Remove Messenger Worm on filter

RouterOS General
1

We have a campus network working great with 100 % Mikrotik solution. My first implementation and I am not looking anywhere else for further deployment.


We have filter implemented as per wiki,

add chain=Virus protocol=udp dst-port=135-139 action=add-src-to-address-list
address-list=virus address-list-timeout=0s comment=“Messenger Worm”
disabled=no
add chain=Virus protocol=udp dst-port=135-139 action=drop comment=“Messenger
Worm” disabled=no

We are seeing few megabyte on this filter. and on address list it seems every hotspot address is captured.

Is this really a worms that should be drop and anyone knows how can this be cleaned on the user laptop.

We also have a few more virus that was drop but not as much as the Messenger worms.

any insight is much appreciated

thx

2

So no one is blocking this port ???

or

You are blocking the port and not seeing any activities

3

Been blocking those and others for years. Lots of activity. Not just bad stuff but packets that don’t belong out on the net.

4

Thanks GotNet,

I am a novice to networking..and RouterOS.

I was just wondering with so much activities on some ports maybe something can be done to stop it before it start to escalate or it was just a false alarms.

I have gone thru the process of building the wireless ptp,ptmp, hotspot,webproxy, bridging ,usermanager,etc.. with this forum help…and happy with the result… and now comes the managing part.


Thks