YAPhFT

[BoberFett]

Yet Another Phantom Flusher Thread

I know, I know, sorry to keep bringing this up. But I'm one of the "victims" so it's of interest to me.

Does anyone else find it odd how he's coming back online slowly? If the reason the output nearly stopped was that the clients installed were pre-8009 and doing invalid OGR blocks rather than RC5, wouldn't his output have come back as soon as D.net updated their proxies? Or if he was using a pproxy and updated it to 318, it should have happened all at once.

Over the past few days, my RC5 stats have been going up; today I'm over 22K blocks. Does this seem to indicate a person behind this rather than a trojan? Any thoughts?

 

[Xede]

Didn't Virge mention at one point that SOME of the DNET keyservers had been updated, but not all? (updated to tell old clients not to do OGR). That might have something to do with it. <shrug> I assume that by now they are all properly configured.

 

[Engine]

There's probably also a decent amount of the infected computers using dialup access. If a lot of these people only access the internet once every three days or so, then it would take a while for them all to be switched back to rc5

 

[JonB]

Xede, on the DNet OGR keyserver list http://n0cgi.distributed.net/ogr-proxyinfo.html there is only one keyserver running less than version 318 and it isn't handling much traffic.

I'm not sure what that says, since we can't see what client versions are dumping into our accounts. The daily curve for me http://rc5stats.distributed.net/rc5-64/phistory.php3?id=130398 show that my PHF blocks dropped off drastically, then slowly came back up. I just wish I could see the client version and the domain from them (like we get from Mika-stats).

Time will tell. Don't look a gift client in the mouth. All's well that ends well. I'll still respect you in the morning.

did I miss any?

 

[mindless]

I dont think its a trojan, but I dont think whoever is flushing blocks for me has any great computing power. Of course I consider my PhF to be a copy cat, I get about 2800 blocks from him daily, nowhere near the 25000 some of you get. But when OGR started he dumped none for me, my guess is bad blocks. But over the next couple days it returned to my &quot;normal&quot; rate with him flushin (about 3800 blocks), each day it increased by about 1000, just like when he first started flushing for me. My guess is he has @home cable and has easy access to peoples machines on his subnet, which is why Virge's and couple others emails have been found on some machines.

My theory on it is we have the PhF, and then one or more copy cats. The PhF has access to a large sum of computers all of which probably flush directly to Dnet and would explain why it took a bit for him to come back online. The only problem with my theory is anyone getting blocks from the copy cat are getting blocks cracked on a computer without permission.

 

[Randall]

I don't know much about the PF but he's really pissing me off, It's a lot of work to amass a herd capable of doing 10K per day, I'm trying to advance up the TA rankings and BoberFett is right on my tail with PF blocks ( no offense to you Bober ). I haven't received any blocks from him ( and I don't want them either ) but he's killing what fun was left in RC5.

 

[Postman]

10K blocks/day = 10 machines

 

[Russ]

Xede is correct. The dnet guys each are responsible for different servers. One of them was out of town, so not all were upgraded at once. That would explain the incremental increase, rather than immediate.

I'd assume that it will now basically level off now.

Russ, NCNE

 

[Viztech]

PhF was doing ~22,000/day for me. I'm back up to 17,000 now, so we shall see. I still have no OGR blocks from the Phantom, has anybody else?

viz

 

[MWalkden]

OK, good story line, could be 1 or several. Each joining a secret club that decides to aid a good rep. Bet they are pissed a bit when we rag on them.......hmmmm, no, just one guy that uses a Trojan to plant clients. Thinks it is good because he is serving a cause to both Dnet and certain individuals.

No, it is several people who found/share the same Trojan and since they can't claim the blocks themselves choose them as they see fit, (maybe hoping it will be enjoyed, less likely these days).

Seems I could just go on with theory after theory!

 

[BoberFett]

Sorry Randall.

I put my entire herd on OGR if that's any consolation.

 

[Viztech]

bober-

Not quite-

Incoming Connection from 24.5.237.177
New thread started to handle client communication
Client requesting to send 5 blocks upstream
Received block [Gamma Flux] from client 24.5.237.177
[22-7-100 6:22:19] Block was received from e-mail chris@kyarsgaard.org on Team: 3
Received block [Gamma Flux] from client 24.5.237.177
[22-7-100 6:22:19] Block was received from e-mail chris@kyarsgaard.org on Team: 3
Received block [Gamma Flux] from client 24.5.237.177
[22-7-100 6:22:19] Block was received from e-mail chris@kyarsgaard.org on Team: 3
Received block [Gamma Flux] from client 24.5.237.177
[22-7-100 6:22:19] Block was received from e-mail chris@kyarsgaard.org on Team: 3
Received block [Gamma Flux] from client 24.5.237.177
[22-7-100 6:22:20] Block was received from e-mail chris@kyarsgaard.org on Team: 3
Waiting for inbound connection. Press s to shutdown. Press f to fetch&amp;flush.

Looks like your still doing a little Gamma

viz

 

[BoberFett]

Yep, I think I still have 3 machines on Gamma. A Cel 333, P75 and P133. If they ever start GF2 maybe I'll put some more power there. Right now I wanted to really pound on OGR and /.