Get your fill of sci-fi, science, and mockery of stupid ideas
http://stardestroyer.dyndns-home.com/
http://stardestroyer.dyndns-home.com/viewtopic.php?f=24&t=27723
Count five words in to your post.MKSheppard wrote:Christ, what a fucking cunt....why do people do that?
crap, remembers it has access to my shared partition through samba... runs off to get firewallHave you tried using iptables?Pu-239 wrote:I got shitloads of scans when I had SNORT running on my computer. Got rid of it after getting tired of reading logs. My computer needs a firewall since I'm running lots of daemons (masqmail, xinetd(for running swat(web based samba configuration)), samba, and cups).
Code: Select all
#/bin/bash
# Sets up default route for using ICS from win98 box
route add default gw up metric 3 &>/dev/null
# Very loosely based on stuff from the iptables tutorial and the IP-Masq HOWTO
# More complexity is better ;)
# Designed for only 2 computers on LAN
#
# 192.168.0.1 - this computer, hostname is 'down'
# 192.168.0.2 - computer upstairs, hostname is 'up'
# 66.44.0.0/16 - IP addresses assigned anywhere between this range for dialup connection
# 00:40:05:81:77:97 - MAC address for 'up'. Can they be spoofed?
# 00:00:00:00:00:00 - loopback mac address, is there such thing? Seems to match local computer when
# testing loopback interface. Someone explain this to me.
# Is it a bad idea to put any of this information on a public forum??
# Initial setup
#---------------------------------------------------------------------
# Sets path
#---------------------------------
PATH="/sbin"
export PATH
#---------------------------------
# Loads modules
#---------------------------------
modprobe ip_conntrack_ftp
#modprobe ip_nat_ftp
modprobe ip_conntrack_irc
#modprobe ip_nat_irc
# rest autoloaded
#---------------------------------
# Resets firewall rules
#---------------------------------
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -F
iptables -X
#---------------------------------
#---------------------------------------------------------------------
# Creates chain for dropping and logging packets
#---------------------------------------------------------------------
iptables -N DROPLOG
iptables -A DROPLOG -j ULOG
iptables -A DROPLOG -j DROP
#---------------------------------------------------------------------
# Creates chain for rejecting and logging packets
#---------------------------------------------------------------------
iptables -N REJECTLOG
iptables -A REJECTLOG -j ULOG
iptables -A REJECTLOG -j REJECT
#---------------------------------------------------------------------
iptables -N TCPFILTIN
iptables -A TCPFILTIN -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j DROPLOG
iptables -A TCPFILTIN -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A TCPFILTIN -p tcp --sport 6346 -j ACCEPT
iptables -A TCPFILTIN -i eth0 -s 192.168.0.2 -m mac --mac-source 00:40:05:81:77:97 -j ACCEPT
iptables -A TCPFILTIN -i lo -j ACCEPT
iptables -A TCPFILTIN -j DROPLOG
iptables -N UDPFILTIN
iptables -A UDPFILTIN -i eth0 -s 192.168.0.2 -m mac --mac-source 00:40:05:81:77:97 -j ACCEPT
iptables -A UDPFILTIN -m state --state ESTABLISHED,RELATED -p UDP -s 207.172.3.0/24 -j ACCEPT
# Allows access to my ISP's DNS servers
# Allows access to my computers services from upstairs
iptables -A UDPFILTIN -j DROPLOG
iptables -N ICMPFILTIN
#iptables -A ICMPFILTIN -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A ICMPFILTIN -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A ICMPFILTIN -i eth0 -s 192.168.0.2 -m mac --mac-source 00:40:05:81:77:97 -j ACCEPT
iptables -A ICMPFILTIN -j DROPLOG
iptables -A INPUT -p tcp -j TCPFILTIN
iptables -A INPUT -p udp -j UDPFILTIN
iptables -A INPUT -p icmp -j ICMPFILTIN
iptables -A OUTPUT -j ACCEPT
# Allow all outgoing traffic
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
# Sets up NAT
Nope, because it pushes it through to a Windows protocol that probably already has free access through the firewall (like the Messenger spam).Thunderfire wrote:This happend to me to and Zonealarm doesn't protect against this shit...
You need to use a decent firewall, like the built-in IPSEC or Kerio to protect yourself, IIRC.Thunderfire wrote:This happend to me to and Zonealarm doesn't protect against this shit...
Don't screw with the RPC settings, bad things can happen. After you've implemente the patch switch back to the old RPC settings.Rye wrote:Ok, after changing those settings i've run across some bizarre results. Namely, now links on websites don't work (sorta)and i can't connect/disconnect at will, it just sorta locks up, MSN chatrooms now don't have the main chat box and text box parts...or have i fucked something else up on the way to the services?
Crayz9000 wrote:*basks in the glory that is Linux*
Sorry
A properly secured Windows box would not have had this problem, patch or no patch.Yeah, the older version of TPF is now KPF.But yeah, a firewall definitely helps. When I use Windows, I still use the older version of Tiny Personal Firewall (it's now Kerio, right?)
The best kind of firewall, of course, is an external one, but those take work to set up.
Where the fuck does it come from originally? It comes back if you delete it. It's located in windows/system32 iirc, and has an accompanying .pn file. there's also a weird file called "wowpost.exe" in system. It didn't say it was made by microsoft so i deleted that too.lukexcom wrote:Everyone that had this program, goto:
start>>run
type: msconfig
go to the startup tab, and check if "msblast" is there. I just found it too, and it appears to be the root of the problem. I'm guessing that it opens a series of ports up for grabs for the script kiddies. Further analysis of the program will be made if I find the time.
Also, for you XP/2000 users, hit ctrl-alt-del, and under the task manager, processes tab, kick out msblast.exe and any other suspicious programs that you see running.
It's a worm that automatically replicates itself.Rye wrote:Where the fuck does it come from originally? It comes back if you delete it. It's located in windows/system32 iirc, and has an accompanying .pn file. there's also a weird file called "wowpost.exe" in system. It didn't say it was made by microsoft so i deleted that too.