I've heard about this also. I haven't had it happen to me because I am blocking all ports except ones I want with my router. I believe there are two ways people are sending these messages. One is with netbios/SMB, UDP ports 137-139, and TCP port 139 and 445. The other is using RPC, UDP port 135.
Just block these ports from the internet. Or Dissable your messenger service. But you may want to start blocking ports anyways, some may see it as a slight security hole.
Although our firewall is very secure, we have many links to customer sites as we look after their ERP systems, some are pretty secure and some are not, I have a feeling the message may be coming through one of these links.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.