Flighting back for NET SEND SPAM

I talked about NET SEND SPAM and methods to stop it later. Now it is the time to fight back.

Who sent the spam?

"What is the IP address of the spammer?" You probably eager to know. Well. It is not easy. It is almost impossible to get the IP address of the sender. If you are very technical and want to know more about the details, please read this article first.

Install a firewall

A better way than shutting down the Messenger service is to install a firewall. By install a firewall, you gain the follow benifit.

1. You eliminate NET SEND SPAM and other kind of attack and virus.
2. You log the IP address of all attackers so you can take actions to fight back.

There are handful of great personal firewall software available. If you are using Windows XP, you already have a firewall installed. It is called Windows Internet Connection Firewall (a.k.a. ICF). You only need to follow these steps to enabled it.

To enable or disable Internet Connection Firewall

1. Open Network Connections (Click Start, click Control Panel, and then double–click Network Connections.)
2. Click the Dial–up, LAN or High–Speed Internet connection that you want to protect, and then, under Network Tasks, click Change settings of this connection.
3. On the Advanced tab, under Internet Connection Firewall, select one of the following:
• To enable Internet Connection Firewall (ICF), select the Protect my computer and network by limiting or preventing access to this computer from the Internet check box.
• To disable Internet Connection Firewall, clear the Protect my computer and network by limiting or preventing access to this computer from the Internet check box. This disables the firewall, your computer and network are then vulnerable to intrusions.

Source: Use the Internet Connection Firewall to Secure Your Small Network

Enable Firewall logging

This is a good article on how to enable firewall logging. After you enable the logging, you keep the record of all attack to your server.

Analysis the report

On of the easy way is to utilize myNetWatchMan. Follow the steps to register and download an agent. The agent will check the log file on your computer and send the attack information to the server. After aggregating all the report from many agents (about 5000+ currently), it will send abuse compliane to the network owner, thus prevent futher spam.

You can also check for yourselves. Here is an sample from my personal firewall log:

2002-11-08 21:38:25 DROP UDP 195.252.113.35 211.161.107.5 1026 137 78 - - - - - - -

If you find a lot DROP lines from a source while it indicates port is UDP 137, it seems like a spam.

Use this command in Command line (replace the IP address with the IP you saw in your log file

NBTSTAT -a 195.252.113.35

You will get return like this:

Local Area Connection:
Node IpAddress: [157.60.112.235] Scope Id: []

NetBIOS Remote Machine Name Table

Name Type Status
===========================================
SPAM-01 <00> UNIQUE Registered
SPAM <00> GROUP Registered
SPAM-01 <20> UNIQUE Registered
SPAM <1E> GROUP Registered

MAC Address = 00-10-A4-BB-E2-C3

Note the last line: it is the MAC address of the spammer. MAC address is the serial number of a Network Interface card. It is burnt into the chip and cannot be changed. Unfortunately, there is no reliable way to narrow down to certain geographic location from IP address. But by know the MAC address, it is very solid evidence that the package is sent out from the computer of the MAC address owner.

We need more

The topic of NET SEND SPAM never stops. I will fine tune this article and replace some general concept to some resources and steps. I believe we need to unite to fight back to NET SEND SPAM.

by Jian Shuo Wang on November 20, 2002 under Spam

1. Infected by Spam Virus? November 1, 2006
2. Wang Yang Lee (ICBC) May be Fraund October 5, 2006
3. ifuleuiycfi - I Really Admire You, Spammers February 21, 2006
4. The City and Its Moral Boundary January 9, 2006
5. Closed Trackback October 14, 2005
6. Hit by Caribe.sis Virus via Bluetooth October 9, 2005
7. MTBlackList is Better than IP Banning July 27, 2004
8. Appologize from Baliforyou November 11, 2003
9. EndAds.com Caught by FTC November 6, 2003