[windows2000] Re: Windows Messenger via a proxy?

  • From: "Dean Theophilou" <dino7@xxxxxxxxxxxxx>
  • To: <windows2000@xxxxxxxxxxxxx>
  • Date: Tue, 15 Oct 2002 18:22:50 -0700

I got something like that the other day, also, but it wasn't offering
diplomas....

Dean Theophilou


This message contains information which may be confidential and privileged.
Unless you are the addressee (or authorized to receive for the addressee),
you may not use, copy, or disclose to anyone the message or any information
contained in the message.  If you have received the message in error, please
advise the sender by e-mail reply to dino7@xxxxxxxxxxxxx, and then delete
the message.

-----Original Message-----
From: windows2000-bounce@xxxxxxxxxxxxx
[mailto:windows2000-bounce@xxxxxxxxxxxxx]On Behalf Of Jim Kenzig
Sent: Tuesday, October 15, 2002 7:10 AM
To: windows2000@xxxxxxxxxxxxx
Subject: [windows2000] Re: Windows Messenger via a proxy?


I just got the same thing the other day on my server. It really threw me for
a loop.  I scanned with every virus scanner known to man and tried to trace
it but got nowhere. I am not sure how the heck they did this but I turned
off the windows messenger service just to be safe.
JK

-----Original Message-----
From: windows2000-bounce@xxxxxxxxxxxxx
[mailto:windows2000-bounce@xxxxxxxxxxxxx]On Behalf Of Scott Ehrlich
Sent: Tuesday, October 15, 2002 9:51 AM
To: scott@xxxxxxxxxx
Subject: [windows2000] Windows Messenger via a proxy?



We have a Windows Messenger message pop up on a machine, shown as being
sent from another host, but we don't believe anyone from the "originating"
host actually sent the message.

The popup offers diplomas.   We've only started receiving popups recently
and I've advised on how users can disable the messenger service to get rid
of the annoyance.  This particular popup did NOT appear to be a broadcast,
as our two NT 4 servers did not receive the message and they have messenger
service enabled.

Thus begs the question - is it possible to use/compromise a Windows host as
a proxy?  If so, it may mean the "originating" host is compromised.

Thanks for any leads.


Scott

==================================
To Unsubscribe, set digest or vacation
mode or view archives use the below link.

http://thethin.net/win2000list.cfm


==================================
To Unsubscribe, set digest or vacation
mode or view archives use the below link.

http://thethin.net/win2000list.cfm

Other related posts: