AUTHORITY/SYSTEM, ...
> > Remote Procedure Call termination..., computer will restart in 60
> > seconds"
> >
> > Then a connection box appeared saying that "dynamicnet.ath.cx" is
> > trying to connect to the internet.
> >
> > All I could do was to use system restore to remove whatever it was.
> > But I would like to know exactly what caused this and if it was
> > dynamicnet.
>
> If you've noticed my sig, you'll see the ath.cx domain. What it really
> is, is a way to assign a static name to a dynamic IP #. The service is
> provided by www.dyndns.org, a legit company I have used for almost a
> year now. This service is provided free of charge (they pay ones too.)
> Most likely if you are seeing "ath.cx" domain, someone has assigned
> their dynamic IP address (possibly a dial-up PPP user) to a static
> domain name. The client picks the top most part, in this case
> "dynamicnet" and the system assigns the "ath.cx" part. A quick whois
> confirms this, but with the registrar listed www.NetDNS.cx. However, the
> Nameservers are listed the same as mine, dyndns, NS.DYNDNS.ORG,
> NS2.DYNDNS.ORG.
> This method is neat, because both your IP and domain name can change
> overnight, so tomarrow my site could be xyz.ath.cx, asdf.something.else
> (they have other domains than just ath.cx) with a different IP besides.
> The bad side is it is a little harder to setup network services. My
> guess is this dynamicnet.ath.cx is a fly-by-night, here-today,
> gone-tomarrow kinda operation, or they're too poor (like me!) to get a
> real domain. The reason it says "blah,blah- try to connect TO THE
> internet" is more complex. Do you use a hosts file? I did in the past
> (when I used windows) and I got seemingly backwards messages ( your
> machine seems to think that IT is dynamicnet.ath.cx: > a connection box
> appeared saying that "dynamicnet.ath.cx" is
> > trying to connect to the internet. ) like that, but in a slightly
different situation.
> It's not much help, but maybe sheds some light.
> --
> -=-=-=-=-=-=-=The Even Newer Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-=-=
> - jayjwa Mod-SSL / PGP Key / CA Onsite
> Was I helpful?: https://atr2.ath.cx/affero.php
> What Windows' users need: https://atr2.ath.cx/pub/pic.gif
> Enough Ads! https://atr2.ath.cx/pub/no-ads.html
> Spam: listme@listme.dsbl.org Mail: /cgi-bin/ping-jay.cgi
> =-=-=Linux Tough.Powered By Slackware=-=-RLF#37=-=-=-=-=-=-=-=
>
>
>

I'm afraid not!!!!!!!!!!!!
It was simply the blaster virus. See symantec site of Mcafee for info and
removaltool. Do not forget the patch from microsoft.

[jayjwa]

Bart wrote:

> I'm afraid not!!!!!!!!!!!!
> It was simply the blaster virus. See symantec site of Mcafee for info and
> removaltool. Do not forget the patch from microsoft.

And I'm afraid blaster has nothing to do with a service that provides
domain names for people with dynamic IP's. I have the source code for
Blaster, and I used to program in assembler- nothing in there about
"dynamicnet.ath.cx", I'm afraid...


--
-=-=-=-=-=-=-=-=-=Atr2-WBS @ Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-
Mod-SSL / PGP Key / CA Onsite
-{jayjwa} Was I helpful? https://atr2.ath.cx/affero.php
Contact: https://atr2.ath.cx/cgi-bin/ping-jay.cgi
or finger, same name & domain, for plan, projects, $ PGP

What Windows' users need: https://atr2.ath.cx/pub/pic.jpg
=-=-=Linux Tough.Powered By Slackware=-=HTTPS/FTP=-RLF#37=

[Bart]

"jayjwa" <jayjwa@hotspam.microsoftsux.suk> wrote in message
news:vq8ja3s821uf03@corp.supernews.com...
> Bart wrote:
>
> > I'm afraid not!!!!!!!!!!!!
> > It was simply the blaster virus. See symantec site of Mcafee for info
and
> > removaltool. Do not forget the patch from microsoft.
>
> And I'm afraid blaster has nothing to do with a service that provides
> domain names for people with dynamic IP's. I have the source code for
> Blaster, and I used to program in assembler- nothing in there about
> "dynamicnet.ath.cx", I'm afraid...
>
>
> --
> -=-=-=-=-=-=-=-=-=Atr2-WBS @ Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-
> Mod-SSL / PGP Key / CA Onsite
> -{jayjwa} Was I helpful? https://atr2.ath.cx/affero.php
> Contact: https://atr2.ath.cx/cgi-bin/ping-jay.cgi
> or finger, same name & domain, for plan, projects, $ PGP
>
> What Windows' users need: https://atr2.ath.cx/pub/pic.jpg
> =-=-=Linux Tough.Powered By Slackware=-=HTTPS/FTP=-RLF#37=
>
>
>

But the part about remote procedure call is classic blaster stuff.

