I Get A Message Broadcast Across My Entire Network And I Dont Know Why? Any ideas?

[Shurafa]

I recently installed 2000 server on one of my machines to host my website and to get some practice in configuring servers. However for some reason I get advertisements in the for of a wierd popup that get broadcast across my entire network and I cant get rid of it.

I formatted all 5 machines and it came back within a day. I reformatted the server again and used better passwords and used the IIS lockdown tool yet i still get the messages.

No idea what the problem is any help would be greatly appreciated.

[ilovetheusers]

Hello and welcome! Need more info.

What does the popup say?

Is it a popup window from IE or are you talking about something else?

How do you access the internet and are all of these machine hooked up?

Does it come up on it's own?

Do they have up to date virus scanners on them?

[Shurafa]

Thank you for the welcome, this place seemd pretty cool I think I may stay, (any other good tech forums out there?)

The pop ups say different things (usually tobuy something) and have an IP address on them.

The pop ups are like nothing I have seen before. It looks like a modified IE window that is much smaller (like a popup) and does not have the min/maximize option on it.

Also they broadcast across all 5 machines at the same exact time. At what seems like random intervals.

After I formatted the machines (5 of them) I installed mcafee on the three XP boxes. However it does not work on the two servers.

I tried zone alarm but then I could not get to my website so I need to learn how to configure it better before I try that again.

[Stalemate]

No need to format your machines, your network appears to be victim of this: http://torrez.net/archives/windows_net_send_spam.php.

McAfee will not work against this type of spam. Trace the sender's IP and block it in your firewall settings once you get the hang of it.

[Shurafa]

Yep that is exactly what is hitting me.

So I need to get zone alarm and learn how to configure it?
Is there any other way to prevent it?

thx for the info btw

[NooNoo]

You need a firewall - whether hardware or software - you need one to block the ports that those things get sent on. If you have a fixed ip for the internet, I would suggest you get a hardware firewall.

Have you patched 2k server? There are hundreds of nasties out there waiting to find unpatched servers.

[Shurafa]

I am patched and passworded however I have a dynamic IP and dont really know how to configure zone alarm very well.

Guess I am going to have to learn. Well that is how I have learned just about everything I know about computers (good old trial and error).

[NooNoo]

The free version of ZA does not auto configure for sharing the internet connection... You may wish to consider buying. Other products that will do the same for you - free are AnalogX and Kerio.

[MacGyver]

You're a victim of Messenger Spam. (Not to be confused by MSN or Windows Messenger) You need to do two things:

Close port 139. That is a spam and hacker magnet!

Visit this website and find out how to shut down messenger service: http://www.techtv.com/screensavers/a...374542,00.html

[Stalemate]

MacGyver'a last post would be the easiest way to secure your network right now against this specific "spam attack".

If you intend on getting a software firewall, I'm currently using Kerio. We had a thread on that topic a while ago here: Kerio Personal Firewall.

Have fun!

[Garfeild_Cat]

Uhmmmmmmmmm... This is only using pop up windows messenger to spam your network???

Does your network have a legit need for windows messenger???

If your network does not have a legit use for windows mess. turn that feature off in Windows "services".


It is amazing the number of items that people have running on their servers that are NOT used OR needed.......

Just my 2cents

[GokuSS2]

Check out this links to your OS.



Windows XP Service Info

Windows 2000 Service Info

These will let you Fine tune your OS.

[Shurafa]

Thank you for the info guys. I have learned alot over the past week or so.

[Chris_MacMahon]

on the win2k machine type this from a command prompt



net stop messenger


and if you want to enable messenger again

net start messenger


if it's a service that you don't need to this it's fast and it's a cure...

just make a quick batch program, put it in the start up folder....

later

[Rô©kHøµñÐ]

Man i love the messenger service, I hate the pricks that have been using it lately, but sometimes i need to acces my home computer at mork so i do a net send to let everyone know that im logging on.

I also use it at work to contact other admins.