New ways to spam you
Microsoft's operating systems allow people to send you pop-up network messages, exploiting a little known network administrator's tool called Windows Messenger Service (which is not related to MSN's instant messaging) -- if you are exposed to the Internet directly. If you're behind a firewall or on a local subnet, such as in the case of the gateway/router, you're probably safe from these annoying little popups.
CIAC (Computer Incident Advisory Capability) writes:
Sites that have a firewall that blocks the Windows networking ports (135, 137-139, and 445) are already protected from this spam. This particular spam engine starts with a connection to port 135 rather than the NetBIOS ports (137-139 and 445) and then connects to a port above 1024 but future spam engines could use the NetBIOS ports as well. The Messenger service generally should not be disabled or shut down because different programs use it to pass messages to a user. System managers also use it to warn of impending network actions such as server shutdowns.
It is possible to use the IP Filtering feature of Windows to block the incoming connections at the machine but the filter’s options are “Permit All” or “Permit Only ”. To make the filter work, you must use the “Permit Only
” option and supply the list of all allowed open ports. TCP Filtering is part of the Advanced Properties of the TCP/IP Protocol in the Networking control panel. Note also that blocking incoming connections to ports (TCP and UDP) 135, 137-139, and 445 at a machine may prevent that machine from participating in Windows Networking. We have seen one company (www.coffeecup.com) that is offering a filter for these ports that keeps the ports open for network communications but blocks the spam messages. More....
