"Gatewayserver" is underattack

[unforgiven78]

Hello

I believe this is a DDOS attack against my server, Take a look yourself:

First i get this error from "Gatewayserver"



Then,
"SMC" service becomes "Red" and everytime i click "start service" it becomes "Red" again in 2 seconds



I tried to replace "Gatewayserver.exe" with another one but it didn't work
Please help, tell me what to do?

Thank you

[Kape7]

Close the SMC when that happens and check if keeps happening on the gateway, that msg is a patch preparation msg sent from the SMC.
I assume you have globalmanager port closed.

[unforgiven78]

Originally Posted by Synx7

Close the SMC when that happens and check if keeps happening on the gateway, that msg is a patch preparation msg sent from the SMC.
I assume you have globalmanager port closed.

It happens while SMC is closed, i'm using win server 2008 r2 it is allowed for all necessary ports to connect. my server has been running well for a longtime i don't know why this happens now?!

[Wayne3]

Block the IP of the attacker.

[unforgiven78]

Originally Posted by Wayne3

Block the IP of the attacker.

Well it's a temporary solution, he would not mind change his IP and attack again. i got his msg:

"Hey ** .. i'll keep attacking ur game and make it Check 24/7 .. so let's make a deal when u come back .. and i hope when u read my msg u will remsg me .. if u care about ur game"

thank you

[Wayne3]

Thats true. Where did you got the message?

[Schickl]

1.perfmon(.exe) and monitor traffic
2.find out the port this guy obviously uses
3.close port(firewall ya know)
4.????
5.profit

[royalblade]

easiest and most complete way to fix is replace the vsro gateway with the black rogue gateway.



Click the first link and follow the tutorial
No advertisment intended

[InPanic Kev]

With blackrouge you will have the same problem if you dont belive i can close your gateway server ^^

add me on Skype : ip-kev

maybe i can help you

[Ninja_Stylez]

Haha that one is easy... someone is using srDos_2.exe against you. To fix it you need new gateway server, which usually ***** up auto-update so you will have to use 2 gateway servers. One for updates only (just switching them for 1-2 mins to make the auto update then u run the fixed one again). The exploit itself is sending packets that SMC sends for auto-update which makes GW close.

 Spoiler

Dizzie*RZ*:There was leaked security programs from my computer by friends.

Here is the fix for it:

Just load GatewayServer with ollydbg.
right click -> Search for -> All commands

write there:
PUSH 6308


Just double click on it and change the number to whatever you want.

I wont write down the rest, its not an ODBG guide =)

Edit:
There is another exploit too, which will (how to say properly...) disconnect gatewayserver from smc/cert. Works almost the same way as the other.

Just change 631D opcode to something else and everything should be fine again