[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: port 137 scans


On Mon, Oct 28, 2002 at 03:21:54PM +0100, Russell Coker wrote:

> On Mon, 28 Oct 2002 15:11, Scott wrote:
> > They are SPAM messages being set to the Windows Messenger service.  We got
> > several clients who were blasted with: "Get Your Degree" in a windows
> > pop-up.  There are spam utilities that now do this.
> The technical description linked from the Wired article on the topic
> says that it's port 135.  Does the spam use both ports 135 and 137?

135 runs a DCE/RPC portmapper service.

Apparently the spam service is quite well-behaved, if it doesn't just
assume port 137 but asks DCE-'portmapper' at 135 for the correct port
first. Protocol-wise, that is, of course. ;-)



E-Advies / Emile van Bergen   |   emile@e-advies.info
tel. +31 (0)70 3906153        |   http://www.e-advies.info

Attachment: pgp8j_d1qiDgj.pgp
Description: PGP signature

Reply to: