On Thu, 14 Jul 2005 21:30:20 -0400, Rick T wrote:

N. Miller wrote:
On Thu, 14 Jul 2005 13:32:09 -0400, Rick T wrote:


thought it might be something like that, thanks... any real purpose for
those specific ports? (looking it up it's supposed to be DNS auxiliary
or something like that, but if they're never used I'm blocking them).


Access to the Messenger Service for Windows XP, 2K, and, maybe, NT. For
spam. I believe that unpatched systems are also vulnerable to a worm
attack; just don't recall which worm. Something to do with DCOM? RPSS?

You might have to block ports all the way up to 1030, or 1032.


hmm, don't want to cut the kids messenger service off (and I'm already
blocking 5K)

Thanks,


Rick

There are three "Messengers", thanks to MSFT choosing to use a confusing
nomenclature.

Windows Messenger Service:

Only available with Windows 2K, Windows XP, and, maybe, Windows NT (very
old OS). Used by Windows network administrators for distributing notices to
system users. Uses port 135, and the lowest of the ephemeral ports
(beginning with port 1025). UDP packets. Also used by spammers, and RPC
worms, to try to reach users with unprotected systems on Internet
connection. Completely unrelated to any of the instant message services;
certainly can't access, or be accessed by, IM servers.

Windows Messenger 4.7(?):

Only available with Windows XP. Necessary for remote desktop sharing, or
whatever that application is. Can access, and be accessed by the MSN
Messenger servers.

MSN Messenger 7.0 (latest version):

Standalone IM product that runs under all versions of Windows except
Windows 95.

Restricting the functionality of the Windows Messenger Service will not
affect the use of the MSN Messenger service.

I expect some MVP will now clarify any errors I have made...

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint