Windows has found CRITICAL SYSTEM ERRORS, on a Linux box.

dalek

Well, I don't have to ask for to much help but this one has me sort of stumped. I'm on dial-up and every once in a while I see a little bit of data even though nothing is going on, including email. I closed everything and even stopped ntp and used Wireshark to capture this. Can someone tell me what the heck this is? Is this that little pop up window that pops up on windoze? I use Bell South, aka AT&T now, and so does my brother. His windoze XP "claims" someone is trying to hack in and Norton stops it. Is this true? Well, before I call out the Special Forces or something, what is this?

Rob1n · Posted: Wed Aug 01, 2007 12:22 pm Post subject:

Yes - this looks like a Windows Messenger alert. It'll just be a spam or phishing attack. Since you're not running messenger then there's no real issues - you probably ought to look into installing a basic firewall though.

Akkara · Posted: Wed Aug 01, 2007 12:24 pm Post subject:

It appears to be a packet targeted at windows message service that pops up a dire-warning-looking box which directs the user to a website that offers malware (the red click-here link is a .exe which is probably up to no good.)

Edit: I lose the typing speed race

dalek · Posted: Wed Aug 01, 2007 4:44 pm Post subject:

I have iptables installed on here but everything is set to wide open right now. Iptables always worried me. I screwed up once and had no internet until I figured out how to open it all up again. I'll have to change that when I get DSL though.

What should I do about my bro's on his XP? Should I report this to the ISP so they can do something to stop them, you know, like AOL did with the spammer. It appears that Norton is blocking it on his machine but we all know how windoze is. :lol:

It's funny, that thing does that a good bit. I only sent one packet but there was more.

Thanks

_________________
My rig: Gigabyte GA-970A-UD3P mobo, AMD FX-8350 Eight-Core CPU, ZALMAN CNPS10X Performa CPU cooler,
G.SKILL 32GB DDR3 PC3 12800 Memory Nvidia GTX-650 video card LG W2253 Monitor
60TBs of hard drive space using LVM
Cooler Master HAF-932 Case

Rob1n · Posted: Wed Aug 01, 2007 8:24 pm Post subject:

You can report it to the ISP - I doubt they'll do anything about it though. You best bet is just to make sure you have a decent firewall (and anti-virus, anti-spyware, etc) to protect against this sort of thing (and Norton wouldn't be my first choice!). He may want to look at http://www.techsupportalert.com/best_46_free_utilities.htm for some useful protective tools.

dalek · Posted: Thu Aug 02, 2007 12:18 am Post subject:

That sounds like a start. Now just to help me make sure I am off to a great start with iptables. Is this the part that says what port it is using and that I would have to block:

roderick · Posted: Thu Aug 02, 2007 3:37 am Post subject:

There are many firewall scripts that utilize IPTABLES. I suggest you install one of them instead of configuring iptables manually.

For example:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23091

dalek · Posted: Thu Aug 02, 2007 6:02 am Post subject:

I know that I need port 80 open for web browsing, ports 110 and 25 for email if I recall correctly. What other ports should be open? I don't currently run sshd or anything here. I'm not sure what port portage uses for ftp, sync etc either.

I think where I messed up last time was that I put the drop rule at the top as the first rule and it just dropped everything and looked no further for matching rules. From what I have read, that rule should be last not first. LOL It was fun though. I'm just glad I hadn't saved the rules and that restarting iptables fixed it.

I found a great, I mean GREAT, howto once. It was super easy to understand but now I can't find it. I had it bookmarked but now I can't find the bookmark either.

I'm sleepy right now and I may have to go out of town to meet a "lady friend" so I may start working on that in a few days. I don't want to start something only to get half way through and have to stop.

I do have webmin installed though. It has a nice GUI thing for iptables and shorewall. That may help me some.

Thanks

_________________
My rig: Gigabyte GA-970A-UD3P mobo, AMD FX-8350 Eight-Core CPU, ZALMAN CNPS10X Performa CPU cooler,
G.SKILL 32GB DDR3 PC3 12800 Memory Nvidia GTX-650 video card LG W2253 Monitor
60TBs of hard drive space using LVM
Cooler Master HAF-932 Case

Hu · Administrator Joined: 06 Mar 2007 Posts: 23091

You need to be able to connect to those ports, yes. If you are only setting up a filter on inbound traffic, you do not need to open those ports unless you plan to offer those services from your machine to other systems.