blocking popup messages

My sbs2000 is connected to the net via dialup connection...
in the last weeks, i started receiving lots of annoying "spam popups"....
i read that the most simple solution is to disable the "messenger" service,
but on a server i won't like doing this.....
is there another way with sbs to block this popups??
thnx in advance
bye

Kevin
Mon Sep 01 08:08:34 CDT 2003

disabling Messenger services may be an easy fix, but it is certainly NOT the
recommended solution - as it only avoids the problem, and does not fix it. A
properly configured firewall should be blocking this.

Are you getting this on your workstations or your server? if workstations,
which OS?

Meanwhile, take a look at the following:
http://support.microsoft.com/?id=330904
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

-kw

"Davide Beggio" <xxxdbeggio@raminformatica.it> wrote in message
news:OPftXdHcDHA.1272@TK2MSFTNGP12.phx.gbl...
> My sbs2000 is connected to the net via dialup connection...
> in the last weeks, i started receiving lots of annoying "spam popups"....
> i read that the most simple solution is to disable the "messenger"
service,
> but on a server i won't like doing this.....
> is there another way with sbs to block this popups??
> thnx in advance
> bye
>

Davide
Mon Sep 01 08:28:45 CDT 2003

The problem is on the sbs2000 server....the workstations are fine.
The only firewall I have is ISA of course, because I use a standard modem
directly connected to the server; therefore I think that the server is not
behind ISA....
thank you
bye


"Kevin Weilbacher" <kweilbac@gte.net> ha scritto nel messaggio
news:OhavmoIcDHA.1744@TK2MSFTNGP12.phx.gbl...
> disabling Messenger services may be an easy fix, but it is certainly NOT
the
> recommended solution - as it only avoids the problem, and does not fix it.
A
> properly configured firewall should be blocking this.
>
> Are you getting this on your workstations or your server? if workstations,
> which OS?
>
> Meanwhile, take a look at the following:
> http://support.microsoft.com/?id=330904
>
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp
>
> -kw
>
> "Davide Beggio" <xxxdbeggio@raminformatica.it> wrote in message
> news:OPftXdHcDHA.1272@TK2MSFTNGP12.phx.gbl...
> > My sbs2000 is connected to the net via dialup connection...
> > in the last weeks, i started receiving lots of annoying "spam
popups"....
> > i read that the most simple solution is to disable the "messenger"
> service,
> > but on a server i won't like doing this.....
> > is there another way with sbs to block this popups??
> > thnx in advance
> > bye
> >
>
>

Mal
Mon Sep 01 08:14:16 CDT 2003

Sounds like you have port 135 open to the 'net. This is bad, and probably
indicitive of no packet filtering operating at all. Make sure you have
packet filterign operating on your exteranl IPs.

Mal Osborne
MCSE MVP Mensa


"Davide Beggio" <xxxdbeggio@raminformatica.it> wrote in message
news:OPftXdHcDHA.1272@TK2MSFTNGP12.phx.gbl...
> My sbs2000 is connected to the net via dialup connection...
> in the last weeks, i started receiving lots of annoying "spam popups"....
> i read that the most simple solution is to disable the "messenger"
service,
> but on a server i won't like doing this.....
> is there another way with sbs to block this popups??
> thnx in advance
> bye
>

Mariette
Mon Sep 01 10:12:34 CDT 2003

In news:eMs0wGJcDHA.1748@TK2MSFTNGP12.phx.gbl,
Davide Beggio <xxxdbeggio@raminformatica.it> wrote:


> Please, how can I check this??

Run the ICW from Administrator Console. I get the impression that ISA is not
doing anything at the moment for you. What network layout do you have? Do
you have two Nic's in your server?

--
Mariette Knap [SBS MVP]
www.smallbizserver.net

Susan
Mon Sep 01 12:01:23 CDT 2003

This "spamming" is telling you that you've got a hole in your firewall.

Outside NIC, properties, tcp/ip properties, click on advanced, click on WINS,
click on "Disable NetBios over tcp/ip" on that outside NIC.

