Archived copy of http://www.chatnet.org:80/nethelp.html as of 1999-04-27 · original content, not edited · ChatNet Old Stuff

Answers Solutions to
Nuking and Icmp Attacks
 
Nuking and Icmp across the internet are used to Crash systems
and disconnect people from the internet.
This page was made help people understand
and protect and detect yourself from such attacks.
 
[Winuke Info and Protection]
 
[Icmp/SSping Info and Protection]
 
[Emailing The Provider]
 
[Detection Programs and Methods]
 
 
 

 
 
 
WinNuke AKA "Blue Screen of Death"
On a computer running Microsoft Windows 95 (all releases) using the Microsoft TCP/IP
protocol, the following error message may occur when certain data is received over
the network with a blue screen: 
Fatal exception 0E at 0028:<address> in VxD MSTCP(01) + 000041AE.
This was called from 0028:<address> in VxD NDIS(01) + 00000D7C.
After this error message occurs, the computer may not receive further network data
until Windows is restarted. 
Update to Windows 95 TCP/IP to Address Out-of-Band Issue
http://www.microsoft.com/kb/articles/q168/7/47.htm
 
Solution
 
To install these updated files, follow these steps:
1.Download the Vtcpupd.exe file to an empty folder.
2.In My Computer or Windows Explorer, double-click the Vtcpupd.exe file you
downloaded in step 1.
3.Follow the instructions on the screen.
The following file(s) are available for download from the Microsoft Software Library:
Vtcpupd.exe (size: 253144 bytes)
 
http://www.microsoft.com/kb/softlib/mslfiles/Vtcpupd.exe
 
Test Your Patch see if it "Works" Go to this site:
http://206.148.240.160/~dirk/winnuke.html
 
ICMB/SSPING aka "Jolt"
Computers running Windows NT or Windows 95 may stop responding (hang) when they
receive corrupt Internet Control Message Protocol (ICMP) datagram fragments from a
client. also modem lights on my win95 modem icon when the incoming light is 
pegged on and stays that way due to the rapid incoming Data. 
 
SSPING/Jolt is a program which effectively will freeze of almost any
Windows95 or Windows NT connection. It's based on old code which
freezes old SysV and Posix implementations. It works basically by sending
a series of spoofed & fragmented ICMP packets to the target, which build
up to be a 64k ping, and Windows95/NT
then ceases to function altogether.
Solution
 

 
Windows 95
This issue is resolved by the following updated file for Windows 95 and OSR2:
Vip.386 version 4.0.956 (dated 6/30/97) or later
This file is included in the self-extracting Vipupd.exe file.
To install this update, follow these steps:
1.Download the Vipupd.exe file from the online service listed below to an empty folder.
2.In My Computer or Windows Explorer, double-click the Vipupd.exe file you
downloaded in step 1.
3.Follow the instructions on the screen.
The following file are available for download from the Microsoft Software Library:
~ VIPUPD.EXE (size: 171672 bytes)
http://www.microsoft.com/kb/softlib/mslfiles/VIPUPD.EXE
 
Windows NT 3.51
NOTE: Service Pack 5 must be applied to Windows NT 3.51 prior to applying this fix.
This hotfix has been posted to the following Internet location:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/hotfixes-postSP5/icmp-fix
 
Windows NT 4.0
NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to applying this fix.
This hotfix has been posted to the following Internet location:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/icmp-fix
 
Emailing the Provider:
 
 
Email your proof of nuke or icmp to the Provider, by sending the email 
to the perpetrator's domain (host.domain) to both abuse@domain and 
root@domain. 
example: if the nuker is canton15.imperium.net, you would send
email to abuse@imperium.net and cc to root@imperium.net
You need to include all of the following information:
a) log file of the nuke or icmp attack
b) IP of the attacker
c) any relevant IRC logs, preferably timestamped
d) time of day
e) your time zone, preferably in relation to GMT
f) /whois information on the attacker, if s/he is on IRC at the time of the attack
Politely explain what occured, the proof you have, and the frequency of 
attack, if a chronic problem, and request that the provider take action 
against the perpetrator.
 
Detection Programs and Methods
 
Skream's port listen
 
http://skream.simplenet.com/plisten/
 
Port Listen Intructions txt
 
Nuke Nabber*
 
http://www.dynamsol.com/puppet/files/
netscape users - hold down the shift key and click on nn29.exe
internet explorer just click on nn29.exe
 
Nuke Detecter
 
ftp://ftp.devware.com/nukedet/
 
Arp Scanner
 
Icmp Dos Arp Scanner for Win95