[Tux]

actually the initial message about the RPC NT Authority error IS the Blaster
worm

BUT it is not uncommon to have Welchia also in a computer infected by
Blaster

id check for and immunize against both

i make a lot of money disinfecting and deworming computers every year...

sometimes i feel like a digital vetrinarian


charles@ktc.com




art wrote:

>
> "jayjwa" <jayjwa@hotspam.microsoftsux.suk> wrote in message
> news:vq8ja3s821uf03@corp.supernews.com...
>> Bart wrote:
>>
>> > I'm afraid not!!!!!!!!!!!!
>> > It was simply the blaster virus. See symantec site of Mcafee for info
> and
>> > removaltool. Do not forget the patch from microsoft.
>>
>> And I'm afraid blaster has nothing to do with a service that provides
>> domain names for people with dynamic IP's. I have the source code for
>> Blaster, and I used to program in assembler- nothing in there about
>> "dynamicnet.ath.cx", I'm afraid...
>>
>>
>> --
>> -=-=-=-=-=-=-=-=-=Atr2-WBS @ Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-
>> Mod-SSL / PGP Key / CA Onsite
>> -{jayjwa} Was I helpful? https://atr2.ath.cx/affero.php
>> Contact: https://atr2.ath.cx/cgi-bin/ping-jay.cgi
>> or finger, same name & domain, for plan, projects, $ PGP
>>
>> What Windows' users need: https://atr2.ath.cx/pub/pic.jpg
>> =-=-=Linux Tough.Powered By Slackware=-=HTTPS/FTP=-RLF#37=
>>
>>
>>
>
> But the part about remote procedure call is classic blaster stuff.

[Invisible Man]

"Bart" <bartnws@hotmail.com> wrote in message news:<bo11hl$hfj$1@reader08.wxs.nl>...
> "@micro$oft.com" <""billyboi\"@micro$oft.com"> wrote in message
> news:vq7pde4sqph8d3@corp.supernews.com...
> > Invisible Man wrote:
> > > When I booted up my computer for the first time this morning, I got a
> > > system message like "System Shutdown, ... NT AUTHORITY/SYSTEM, ...
> > > Remote Procedure Call termination..., computer will restart in 60
> > > seconds"
> > >
> > > Then a connection box appeared saying that "dynamicnet.ath.cx" is
> > > trying to connect to the internet.
> > >
> > > All I could do was to use system restore to remove whatever it was.
> > > But I would like to know exactly what caused this and if it was
> > > dynamicnet.
> >
> > If you've noticed my sig, you'll see the ath.cx domain. What it really
> > is, is a way to assign a static name to a dynamic IP #. The service is
> > provided by www.dyndns.org, a legit company I have used for almost a
> > year now. This service is provided free of charge (they pay ones too.)
> > Most likely if you are seeing "ath.cx" domain, someone has assigned
> > their dynamic IP address (possibly a dial-up PPP user) to a static
> > domain name. The client picks the top most part, in this case
> > "dynamicnet" and the system assigns the "ath.cx" part. A quick whois
> > confirms this, but with the registrar listed www.NetDNS.cx. However, the
> > Nameservers are listed the same as mine, dyndns, NS.DYNDNS.ORG,
> > NS2.DYNDNS.ORG.
> > This method is neat, because both your IP and domain name can change
> > overnight, so tomarrow my site could be xyz.ath.cx, asdf.something.else
> > (they have other domains than just ath.cx) with a different IP besides.
> > The bad side is it is a little harder to setup network services. My
> > guess is this dynamicnet.ath.cx is a fly-by-night, here-today,
> > gone-tomarrow kinda operation, or they're too poor (like me!) to get a
> > real domain. The reason it says "blah,blah- try to connect TO THE
> > internet" is more complex. Do you use a hosts file? I did in the past
> > (when I used windows) and I got seemingly backwards messages ( your
> > machine seems to think that IT is dynamicnet.ath.cx: > a connection box
> > appeared saying that "dynamicnet.ath.cx" is
> > > trying to connect to the internet. ) like that, but in a slightly
> different situation.
> > It's not much help, but maybe sheds some light.
> > --
> > -=-=-=-=-=-=-=The Even Newer Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-=-=
> > - jayjwa Mod-SSL / PGP Key / CA Onsite
> > Was I helpful?: https://atr2.ath.cx/affero.php
> > What Windows' users need: https://atr2.ath.cx/pub/pic.gif
> > Enough Ads! https://atr2.ath.cx/pub/no-ads.html
> > Spam: listme@listme.dsbl.org Mail: /cgi-bin/ping-jay.cgi
> > =-=-=Linux Tough.Powered By Slackware=-=-RLF#37=-=-=-=-=-=-=-=
> >
> >
> >
>
> I'm afraid not!!!!!!!!!!!!
> It was simply the blaster virus. See symantec site of Mcafee for info and
> removaltool. Do not forget the patch from microsoft.

