How Net Send Spammers Work (+ FIX)

[spools.exe]

The following is a code that sends the word "spam" as a message to an entire IP range.
I would like to explain how this code works.

This is basicly for people who want to understand how their chosen to receive spam.

#!/usr/bin/perl -w
#!C:\Perl\bin\perl.exe -w
$message_text = "spam";
places the word "spam" in a variable called "message_text"
$first_x2_ip = "192.168";
Set starting range of IP's (192.168) in variable "first_x2_ip"

"Im going to break an IP address into sections... A.B.C.D When i refer to part "A" of the IP 192.168.0.3 i'm refering to 192 adn when i refer to C i'm refering to 0."

for ($countb=0; $countb<257; $countb++) {
Starts 192.168.0.0 and ends 192.168.257

for ($counta=1; $counta<257; $counta++) {
For Every Addition to section "C" do a loop for part "D". 192.168.C.0 to 192.168.C.257
$send_message_to = "$first_x2_ip.$countb.$counta";
Sets send_message_to as the generated IP... 192.168.C.D
&message_send;
Call Function MESSAGE_SEND
}

}

sub message_send {
system("net send $send_message_to = $message_text");
Use net send to send message to the value of send_message_to (Generated IP). The message will be the variable message_text ("spam")
print "$send_message_to\n";
Display on screen the person who just got the spam message.
}

=======================================
FIX
=======================================
Goto StratMenu>>RUN>> Type "Services.msc"
Something Should Pop-Up
Right-Click on the Service called "Messanger" and select Properties
Click on General Tab

Under Service Status Click The "STOP" Button.

On the same tab, under "Startup Type" select "Disabled"

Click Apply

Your All Done!


I belive that if you have Ad-Aware installed then most likely the messenger service has already been disabeled.

[nihil]

Fot those who don't feel confident: go to http://www.grc.com and get "shoot the messenger"

This site is well worth browsing around anyway

Cheers

[=FeN-i-X=]

also most firewalls will filter that kind of incomming traffic over the internet.

[tampabay420]

yes, you can set up your firewall to block these types of messages, although a simple drop rule may screw up some other services...


btw-

for ($counta=1; $counta<257; $counta++) {

not trying to bust yer chops here or nothin' but i think 255/254 would be enough (as apposed to 257)

[spools.exe]

that code above is an actual code used by spammers. I noticed that it had 257 but considerind that i didn't write it i wanted to keep it the same. It might even have a purpose.