Newsgroup: it.comp.reti.locali
Titolo: Messaggi di Anna Falchi....

Mentre mi sto scervellando per risolvere i problemi con la bella collega e
la sua posta in Outlook, mi accorgo che il server della azienda di cui andrò
ad occuparmi, pur in maniera relativa, ha delle belle finestre nelle quali
si invita a visitare il sito di Anna Falchi...!!! Classiche finestre di
avviso di win, grigie...
Dopo averne chiuse 4 o 5 , tutto tace...(fino al giorno dopo).
So che è possibile inviare questi messaggi all'ip statico, ma cosa sono,
come funzionano e come si possono levare ?
Spero di essere stato chiaro...
Grazie
Fabrizio


normalmente si eliminano disabilitando il servizio messenger.
Cristiano


esatto č il window messenger. Vai su Pannello di controllo -> Strumenti di
amministrazione -> Messenger, clicca su "disattiva" e su "arresta servizio".
Cristiano (un altro)
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/


Grazie 1000 a tutti e due i Cristiani !
Fabrizio

 rete non ci arrivi neppure.
Uh ... mi hai preceduto di 2 secondi :-) stavo per
postare la stessa cosa .. ho il "vago sospetto"
che la rete aziendale non abbia neanche uno
straccio di firewall ... bello !! Com'è l'IP :-) ????

 ha scritto nel messaggio
news:c0il22$17e9ei$1...@ID-180886.news.uni-berlin.de...

Ehmmmm purtroppo l'IP non lo ricordo....
Eppure il firewall c'è ed è ISA server....
Fabrizio

 Eppure il firewall c'č ed č ISA server....
Hm ... magari installato senza abilitare
il packet filtering .. o configurando ISA
"con i piedi" .. cosě invece di un firewall
c'č una fogna a cielo aperto :-)
Fai un bel portscan all'ISA dall'esterno
poi vedi se veramente il firewall funge
o meno, l'ideale sarebbe collegare un
pc Linux all'esterno di ISA e lanciare
uno scan nMap o Nessus, se non puoi
farlo, un altro test potrebbe essere quello
che trovi qui (anche se non č la stessa
cosa naturalmente)
http://scan.sygatetech.com
prova le varie scansioni (tcp, udp...) e
vedi che risultato ottieni
Ciao

 Ciao
Spero non sia troppo lungo, ho fatto fare alla collega lo scan come mi hai
detto da quel sito....
Ecco i risultati, mi sembrano abbastanza sconcertanti.....
Your system ports are now being scanned and the results will be returned
shortly...
Note: Only OPEN ports will be displayed.
Results from scan of all ports from 1 to 1024 at TCP/IP address: *****.****
Service  Ports  Status  Additional Information
SMTP 25 OPEN SMTP is used to send email across the internet. This allows an
attacker to verify user accounts on your system, send anonymous (spam)
email, or even access files on your hard drive.
unknown 42 OPEN none
DNS 53 OPEN Domain Name Services are used to resolve host names to IP
addresses.
WEB 80 OPEN HTTP web services publish web pages. A misconfigured web server
can not only offer an attacker needed information about his target, but it
can allow for various security breaches.
unknown 88 OPEN none
POP3 110 OPEN Post Office Protocol is used to receive email. It can be used
by attackers to create fake email addresses, execute programs, and even
intercept your private email. Scanning ports 111 to 120 . . .
unknown 119 OPEN none
NetBIOS 139 OPEN NetBios is used to share files through your Network
Neighborhood. If you are connected to the internet with this open, you could
be sharing your whole hard drive with the world! This is a very dangerous
port to have open.
unknown 143 OPEN none
unknown 389 OPEN none
unknown 427 OPEN none
HTTPS 443 OPEN Secure Web Servers are often used by banks and online
vendors.
Server Message Block 445 OPEN In Windows 2000, Microsoft added the
possibility to run SMB directly over TCP/IP, without the extra layer of NBT.
unknown 464 OPEN none
unknown 563 OPEN none
unknown 593 OPEN none
unknown 636 OPEN none
unknown 691 OPEN none
unknown 993 OPEN none
unknown 995 OPEN none
We are now determining if you have a firewall blocking UDP ports on IP:
213.156.49.42
Note: this may take a while on highly secure systems...
We have determined that you do not have any firewall blocking UDP ports!
Your system ports are now being scanned and the results will be returned
shortly...
Note: this may take up to one minute on some ports!
Results from UDP scan of commonly used ports at IP address: ***.***
Service  Ports  Status  Additional Information
FTP DATA 20 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
FTP 21 CLOSED This port has responded to our probes. This means that you are
not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
SSH 22 CLOSED This port has responded to our probes. This means that you are
not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
TELNET 23 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
SMTP 25 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
DNS 53 OPEN Domain Name Services are used to resolve host names to IP
addresses.
DCC 59 CLOSED This port has responded to our probes. This means that you are
not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
DHCP SERVER 67 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
FINGER 79 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
WEB 80 CLOSED This port has responded to our probes. This means that you are
not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
POP3 110 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
SUNRPC 111 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
IDENT 113 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
Location Service 135 OPEN Microsoft relies upon DCE Locator service (RPC) to
remotely manage services like DHCP server, DNS server and WINS server.
NetBIOS-NS 137 OPEN Windows/Samba file and print sharing.
NetBIOS-DGM 138 OPEN Windows/Samba file and print sharing.
NetBIOS 139 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
HTTPS 443 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
Server Message Block 445 OPEN In Windows 2000, Microsoft added the
possibility to run SMB directly over TCP/IP, without the extra layer of NBT.
SOCKS PROXY 1080 CLOSED This port has responded to our probes. This means
that you are not running any application on this port, but it is still
possible for someone to crash your computer through known TCP/IP stack
vulnerabilities.
UPnP 1900 CLOSED This port has responded to our probes. This means that you
are not running any application on this port, but it is still possible for
someone to crash your computer through known TCP/IP stack vulnerabilities.
WEB PROXY 8080 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
Results from UDP scan of commonly used trojans at IP address: 213.156.49.42
Service  Ports  Status  Possible Trojan
Trojan 6776 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
Trojan 12345 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
Trojan 20034 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
Trojan 31337 OPEN Baron Night, BO client, BO2, Bo Facil, BackFire, Back
Orifice, DeepBO
Trojan 54320 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.
Trojan 54321 CLOSED This port has responded to our probes. This means that
you are not running any application on this port, but it is still possible
for someone to crash your computer through known TCP/IP stack
vulnerabilities.

