RE: Stopping Admin Alert SPAM

I blocked port 135 (TCP/UDP) at the firewall...haven't seen another one since.

--Jay Lagorio

http://www.lagorio.net/

-----Original Message-----

    From: "Ed Sunder" <edsunder@3hd.com>     Sent: 1-23-2003 11:45:43 AM
    To: "focus-ms@securityfocus.com" <focus-ms@securityfocus.com>     Subject: Stopping Admin Alert SPAM     

    Okay, I haven't found a good answer to this online and would appreciate     any advice this group has... Our servers are being deluged with Admin     Alert Spam's. At a certain point, particularly over a weekend, with no     one actively looking at the machine, if there are enough messages it can     cause some services to shut down. I read that blocking ports 137-139     would stop these messages, but I did that in our firewall and yet the     messages still came.     

    I'm wondering:

1. If I disable the messenger service on the server, could there be any bad ramifications of that, other than potentially not receiving legitimate messages about system shutdowns etc.? Also, would that stop

• Is there some other way to stop these messages? Are they coming in on another port etc.?

      Any help on this would be appreciated.     Thanks in advance,     

      Ed Sunder
      Three HD      Received on Fri Jan 24 10:03:17 2003

  Do you need help?

  In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek