Organized Crazy Addicts

T}{ANAT}{O$ · Posted: Fri Jan 09, 2004 10:52 am Post subject: Trojan on PM?! How come?

I've had a small training session on PM this morning (hadn't play quite a long time)
and wondered why I didn't connect after changing map (Log says: DM-ChalcedonyTemple),
when I heard a "bonk" from NIS... so I changed view and saw this

I was a little confused at least... but I thought I'd better warn you
to keep your eyes open and firewalls/ anti-virus progs ready...

I hope Puntloos might have the time to take a look at it....

Than

LeeBe · Posted: Fri Jan 09, 2004 11:47 am Post subject:

Ive had a firewall popup saying I had a post scan from pm a while ago Confused

the only thing I can think of Than is that pm was trying to connect using a port used by that trojan.

Its definately not that trojan trying to connect, it only works on windows machines, and I think only 95/98

but if you joined pm using a udp port that the trojan uses, nis wont know the difference

T}{ANAT}{O$ · Posted: Fri Jan 09, 2004 7:49 pm Post subject:

Hmmmm... sounds logical, but I did some research on this (made it
some time ago to configure firewall, but wanted to be on the safe side)

As you can see, it used the default port, that has been configured by me to be "UT-friendly":

Unreal Tournament server
IN UDP 7777 (default gameplay port)
IN UDP 7778 (server query port
IN UDP 7779+ (UDP 7779+ are allocated dynamically for each
helper UdpLink objects, including UdpServerUplin
objects. Try starting with 7779-7781 and add
ports if needed.))
IN UDP 27900 (server query, if master server uplink is enabled.
Some master servers use other ports, like 27500, 28900)
IN TCP 8080
(Port 8080 is for UT Server Admin. In the [UWeb.WebServer] section of the server.ini file,
set the ListenPort to 8080 (to match the mapped port above) and ServerName
to the IP assigned to the router from your ISP.)
ProxyServerPort = 3128 (IpDrv.HTTPDownLoad)

Players might also need ports 7775,7776,8500,8501,8502 (didn't find these in ut.ini!! )

Based on info from:
http://www.practicallynetworked.com/sharing/app_port_list.htm#Games

...and my .ini

LeeBe · Posted: Fri Jan 09, 2004 8:15 pm Post subject:

well, like I say, im only guessing. Only Punt will know for sure whats happened.

The server log has changed since you went in and I cant see the old one, but players do use ports other than those.

2004-01-09 19:46.31 436 [I$C]Missing_Link *.*.*.53:38409 packages validated!

2004-01-09 19:59.19 436 The_Doctor *.*.*.114:63744 packages validated!

T}{ANAT}{O$ · Posted: Fri Jan 09, 2004 9:08 pm Post subject:

Uh, I finally managed rummaging through the logs....

"An instance of "X:\UnrealTournament\System\UnrealTournament.exe" is preparing to access the Internet for the first time

Rule "Default Block Master Paradise Trojan horse" blocked (130.89.22.201,3129).
Inbound UDP packet
Local address,service is (XXX(XXX.XXX.XXX.9),3129)
Remote address,service is (130.89.22.201,7777)
Process name is "N/A"

Rule Default Block Master Paradise Trojan horse matched
Remote address (130.89.22.201,7777)

Trojan attempt detected from address 130.89.22.201 by rule "Default Block Master Paradise Trojan horse".
Blocked further access for 30 minutes."

It happens to be port 3129 that matches NIS Trojan horse rule- maybe
the up/download port?

I just wondered wether this happens to other people, too.
But since you've been "scanned" as well, it might've really been nothing but a false
alarm.. Maybe I'm just a little overcautios on these things. Wink

(Forgot: router is configured as well to keep unused and "suspect to attack" ports closed, so that's mainly why I was so confused.)
BTW: Virus-etc. Scans and reg-searches (I hate that waste of time!) turned out all fine.

roba · Posted: Fri Jan 09, 2004 11:13 pm Post subject:

Maybe UT just randomly choosed port 3129 for next map and firewall interpreted it as that trojan? I think UT port on client side is random...

T}{ANAT}{O$ · Posted: Sat Jan 10, 2004 2:45 am Post subject:

Think so too.....
Sorry for unsettling you!
Embarassed

roba · Posted: Sat Jan 10, 2004 12:21 pm Post subject:

I hope you really like my brain, coz I lciked on that link again. And it always HURTS! Laughing

Tempus · Posted: Sat Jan 10, 2004 5:49 pm Post subject:

Th@n@tos has eaten 65 brains. Yours was hilariously spicy.

heres mine if u wonna try it Wink

http://kevan.org/brain.cgi?zalensia

LeeBe · Posted: Sat Jan 10, 2004 5:59 pm Post subject:

hehe

zalensia has eaten 94 brains. Yours was a bit hard to get out, but worth it.

bah! Ive never even used it....

roba · Posted: Sat Jan 10, 2004 6:02 pm Post subject:

"Yours looked a bit strange, but tasted okay."

T}{ANAT}{O$ · Posted: Sat Jan 10, 2004 9:58 pm Post subject:

Hehehe.... maybe I should change it into: "...it won't hurt anymore soon."
Would that be better?
By the way: try refreshing the site after being attacked by me....

But good to know they still come crawling to me and fill the
ranks of the shambling, grey-skinned legions of the undead. Twisted Evil

Tempus · Posted: Sat Jan 10, 2004 10:19 pm Post subject:

Just remember, the brain feels no pain, once the skull is cracked open you wont feel a thing LOL buzz_saw

how is this for getting off topic lool ^^