Windows messenger new spammer tool ?

[MCSkibadee]

windows messanger is the same as MSN Messanger but it dont have all the features as msn messanger. u mite aswell download msn messanger

[t2k2]

Neb, I just tested it by running a windump while I sent a net send message to someones machine, and it picked it up as traffic with a destination port of 139 just as you may have been thinking.

[nebulus200]

Thanks for looking into that, always nice to have some time saved

So I guess the lessen is, if you are getting these messages, you should be looking into maybe filtering out all netbios traffic (udp/137, udp/138, tcp/139). Aside from fixing the messenger thing, you would also be protecting yourself from user enumeration via null sessions, improper securing of administrative shares, and several other popular windows hacking methods.

/nebulus

[Highlander]

Hi All;

I do not have Messenger service active on a
Windows 2000 Pro box I use as a DNS/HTTP and
Game Server. Everytime I remote in I have
a Pop Up add from some sort of non-accreded
group.... very annoyining!!!

So far no attempted hack attacks on it....
I do not use IIS on that box. (Do you think I am NUTS!!!)
What port do I have to block ??
or how do I stop it ???

Now If I learn to read the other posts
on Antionline... I would not have to ask
so many DUMB Questions!!!

[CXGJarrod]

Highlander: Put a personal firewall on the machine. I have ZoneAlarm loaded on my machine and it blocked all pop-ups.

[stuart]

We got hit by this on six of our machines last Friday. The only thing they had in common is that they were all upgraded from NT4.0 to 2000. It uses the Windows Messenger Service not MSN Messenger. We stopped it by opening the Services Manager and shutting down and disabling the messenger service. I am also asking the firewall guy to block all netbios/netbui ports.

I also would think that this would be illegal. The company that makes the software http://www.directadvertising.com claims it to be perfectly legal. Not in my eyes!

Stuart

[El Diablo]

what's funny is there is an online game that I play where someone reported this very thing happening to him over the weekend. He said it's been going on for him for about a week until he figured out how to turn it off.

I had never thought of this as an avenue for advertising... spammers have sunk to a whole new level.



El Diablo

[Tedob1]

the real shame about what their doing is that it falls under the IM catagory which is pretty much unregulated.if we wanted to stop this legally it would require even more government regulation. like we need that. i really wish scum bags like this would just dry up and blow away like the scabs they are.

[nebulus200]

I forgot to mention something in the previous post I made regarding which ports to block to block the messenger/netbios. I neglected to mention that Win2k has its own netbios like port 445/tcp, so need to block that as well.

/nebulus

[valhallen]

windows messanger is the same as MSN Messanger but it dont have all the features as msn messanger. u mite aswell download msn messanger

MSN messanger is a complete IM service allowing real time chat with multiple people as well as p2p file transfers - windows messanger is built in to the operating system and allows other people to send msgs to your pc using the net send command

eg:

net send xxx.xxx.xxx.xxx then your msg here

or on a local network

net send computername then your msg here

see there is quite a dif between the 2

v_Ln