 Ciao
Spero non sia troppo lungo, ho fatto fare alla collega lo scan come mi hai





***.***




Results from UDP scan of commonly used trojans at IP address: ***.***


 Ecco i risultati, mi sembrano abbastanza sconcertanti.....
<snippone>
Appunto... come volevasi dimostrare ...
ISA server tutto aperto, nessun packet
filter, nessuna sicurezza ...tanti auguri :-)

 ha scritto nel messaggio
news:c0irh5$17ko0s$1...@ID-180886.news.uni-berlin.de...

Bene, almeno sappiamo da dove cominciare....
Bel casino, eh ?
Mi sa che se mi fanno occupare di quella rete, dovrò prendermi un bel
carrello di manualoni da leggere...
In bocca la lupo anche a me....
Grazie dell'aiuto, comunque...
Fabrizio

 manualoni da leggere...
Beh ... inizia abilitando il packet filtering in ISA
almeno mantieni la situazione piů "pulita" poi
prosegui installando/aggiornando tutti gli AV
e facendo una scansione completa su tutte
le macchine (servers inclusi) a quel punto
fatti il segno della croce ed inizia a passare
windowsupdate a manetta dappertutto (ed
ovviamente passa anche le patch per ISA)
poi beh ... penso dovresti essere in grado
di andare avanti ...
Ciao
-- 
* ObiWan
DNS "fail-safe" for Windows 2000 and 9X clients.
http://ntcanuck.com
Support and discussions forum
http://ntcanuck.com/net/board
408 XP/2000 tweaks and tips
http://ntcanuck.com/tq/Tip_Quarry.htm

 Grazie dell'aiuto, comunque...
In bocca al lupo davvero...:)
PS: non dire in azienda che hai pubblicato su un NG i risultati di un
portscanning del genere, con tanto di IP....potrebbero non prenderla
bene...imho...
Ciao
Giorgio


 portscanning del genere, con tanto di IP....
Uh ... dov'è l'IP che non l'ho visto ??
A meno che tu non ti riferisca al poster
IP ... ma (in teoria) stando a quello che
scriveva Fabrizio, la macchina con ISA
dovrebbe essere su di un'altro IP ... ;-)

 ha scritto nel messaggio
news:c0j1hd$17kjsf$1...@ID-180886.news.uni-berlin.de...

E va bene che sarò stupido, ma darvi da fare nel week end nooo ehehehee...
Comunque quella macchina, nell'altra azienda, dovrà pure cambiare ip, credo,
visto che cambierà il gestore della adsl a breve...
Insomma, sarebbe meglio cominciare da zero che avere quella da sistemare.
Comunque grazie, a un non esperto questi consigli del ng servono come l'oro
Fabrizio

 questi consigli del ng servono come l'oro
Hm .. magari anche questi link :-)
http://www.isaserver.org
http://www.isatools.org/
studia, studia :-)
