Jump to content

urandom

Member
  • Posts

    331
  • Joined

  • Last visited

Posts posted by urandom

  1. if your machine boots properly *every* single time you didn't play the game then we can exclude hardware issues. just some shot in the dark: we could imagine that running the game could lead to some file system corruption (when you run it or when game's data are being saved or when <insert whatever comes to mind> ). what ou could try: close any running application, create a restore point, play your game, close it, restore previous state (the restore point you just created), reboot, sacrifice a goat and report results.

    /edit: i'm lazy and I just read OP, I may have missed something.

  2. Oh gee poor little Sweden under all that pressure from the big bad ole usa just HAD to prosecute the owners and shut down pirate bay. Try getting any worthwhile off pb these days and tell me it is still worth a crap. If this so called pressure from the us forced them to instigate this action (which it didnt, try looking in the EU for that pressure first) then I hope they dont get invaded by little schoolgirls anytime soon.

    at this point you're obviously trolling so i'll give you a 3/10, you can do better. this, or your hamster hacked your TV account :D

  3. I'm still seeing the ICMP replies so you may see them at some point too. If you want to get rid of this, a quick and dirty solution would be:

    open notepad *as administrator* (right click the notepad icon -> chose run as administrator). Then, in notepad, click file -> open and open the following file:

    C:\Windows\System32\drivers\etc\hosts (if you can't see the file, chose "All Files" in the drop down menu at the bottom right of the file explorer of notepad. By default, it is set to "Text Documents *.txt" )

    Then add the following line:

    127.0.0.1 host63.truehits.net

    it should be look exactly like this, no # at the beginning of the line.

    Save, close and enjoy.

    What does it do?

    as I said earlier, those ICMP messages are replies to a tcp packet sent from your host to truehits.net. Therefore, if you can't send any packet first, you won't get any reply. This is what you have done by modifying your hosts file, it tells your machine that the IP address of the the truehits server is 127.0.0.1, which is what is called a loopback device: your own network interface.

  4. Good catch droogie,

    Well, obviously, if you want this to stop, you just have to disable javascript or to drop ICMP with the destination-unreachable flag.

    for example, with iptables, this will work:

    # iptables -A INPUT -p icmp --icmp-type destination-unreachable -j DROP

    You can also use your hosts file and make this truehits server point to localhost.

    now this ICMP message is in fact a REPLY to a ack, fin tcp packet sent by YOUR machine that the truehits server's firewall doesn't allow for some reason. it means you'll get several hits every time you load a thaivisa page. why is a mistery but i'll drop a few lines to truehits.net webmaster later today (i don't have too much hope but anyway).

    here's the sequence of sent tcp packet, ICMP reply:

    No. Time Source Destination Protocol Length Info

    3763 190.305447 192.168.3.104 203.151.21.63 TCP 66 34438 > http [FIN, ACK] Seq=811 Ack=399 Win=15680 Len=0 TSval=115329792 TSecr=2352471551

    Frame 3763: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)

    Arrival Time: Jan 22, 2012 21:17:52.362163000 ICT

    Epoch Time: 1327241872.362163000 seconds

    [Time delta from previous captured frame: 11.600035000 seconds]

    [Time delta from previous displayed frame: 11.600035000 seconds]

    [Time since reference or first frame: 190.305447000 seconds]

    Frame Number: 3763

    Frame Length: 66 bytes (528 bits)

    Capture Length: 66 bytes (528 bits)

    [Frame is marked: False]

    [Frame is ignored: False]

    [Protocols in frame: eth:ip:tcp]

    [Coloring Rule Name: HTTP]

    [Coloring Rule String: http || tcp.port == 80]

    Ethernet II, Src: IntelCor_xx:xx:xx (xx:xx:xx:xx:xx:xx), Dst: Tp-LinkT_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    Destination: Tp-LinkT_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    Address: Tp-LinkT_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

    Source: IntelCor_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    Address: IntelCor_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

    Type: IP (0x0800)

    Internet Protocol Version 4, Src: 192.168.3.104 (192.168.3.104), Dst: 203.151.21.63 (203.151.21.63)

    Version: 4

    Header length: 20 bytes

    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

    0000 00.. = Differentiated Services Codepoint: Default (0x00)

    .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

    Total Length: 52

    Identification: 0xade2 (44514)

    Flags: 0x02 (Don't Fragment)

    0... .... = Reserved bit: Not set

    .1.. .... = Don't fragment: Set

    ..0. .... = More fragments: Not set

    Fragment offset: 0

    Time to live: 64

    Protocol: TCP (6)

    Header checksum: 0xe7fa [correct]

    [Good: True]

    [bad: False]

    Source: 192.168.3.104 (192.168.3.104)

    Destination: 203.151.21.63 (203.151.21.63)

