RE: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread Keith Purtell
t the sender by reply email and destroy all copies of the original message. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Monday, March 31, 2003 4:28 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] P

RE: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread SECURITY
I had this happen also several times, about 2 months ago, I did everything you mentioned below. A friend had me download a utility called spybot, which found a cookie in my internet explorer that launches popup ad's automatically. Once I removed this, I haven't seen any since. http://spybot.safer-n

Re: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread R. Scott Perry
Don't know if this is related to spam or not... This morning I logged onto the NT4 server where we host both our web and mail server. Immediately noticed a Messenger Service box (like you get with "net send" from dos prompt) containing a typical spam message (edited): "From our Research Dept ..

RE: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread John Tolmachoff
And it is Spam, not a hack. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Purtell > Sent: Monday, March 3

RE: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread John Tolmachoff
Most likely cause is open ports 137-139 from Internet or Messenger programs. (MS Messenger, AOL Messenger, Yahoo messenger.) John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com > -Original Message- > From: [EMAIL PROTECTED]

RE: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread Colbeck, Andrew
Yep, it's a known "feature". The deal is that although you may be blocking NetBIOS on your firewall, you can do a programmatically do a "net send" to port 135, which you can't unbind from your external NIC. You need to firewall your machine to cut off this unwanted ingress. Doubly so because of

Re: [Declude.JunkMail] Possible exploit on mail server

2003-03-31 Thread Sanford Whiteman
> Don't know if this is related to spam or not... This morning I > logged onto the NT4 server where we host both our web and mail > server. Immediately noticed a Messenger Service box (like you get > with "net send" from dos prompt) containing a typical spam message > (edited): "F