application popup tracking

[Ovatvvon]

I made some posts regarding this issue a couple weeks ago, but I never really got an answer to this questions:

How can I find out what the IP address is of the sender of this new style of SPAM being sent via Messenger Service? It's not available in the Event Viewer.


Example:
-----------------------------
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 11/6/2002
Time: 6:27:45 PM
User: N/A
Computer: XXXXXXXXXX
Description:
Application popup: Messenger Service : Message from CXX49 to XXX.XXX.XXX.XXX on 11/6/2002 6:27:45 PM

CONGRATULATIONS YOUR A WINNER !

You won a vacation for two.

Just complete the special finalists' registration
form and be sure to include your Confirmation Number:

Confirmation Number: H-9312D

http://www.emailpioneer.com/getaway/index.html

-Ovatvvon :-Q

 

[dankelt]

You could do a netstat right after you see the message and try to find it that way. Depending on how they are sending the message you would see connections on UDP ports 137, 138, or TCP ports 135, 139, 445

Only other way I can think of is with some kind of firewall. I use RedHat linux with iptables myself. With that, I can log access to certain ports. You could probably use something as simple as ZoneAlarm to find the source IP address. Either way, you should have some kind of firewall.