    Transmission Control Protocol, Src Port: 34438 (34438), Dst Port: http (80), Seq: 811, Ack: 399, Len: 0

    Source port: 34438 (34438)

    Destination port: http (80)

    [stream index: 136]

    Sequence number: 811 (relative sequence number)

    Acknowledgement number: 399 (relative ack number)

    Header length: 32 bytes

    Flags: 0x11 (FIN, ACK)

    000. .... .... = Reserved: Not set

    ...0 .... .... = Nonce: Not set

    .... 0... .... = Congestion Window Reduced (CWR): Not set

    .... .0.. .... = ECN-Echo: Not set

    .... ..0. .... = Urgent: Not set

    .... ...1 .... = Acknowledgement: Set

    .... .... 0... = Push: Not set

    .... .... .0.. = Reset: Not set

    .... .... ..0. = Syn: Not set

    .... .... ...1 = Fin: Set

    [Expert Info (Chat/Sequence): Connection finish (FIN)]

    [Message: Connection finish (FIN)]

    [severity level: Chat]

    [Group: Sequence]

    Window size value: 245

    [Calculated window size: 15680]

    [Window size scaling factor: 64]

    Checksum: 0xa50d [validation disabled]

    [Good Checksum: False]

    [bad Checksum: False]

    Options: (12 bytes)

    No-Operation (NOP)

    No-Operation (NOP)

    Timestamps: TSval 115329792, TSecr 2352471551

    Kind: Timestamp (8)

    Length: 10

    Timestamp value: 115329792

    Timestamp echo reply: 2352471551

    No. Time Source Destination Protocol Length Info

    3764 190.334561 203.151.21.63 192.168.3.104 ICMP 94 Destination unreachable (Host administratively prohibited)

    Frame 3764: 94 bytes on wire (752 bits), 94 bytes captured (752 bits)

    Arrival Time: Jan 22, 2012 21:17:52.391277000 ICT

    Epoch Time: 1327241872.391277000 seconds

    [Time delta from previous captured frame: 0.029114000 seconds]

    [Time delta from previous displayed frame: 0.029114000 seconds]

    [Time since reference or first frame: 190.334561000 seconds]

    Frame Number: 3764

    Frame Length: 94 bytes (752 bits)

    Capture Length: 94 bytes (752 bits)

    [Frame is marked: False]

    [Frame is ignored: False]

    [Protocols in frame: eth:ip:icmp:ip:tcp]

    [Coloring Rule Name: ICMP errors]

    [Coloring Rule String: icmp.type eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11 || icmpv6.type eq 1 || icmpv6.type eq 2 || icmpv6.type eq 3 || icmpv6.type eq 4]

    Ethernet II, Src: Tp-LinkT_xx:xx:xx (xx:xx:xx:xx:xx:xx), Dst: IntelCor_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    Destination: IntelCor_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    Address: IntelCor_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

    Source: Tp-LinkT_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    Address: Tp-LinkT_xx:xx:xx (xx:xx:xx:xx:xx:xx)

    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

    Type: IP (0x0800)

    Internet Protocol Version 4, Src: 203.151.21.63 (203.151.21.63), Dst: 192.168.3.104 (192.168.3.104)

    Version: 4

    Header length: 20 bytes

    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

    0000 00.. = Differentiated Services Codepoint: Default (0x00)

    .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

    Total Length: 80

    Identification: 0x2bb0 (11184)

    Flags: 0x00

    0... .... = Reserved bit: Not set

    .0.. .... = Don't fragment: Not set

    ..0. .... = More fragments: Not set

    Fragment offset: 0

    Time to live: 56

    Protocol: ICMP (1)

    Header checksum: 0xb216 [correct]

    [Good: True]

    [bad: False]

    Source: 203.151.21.63 (203.151.21.63)

    Destination: 192.168.3.104 (192.168.3.104)

    Internet Control Message Protocol

    Type: 3 (Destination unreachable)

    Code: 10 (Host administratively prohibited)

    Checksum: 0xa203 [correct]

    Internet Protocol Version 4, Src: 192.168.3.104 (192.168.3.104), Dst: 203.151.21.63 (203.151.21.63)

    Version: 4

    Header length: 20 bytes

    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

    0000 00.. = Differentiated Services Codepoint: Default (0x00)

    .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

    Total Length: 52

    Identification: 0xade2 (44514)

    Flags: 0x02 (Don't Fragment)

    0... .... = Reserved bit: Not set

    .1.. .... = Don't fragment: Set

    ..0. .... = More fragments: Not set

    Fragment offset: 0

    Time to live: 57

    Protocol: TCP (6)

    Header checksum: 0xeefa [correct]

    [Good: True]

    [bad: False]

    Source: 192.168.3.104 (192.168.3.104)

    Destination: 203.151.21.63 (203.151.21.63)

