Re: windows messenger spam

From: Michael Bednarek (mb@tgm.com.au)
Date: 11/05/02 

From: mb@tgm.com.au (Michael Bednarek)
Date: 4 Nov 2002 17:06:48 -0800

"Torgeir Bakken (MVP)" <Torgeir.Bakken-spam@hydro.com> wrote in message news:<3DBFAF01.6421B719@hydro.com>...
> Adam wrote:
>
> > I would like to make notice of this and would like to know
> > if anyone can tell me how to disable the windows
> > messenging service so that ads like this are not accepted
> > by computers.
>
> Hi
>
> Properly configure a firewall is what you should do. Block access to ports 135,
> 137-139, and 445.
>
> Windows Messages
> http://www.jmu.edu/computing/security/info/winmsg.shtml
>
> myNetWatchman Alert - Windows PopUP SPAM
> http://www.mynetwatchman.com/kb/security/articles/popupspam/
>
> Wired: Spam Masquerades as Admin Alerts
> http://www.wired.com/news/technology/0,1282,55795,00.html

I always had ports 137-139 blocked, and I still get these pop-ups.

I'm a bit reluctant to block port 135 because it seems to be needed
for Exchange. Similarly, I think port 445 is used during logon over
our VPN.

Does anybody have any experience running an NT network where ports
135/445 are blocked at the firewall?

Relevant Pages

  • Re: "Network" icon
    ... To close a number of ports, GRC suggests to use the Network icon and re-configure bindings to a certain indicted form. ... There seems to be no control of Server Types, no way to uncheck "i want to enable NetBIOS over TCP/IP" on any and all protocol lines, no way to install NetBEUI, and no way to change/set hardware adaptor bindings. ... 1- The information on the GRC page is severely out of date, it was written pre Windows 2000, it makes absolutely no mention at all of any operating systems post 1998. ...
    (microsoft.public.win2000.general)
  • Re: Strange ports open
    ... but both NetBIOS / Windows networking and Exchange open ... I recommend keeping a log of the ports found open ... Administration Tools [Server Manager, User Manager, Event Viewer, Registry ...
    (microsoft.public.security)
  • Re: New/old Trojan?
    ... > looking on google ... anything on Windows systems, ... Sounds like this malware may have rootkit-like ... ports can be useless. ...
    (Incidents)
  • Re: [fw-wiz] how prevelant
    ... over the same few ports), and the tendency of script kiddies to run ... Windows attack tools, I tend to suggest that if you open your firewall up ... > it amazing they were passing domain information across the internet. ...
    (Firewall-Wizards)
  • RE: Microsoft Windows SBS 2003 Communication Issues
    ... you should configure Windows firewall by group ... Microsoft CSS Online Newsgroup Support ... Identifying and opening ports ...
    (microsoft.public.windows.server.sbs)