Davide Beggio wrote:

> >
> > Run the ICW from Administrator Console. I get the impression that ISA is
> not
> > doing anything at the moment for you. What network layout do you have? Do
> > you have two Nic's in your server?
>
> If possible, I wouldn't run ICW.....in my configuration it seems to do a lot
> of mess.....
> so, this is:
> one sbs server, with two nic's, one connected to the lan [10.0.0.2], and one
> connected to the dsl modem [192.168.0.1], to connect to internet I use the
> raspppoe protocol. If I run the ICW, I already know I would connect anymore
> to the net, cause sbs "fight" with the RASPPPOE protocol.....I know that
> using a router/firewall is the best solution, but at the moment this is the
> situation.......
> can I do anything manually to stop this spamming???
> thanx
>
> >
> > --
> > Mariette Knap [SBS MVP]
> > www.smallbizserver.net
> >
> >

--
"Don't lose sight of security. Security is a state of being, not a
state of budget. He with the most firewalls still does not win.
Put down that honeypot and keep up to date on your patches. Demand
better security from vendors and hold them responsible. Use what
you have, and make sure you know how to use it properly and effectively."
~ Rain Forest Puppy

http://www.wiretrip.net/rfp/txt/evolution.txt

Mariette
Mon Sep 01 16:43:30 CDT 2003

In news:eO7lcFKcDHA.1880@TK2MSFTNGP10.phx.gbl,
Davide Beggio <xxxdbeggio@raminformatica.it> wrote:

> If possible, I wouldn't run ICW.....in my configuration it seems to
> do a lot of mess.....
> so, this is:
> one sbs server, with two nic's, one connected to the lan [10.0.0.2],
> and one connected to the dsl modem [192.168.0.1], to connect to
> internet I use the raspppoe protocol. If I run the ICW, I already
> know I would connect anymore to the net, cause sbs "fight" with the
> RASPPPOE protocol.....I know that using a router/firewall is the best
> solution, but at the moment this is the situation.......
> can I do anything manually to stop this spamming???

If you don't get your server setup the way it supposed to be, run the ICW,
nobody can guarantee you that you are safe. If your internet device needs
rasppoe I suggest you put a router between your server and the internet
device that does the ppoe dialin for you.

You are playing a dangerous game at the moment, anybody can compromise/hack
your server if you receive popups.

--
Mariette Knap [SBS MVP]
www.smallbizserver.net

Mal
Tue Sep 02 06:28:55 CDT 2003

Many things fight with 3rd party PPPoE dialers. Sometimes they fight with
themselves even. These things can be a big headache in anything less than
a single NIC workstation, it is well worth spending the few extra $$ to get
this thing off your server IMHO. Most ADSL modems these days will do the
PPPoE authentication for you, if you are sure yours does not, then I would
be trading up to one that does. Does not need to be anything fancy at all.
It will pay for itself in saved time and stress.

Mal Osborne


"Davide Beggio" <xxxdbeggio@raminformatica.it> wrote in message
news:eO7lcFKcDHA.1880@TK2MSFTNGP10.phx.gbl...
> >
> > Run the ICW from Administrator Console. I get the impression that ISA is
> not
> > doing anything at the moment for you. What network layout do you have?
Do
> > you have two Nic's in your server?
>
> If possible, I wouldn't run ICW.....in my configuration it seems to do a
lot
> of mess.....
> so, this is:
> one sbs server, with two nic's, one connected to the lan [10.0.0.2], and
one
> connected to the dsl modem [192.168.0.1], to connect to internet I use the
> raspppoe protocol. If I run the ICW, I already know I would connect
anymore
> to the net, cause sbs "fight" with the RASPPPOE protocol.....I know that
> using a router/firewall is the best solution, but at the moment this is
the
> situation.......
> can I do anything manually to stop this spamming???
> thanx
>
>
>
> >
> > --
> > Mariette Knap [SBS MVP]
> > www.smallbizserver.net
> >
> >
>