Organized Crazy Addicts

puntloos · Posted: Tue Aug 26, 2003 1:10 pm Post subject: Lag Issues

Some rumours have been floating around that people are using 436-version UT servers (like PM is) for DDOS attacking other machines.

This is true.

Hard to remedy as well, some checks can be made, but the real fix is to upgrade to 451 which will kill performance on anything but 451-upgraded clients.

But, the weird lag spikes our server currently has is caused (well probably) by something completely different. I suspect it's the W32.Blaster worm that is causing our entire network, not just the UT machine, to go haywire.

So, eh, other than just bear it out there's not much to do about it. Sorry.

Carry on.

Wayzor · Posted: Tue Aug 26, 2003 10:34 pm Post subject:

Could you explain a little about the effects a client would encounter plz punt. My UT seems to crash, sometimes just after maps finish and my pc has shut itself down or restarted a couple of times in the last week! Confused

Are these poss symptoms of this attack? ............or just my pc getting even more screwy?

Tempus · Posted: Tue Aug 26, 2003 10:37 pm Post subject:

hrm i thought it was just me and blew it off, but now you mention it wayzor i was playing on PM last night, now i dont know if it is just coincidence, but since i baught me new mobo/hd installed win2000 which was about 7 months ago and my computer hadnt crashed or frooze once, last night first ut crashes twice then mid game my computer died completly. like i say dunno if it was a conicidence or what, just made me think when wayzor said he crashed while playing and i had the same

roba · Posted: Tue Aug 26, 2003 10:39 pm Post subject:

LeeBe · Posted: Tue Aug 26, 2003 10:40 pm Post subject:

hmmmm

WAYZOR....WAYZOR....WAYZOR.....hmmm

im sure Ive seen that name before.... Confused

not for at least a couple of months though........you the same one? Wink

kokkie · Posted: Tue Aug 26, 2003 11:03 pm Post subject:

LMAO.. but yeah wazor where have u been.... haven't seen u anymore at pm... or the forum... Crying or Very sad

btw.. congrets with ur #1000 post leebe Wink

cya,

-{IHC}-kokkie

Shaman · Posted: Tue Aug 26, 2003 11:53 pm Post subject:

rebooting sure is a symptom of the afore mentioned virus...

and just of late my firewall was going crazy blocking ips from all over the place...denial of service atack and buffer overflow i just couldnt understand it ... all trying to connect to port 135 (this is a windows service dcom ) anyway u need to close port 135 by Disabling Distributed COM

Click on Start | Run | and enter: C:\WinNT\System32\Dcomcnfg.exe

Then click on the Applications tab.

Many programs "support" Distributed Communication (DCOM) but rarely ever use it. This includes such programs as Windows Media and Wordpad. When examining this option, look for third-party applications that might actually REQUIRE network support, as opposed to those that simply support it. To find out if these programs really require DCOM, you must disable it, run the programs, and see what happens.

Note that it is probably only necessary to look at third-party programs here.

Microsoft programs designed to run on a non-networked, stand-a-lone computer are usually written to support but do not require DCOM. To disable DCOM, go to the Default Properties tab and uncheck the box labeled "Enable Distributed COM on this computer".

Reboot, and try running the third-party software noted as above. Odds are that everything will still run correctly. If not, go back and enable DCOM again. As you re-enable it, also go to the Default Protocols tab and remove all protocols except "Connection-oriented TCP/IP". This doesn’t create any additional security but does reduce the number of connection methods you have to keep an eye on.

If you do not have to re-enable DCOM again, then on the Default Protocols tab remove all protocols. You won't need them, and that should stop Windows from listening on Port 135

the thing is aparently the W32.Blaster.Worm onceinstalled on a infected machine emailsits self to ppl in the addy book ...but allso scans the internet for other windows 2000/xp pc with port 135 open...
since shutting downs dcom and blocking all trafic on port 135 with my firewall ive had no problems........

b4 i cloed this hole i had a warning from my firewall that my ntkernal was trying to connec to the oca server ip ..... this somwhat puzled me only thing i can think of was someone trying to use the server to hack with DDOs ,the ips that wer connected to it ... but im not to sure bout that

punt my know more bout that than i do ?

Wayzor · Posted: Wed Aug 27, 2003 1:09 am Post subject:

Hey roba, I got "Nortons 2002" allways as up to date as can be............it says no probs with my sys! So don't know! Maybe I should try another A/V prog?

Hey Lee ya cheeky monkey Wink

Yep it's me, I have had a bit of an extended break, while moving house...........also took a while to get my net connection installed! I have had a few games but have been on as "aimsgone2pot" 'cause it really has LOL. Thought I might train up again annon, so as not to look like a nOOb WAYZOR hehehe!

Hey Kokkie Smile

played ya the other night @ TSU Wink

We had a dance in the lower hallway of a map, I can't remember the name of it, for about a minute.........when I say dance, I mean we couldn't land a shot while jumping around like looneys LOL. Next map was CTF-433 which was over in no time........hehehe kicked yer ass LOL. j/k I think you were rolling one up at the time or something Wink

http://www.seventhstar.plus.com/oddsnsods/CTF_433.jpg Sorry had to get a screeny........not often I can do so well with a big gun like u onboard lately Razz

@ Spidy I'm still on win98 (Sad pennythrift that I am) still on a sub Gig pc too LOL. So have not got Dcomcnfg.
I have had port 137-139 closed in my firewall for some time......and dcom (RPCSS.EXE) totaly dissalowed from access in my firewall too! It seems to affect only win2000/Xp anyhow right? Sooooo?
Thx anyway ppl Smile

puntloos · Posted: Wed Aug 27, 2003 2:09 am Post subject:

The only non-UT problem I'm currently aware of is that PM gets lag bursts of (say) 5 seconds in intermittent intervals. It's been a lot worse, currently it seems to be fine.

UT-related is this DOS attack thing where malicious hackers use the server to mount a DOS attack on some unsuspecting ip (by spoofing their IP). I could perhaps install the 451 patch but we all know that will lead to more lag problems than it'll solve. I prefer to wait out the MD5-enabled new UTPG thing

And: hey wayzor, ltns. Smile

Where's that voicepack Wink

(hey you knew I would ask)

LeeBe · Posted: Wed Aug 27, 2003 9:00 am Post subject:

hehe welcome back Wayzor m8 Smile

kokkie thx for the congrats Very Happy

very well written spidy Smile

(or copied? Smile

) im geting a ton of these things hitting my firewall every day.

kokkie · Posted: Wed Aug 27, 2003 2:36 pm Post subject:

@ Wazor.... i knew aimsgonetopot could not be a stainger Laughing

but for that game.... I was trying hard but as lately my aim sucks and i totaly lost it that map. Crying or Very sad

(sure i was a little drunk.. but that wasn't the prob. i think) So have to say GG Twisted Evil

but back to topic...

indeed it doesnt affect Win 98 Wink

cya around,

-{IHC}-kokkie

Wayzor · Posted: Wed Aug 27, 2003 6:55 pm Post subject:

Thx for the welcome back and GG's guys Wink

Punt thx for the info and yer it's been too long m8...............and yer I did know you would ask Laughing

LOOoooooool!! It is one of those things that I keep meaning to do when I get some spare time.............only to realise that when it comes to doing it.........I need a lot of spare time hehehe. ( Embarassed

I truely am embarrassed though.......sry Embarassed

)

Tempus · Posted: Mon Sep 01, 2003 8:38 pm Post subject:

Just so ya know, the server has turned into a lag machine again! Sad

[ESD]-Zniperman · Posted: Sun Sep 07, 2003 12:49 am Post subject:

LeeBe · Posted: Sun Sep 07, 2003 12:59 am Post subject:

Ive had a lot of those as well, I think ive only been kicked once though.
not sure if its the server or all the worms about atm on the net.

it did seem better for me today though.