[lug] using tcpdump to emulate effects of packet dump

[D. Stimits]

I'm slowly gathering more information to destroy what I consider to be 
an illegal exploit of a MS vulnerability (they are not using a web 
service or email service port, but directly entering the machine using a 
known *vulnerability* of windows, and threatening to not stop causing 
crashes of applications that can't handle this, unless I pay them 
money...the rest is argument up for debate), the dreaded message service 
popup spam (not the messenger service of ICQ or intended communications, 
but instead the popups used to run system management warnings, e.g., the 
non-web popup you might expect to see when an UPS goes to battery power 
and is telling you that system failure is occuring). To that end, I have 
snort logs, tcp packet dumps, and firewall logs. At the moment, they 
(www.byebyeads.com) switched from their Broomfield, CO. IP address, and 
are now using one registered in China, 210.5.22.20.

I am interested in taking my packet dumps, and sending them to one of my 
machines when booted to windows, in order to test a few ideas (I'd like 
to see www.byebyeads.com out of business by publishing a cure for 
free...I might even brush off my VC C++ compiler just for this 
occasion). To aid understanding for reverse engineering ways to defeat 
them, how would I take a full tcpdump and send it to one of my windows 
machines? Here is a sample, with my IP removed:

03:15:35.050646 210.5.22.20.32771 > x.x.x.x.1026:  [udp sum ok] udp 663 
(ttl 238, id 34612, len 691)
0x0000	 4500 02b3 8734 0000 ee11 04c1 d205 1614	E....4..........
0x0010	 XXXX XXXX 8003 0402 029f 96a1 0400 2800	..I...........(.
0x0020	 1000 0000 0000 0000 0000 0000 0000 0000	................
0x0030	 0000 0000 f891 7b5a 00ff d011 a9b2 00c0	......{Z........
0x0040	 4fb6 e6fc e80e 4ea9 a9a9 31f2 ea31 9a4a	O.....N...1..1.J
0x0050	 616b 0140 0000 0000 0100 0000 0000 0000	ak. at ............
0x0060	 0000 ffff ffff 4702 0000 0000 0f00 0000	......G.........
0x0070	 0000 0000 0f00 0000 436f 6d70 7574 6572	........Computer
0x0080	 2041 6c65 7274 0000 0e00 0000 0000 0000	.Alert..........
0x0090	 0e00 0000 436f 6d70 7574 6572 2055 7365	....Computer.Use
0x00a0	 7200 0000 0302 0000 0000 0000 0302 0000	r...............
0x00b0	 2020 2020 2020 5354 4f50 2054 4845 5345	......STOP.THESE
0x00c0	 204d 4553 5345 4e47 4552 2050 4f50 5550	.MESSENGER.POPUP
0x00d0	 2041 4453 2054 4f44 4159 210a 0a23 2323	.ADS.TODAY!..###
0x00e0	 2323 2323 2323 2323 2323 2323 2323 2323	################
0x00f0	 2323 2323 2323 2323 2323 2323 2323 2323	################
0x0100	 2323 2323 2323 2323 2323 2323 2323 2323	################
0x0110	 2323 2323 2323 2323 230a 0a47 6f20 746f	#########..Go.to
0x0120	 2077 7777 2e45 4e44 4144 532e 636f 6d20	.www.ENDADS.com.
0x0130	 6e6f 7720 746f 2073 746f 7020 6164 7665	now.to.stop.adve
0x0140	 7274 6973 656d 656e 7473 2069 6e20 6d69	rtisements.in.mi
0x0150	 6e75 7465 732e 0a0a 7777 772e 454e 4441	nutes...www.ENDA
0x0160	 4453 2e63 6f6d 2068 6173 2068 6967 686c	DS.com.has.highl
0x0170	 7920 6566 6665 6374 6976 6520 6d65 7373	y.effective.mess
0x0180	 656e 6765 7220 706f 7075 7020 626c 6f63	enger.popup.bloc
0x0190	 6b69 6e67 0a73 6f66 7477 6172 6520 7468	king.software.th
0x01a0	 6174 2077 696c 6c20 656c 696d 696e 6174	at.will.eliminat
0x01b0	 6520 7468 6573 6520 7479 7065 7320 6f66	e.these.types.of
0x01c0	 2061 6473 2066 6f72 6576 6572 2e0a 0a4e	.ads.forever...N
0x01d0	 6576 6572 2062 6520 626f 7468 6572 6564	ever.be.bothered
0x01e0	 2062 7920 6d65 7373 656e 6765 7220 706f	.by.messenger.po
0x01f0	 7075 7020 6164 7320 7768 696c 6520 796f	pup.ads.while.yo
0x0200	 7572 2077 6f72 6b69 6e67 210a 5669 7369	ur.working!.Visi
0x0210	 7420 7777 772e 454e 4441 4453 2e63 6f6d	t.www.ENDADS.com
0x0220	 2074 6f20 7374 6f70 2074 6865 7365 2070	.to.stop.these.p
0x0230	 6f70 7570 7320 696d 6d65 6469 6174 656c	opups.immediatel
0x0240	 792e 0a0a 5072 6573 7369 6e67 204f 4b20	y...Pressing.OK.
0x0250	 7769 6c6c 206e 6f74 2074 616b 6520 796f	will.not.take.yo
0x0260	 7520 746f 2077 7777 2e45 4e44 4144 532e	u.to.www.ENDADS.
0x0270	 636f 6d20 736f 200a 7772 6974 6520 646f	com.so..write.do
0x0280	 776e 2074 6865 2077 6562 7369 7465 2062	wn.the.website.b
0x0290	 6566 6f72 6520 7072 6573 7369 6e67 204f	efore.pressing.O
0x02a0	 4b2e 0a0a 7777 772e 454e 4441 4453 2e63	K...www.ENDADS.c
0x02b0	 6f6d 00                                	om.

What I'd like to do is first create a simple app that will generate 
these spams on my local network, and then write a windows app to defeat 
it (lots of learning curve there, I'm a linux guy!). Any recommendations?

D. Stimits, stimits AT comcast DOT net