If using NT 4.0: Start->Settings->Control Panel->Network->Services, click on Netbios, then click "remove". Everytime you reboot after this you'll get a warning in the logfile that the messenger service could not be started unless you remove it too. If you're running IIS on the machine you'll also get a warning that NMC could not locate the domain list. It will work fine anyway.
If you're using Win2K server the procedure should be similar but I'm not using it so I can't say for sure. If you're not using SNMP I would kill that too. If you're using it you should make the community names damned hard to guess. Unless you've changed it the default is "Public". Makes it real easy to pull a list of the accounts set up on the machine. David Daniels System Administrator Starfish Internet Service [EMAIL PROTECTED] ----- Original Message ----- From: "Marc Funaro" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, October 11, 2002 11:36 AM Subject: RE: [IMail Forum] Virus on the server? > Could you provide a step-by-step on how to "turn off Netbios and SNMP"? > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of Mailadmin > > Sent: Monday, September 23, 2002 4:59 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [IMail Forum] Virus on the server? > > > > > > If the messenger service is running that means Netbios is > > also running. If > > this machine is directly connected with no firewall you need > > to turn off > > Netbios and SNMP! You are leaving yourself wide open. > > > > David Daniels > > System Administrator > > Starfish Internet Service > > [EMAIL PROTECTED] > > ----- Original Message ----- > > From: "Jonas Fornander" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Monday, September 23, 2002 2:54 PM > > Subject: [IMail Forum] Virus on the server? > > > > > > > > > > I woke up this morning with my Imail server running a > > Messenger service > > > popup window, looping through each IP address on the > > server. The Event > > > viewer popup message was: > > > > > > Application popup: Messenger Service : Message from > > CONGRATULATIONS to > > > 63.209.65.212 on 9/22/2002 11:21:05 PM > > > You have just won 25 FREE cigars! > > > To claim your prize, please visit: > > > www.smokeshop.bz > > > > > > Windows explorer was also running in some kind of loop. > > > > > > Has anyone run into this? > > > The only thing I can think of is that someone executed > > something via the > > > webmail. > > > Has a hacker found a way to compromise the Webmail? > > > > > > Jonas Fornander - System Administrator > > > Netwood Communications, LLC - www.netwood.net > > > Find out why we're better - 310-442-1530 > > > > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > > List Archive: > > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
