Popups/Port 135 is open on computer

[Rhonda]

We keep getting gray popup ads that say: Port 135 is open
on your computer or If you are receiving this message you
are actively broadcasting your IP address over the
internet. They want us to suscribe to their product that
will supposedly block these unwanted ads. Isn't there
something that can be done for free? I have downloaded
all the latest patches, etc. How do I secure my
computer? Help!! Rhonda

 

[mamabear]

If they are "Messenger Service" popups, see here:
http://www.lavahelp.com/articles/v6/03/05/0302.html
A good free Popup killer (not "Messenger Service" popups)
is Popup Manager. You can get it here:
http://www.endpopups.com/ You should also download and run
Adaware (free version) from http://www.lavasoftusa.com/
It detects and safely removes dataminers, tracking
cookies, dialers, BHO's and other objects from your
computer. Use "webupdate" before you scan to make sure
you have the latest ref file (open Adaware and click on
the globe or "Check for Updates Now"). The ref files are
updated frequently - sometimes several times a week. Run
a "full scan"
http://www.lavahelp.com/howto/fullscan/index.html
If you have any questions, their forums are here:
http://www.lavasoftsupport.com/
Steve Gibson has a tool to check the vulnerability of Port
135 and disable it if necessary - You can get it here:
http://grc.com/dcom/

 

[Oli Restorick [MVP]]

http://www.microsoft.com/protect/

I would take issue with the lavahelp page that says that the steps under
"workaround" in the KB article may be suitable for most users.

http://www.microsoft.com/protect/

If, in the light of Blaster and the probability that there is another
similar exploit just around the corner, anyone thinks that turning off
Messenger but leaving port 135 exposed on the Internet is a good, they need
shotting.

http://www.microsoft.com/protect/

Basically, you need to get yourself a firewall. The fact that you're
getting the popups shows that you're vulnerable to getting the Blaster worm
if you haven't applied the patch. Even if you have applied the patch, don't
consider yourself safe.

http://www.microsoft.com/protect/

For Windows 2000, ensure you have SP4 and the MS03-026 and MS03-039 patches
at the very least.

http://www.microsoft.com/protect/

Oli