Guess what, I've just found/removed a W32.Welchia.Worm on my computer.

[Bart]

"Invisible Man" <dave_isit20032001@yahoo.co.uk> wrote in message
news:334ea532.0311011945.3b331f47@posting.google.c om...
> "Bart" <bartnws@hotmail.com> wrote in message
news:<bo11hl$hfj$1@reader08.wxs.nl>...
> > "@micro$oft.com" <""billyboi\"@micro$oft.com"> wrote in message
> > news:vq7pde4sqph8d3@corp.supernews.com...
> > > Invisible Man wrote:
> > > > When I booted up my computer for the first time this morning, I got
a
> > > > system message like "System Shutdown, ... NT AUTHORITY/SYSTEM, ...
> > > > Remote Procedure Call termination..., computer will restart in 60
> > > > seconds"
> > > >
> > > > Then a connection box appeared saying that "dynamicnet.ath.cx" is
> > > > trying to connect to the internet.
> > > >
> > > > All I could do was to use system restore to remove whatever it was.
> > > > But I would like to know exactly what caused this and if it was
> > > > dynamicnet.
> > >
> > > If you've noticed my sig, you'll see the ath.cx domain. What it really
> > > is, is a way to assign a static name to a dynamic IP #. The service is
> > > provided by www.dyndns.org, a legit company I have used for almost a
> > > year now. This service is provided free of charge (they pay ones too.)
> > > Most likely if you are seeing "ath.cx" domain, someone has assigned
> > > their dynamic IP address (possibly a dial-up PPP user) to a static
> > > domain name. The client picks the top most part, in this case
> > > "dynamicnet" and the system assigns the "ath.cx" part. A quick whois
> > > confirms this, but with the registrar listed www.NetDNS.cx. However,
the
> > > Nameservers are listed the same as mine, dyndns, NS.DYNDNS.ORG,
> > > NS2.DYNDNS.ORG.
> > > This method is neat, because both your IP and domain name can change
> > > overnight, so tomarrow my site could be xyz.ath.cx,
asdf.something.else
> > > (they have other domains than just ath.cx) with a different IP
besides.
> > > The bad side is it is a little harder to setup network services. My
> > > guess is this dynamicnet.ath.cx is a fly-by-night, here-today,
> > > gone-tomarrow kinda operation, or they're too poor (like me!) to get a
> > > real domain. The reason it says "blah,blah- try to connect TO THE
> > > internet" is more complex. Do you use a hosts file? I did in the past
> > > (when I used windows) and I got seemingly backwards messages ( your
> > > machine seems to think that IT is dynamicnet.ath.cx: > a connection
box
> > > appeared saying that "dynamicnet.ath.cx" is
> > > > trying to connect to the internet. ) like that, but in a slightly
> > different situation.
> > > It's not much help, but maybe sheds some light.
> > > --
> > > -=-=-=-=-=-=-=The Even Newer Atr2.Ath.Cx=-=-=-=-=-=-=-=-=-=-=
> > > - jayjwa Mod-SSL / PGP Key / CA Onsite
> > > Was I helpful?: https://atr2.ath.cx/affero.php
> > > What Windows' users need: https://atr2.ath.cx/pub/pic.gif
> > > Enough Ads! https://atr2.ath.cx/pub/no-ads.html
> > > Spam: listme@listme.dsbl.org Mail: /cgi-bin/ping-jay.cgi
> > > =-=-=Linux Tough.Powered By Slackware=-=-RLF#37=-=-=-=-=-=-=-=
> > >
> > >
> > >
> >
> > I'm afraid not!!!!!!!!!!!!
> > It was simply the blaster virus. See symantec site of Mcafee for info
and
> > removaltool. Do not forget the patch from microsoft.
>
> Guess what, I've just found/removed a W32.Welchia.Worm on my computer.


Hmmmm, and I was just thinking about challenging people to a bet that it was
Blaster. :-)

[jayjwa]