Re: Source of Windows PopUp SPAM

[Michael Katz <mike () procinct com>]

At 10/16/2002 07:39 AM, Ron Trenka wrote:

> on 10/15/02 12:29 PM, Lawrence Baldwin at baldwinL () mynetwatchman com wrote:
>
> > What is also interesting is that some users, despite running personal
> > firewalls, are still reporting getting these popups.  This probably 
> explains
> > the developers choice to use MS RPC (udp/135) for delivery instead of a
> > straight Netbios SMB call (tcp/139).  MS RPC would be less overhead, but
> > also has the potential to reach more people as even those with 
> firewalls are
> > often giving 'svchost.exe' server priviledges because they assume it's
> > necessary:
> >
> > http://www.dslreports.com/forum/remark,4718327~root=security,1~mode=flat
>
> Anyone have a way to disable this on W2K and NT 4.0 servers?

Stop and disable the Messenger service.

Michael Katz
mike () procinct com
Procinct Security


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com