    Transmission Control Protocol, Src Port: 34438 (34438), Dst Port: http (80), Seq: 4206775565, Ack: 950198611

    Source port: 34438 (34438)

    Destination port: http (80)

    Sequence number: 4206775565

    [stream index: 136]

    Sequence number: 4206775565 (relative sequence number)

    Acknowledgement number: 950198611 (relative ack number)

    Header length: 32 bytes

    Flags: 0x11 (FIN, ACK)

    000. .... .... = Reserved: Not set

    ...0 .... .... = Nonce: Not set

    .... 0... .... = Congestion Window Reduced (CWR): Not set

    .... .0.. .... = ECN-Echo: Not set

    .... ..0. .... = Urgent: Not set

    .... ...1 .... = Acknowledgement: Set

    .... .... 0... = Push: Not set

    .... .... .0.. = Reset: Not set

    .... .... ..0. = Syn: Not set

    .... .... ...1 = Fin: Set

    [Expert Info (Chat/Sequence): Connection finish (FIN)]

    [Message: Connection finish (FIN)]

    [severity level: Chat]

    [Group: Sequence]

    Window size value: 245

    [Calculated window size: 245]

    [Window size scaling factor: 64]

    Checksum: 0xac30 [validation disabled]

    [Good Checksum: False]

    [bad Checksum: False]

    Options: (12 bytes)

    No-Operation (NOP)

    No-Operation (NOP)

    Timestamps: TSval 115329792, TSecr 2352471551

    Kind: Timestamp (8)

    Length: 10

    Timestamp value: 115329792

    Timestamp echo reply: 2352471551

  5. still have the email? you shoud be able to on-line analyze the attachment, which will tell you what kind of crap your machine is infected with and the proper way to remove it, if that's even possible.

    if i were you, i won't even use windows would reinstall my OS from scratch and take it as a good lesson for the way I use my computer.

  6. What does your contract with the ISP say? I assume you are a home user, which will be a client on the www. If you are offering server services (i.e. other clients accessing your site), you may have to talk to your ISP to amend your contract.

    you must be a lawyer or something?

    OP, please post screenshots of your router config, problem is in there.

  7. Hmmm. The ip address 217.20.44.193 appears to be down/invalid. Unfortunately a reverse DNS look-up doesn't reveal who owns the ip address concerned. This looks like a network configuration error - probably by Telecity Group.

    host is up, most likely some crashed service...

    root@blackout:~# nmap -sS -O 217.20.44.193

    Starting Nmap 5.51 ( http://nmap.org ) at 2012-01-21 18:57 ICT

    Nmap scan report for 217.20.44.193

    Host is up (0.15s latency).

    Not shown: 994 closed ports

    PORT STATE SERVICE

    22/tcp filtered ssh

    23/tcp filtered telnet

    25/tcp filtered smtp

    49/tcp filtered tacacs

    80/tcp open http

    2222/tcp filtered EtherNet/IP-1

    OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU

    No OS matches for host

    OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .

    Nmap done: 1 IP address (1 host up) scanned in 50.75 seconds

  8. That's not exactly right either. A good analogy would going to Big C with Harry Potter (WAIT WHAT A BRITISH CREATION OH NOOOOES) and Harry would multiply bottles of Samsong. Then you'd leave with one of the magic bottles without paying and bring it to the date you have with Hermione.

    • Like 1
  9. Also, for any of you who just like to bash the US, then go back to your own country and start producing creative, intellectual property and see if you like it.

    this could have been a great trolling attempt but you're being serious so that's extremely pathetic.

  10. I'm being so serious that I'm posting here to ask you to stop making false accusations of stealing. I'm not saying this is right, I'm asking you to please be serious.

    Also, I'm not asking the copyright holders to help me find a way/pay from their pockets to make my business field as profitable as it were 15 years ago without adapting my business to the world we're living in. So basically, the answer to your question is: I don't care.

  11. Providing remote storage is not the the same as copyright infrigement. Otherwise, we should just shutdown the internets as it's the way to access copyrighted material. MU had a DMCA policy to remove copyrighted files on demand. Lastly, sorry to disappoint you USA but your laws are not World Wide Laws.

    Also, copying is not equal to stealing (cf. the dumb Big C example somewhere above).

    Copying anything copyrighted without paying for it is stealing. (Please attempt to be civil.)

    no it's not stealing, it's called copyright infringement.

    • Like 1
  12. Providing remote storage is not the the same as copyright infrigement. Otherwise, we should just shutdown the internets as it's the way to access copyrighted material. MU had a DMCA policy to remove copyrighted files on demand. Lastly, sorry to disappoint you USA but your laws are not World Wide Laws.

    Also, copying is not equal to stealing (cf. the dumb Big C example somewhere above).

×
×
  • Create New...