New Firewall -- port probing detected

[PepperDog]

Well I just set up a new (read: better) software based FW and have been noticing numerous port probes to UDP port 135. They are ALWAYS from overseas (large asian country) and happen in rapid succession every few hours or so.

I've got pretty much everything locked down with the firewall and my Netgear router working in combination, but I still keep seeing these port probes to UDP 135. BTW, I recently upgraded to XP from W98SE, and I never noted this happening, but my previous firewall software didn't provide any great logging or monitoring features that I used or was even aware of.

Can someone tell me a little about this and if I should be at all concerned? I've read up a little on various websites but haven't really been able to decide if this is anything serious or not -- it doesnt seem like a real big deal. At the least I am a bit angry at someone trying to screw with my network, even if they aren't successful. Don't people have better things to do than randomly port scan?!? Geez.

 

[Oaf357]

You should be blocking ports 135-139 at your router. What you're seeing is common (these days) but could definitely be bad if unmanaged.

Someone else will get into the details I'm sure.

 

[skyking]

That is the port used by messenger service. Unless you use messenger for network broadcasts (Pizza is here, woohoo!!!)( network will be shut down for 5 minutes for maintanence, etc.), then it should be disabled on all machines. There is a rash of unsolicited spamming going on, check out the link in this thread for one of the websites. net send spam
Basically, these scum have discovered that 60-70% of the machines can be reached with an automated "net send" advertisement. I saw it in action the other day, and it made an IE pop up storm look like a walk in the park!!!!

Microsoft should help out the users and let them know how to turn it off, if they have not already.

 

[PepperDog]

Thanks for the replys guys. I've now configured my router to drop all incoming TCP and UDP packets on ports 135-139.

After reading the http://61.129.75.229/~antimessage.com/ site, I'm fairly positive this is the origin. What a crock! I've been very successful at avoiding email spam, now this garbage! Sheesh. :|