From: Mike N. 

On Tue, 4 May 2004 22:03:02 -0400, "Geo."  wrote:

>We blocked 5554 this time, doesn't stop the exploit but does stop spreading
>of the worm and doesn't break anything in the process.

  I did a double take at who wrote the message.  You BLOCKED something?
What about requests from port > 1024 which happens to be 5554?   How does
blocking 5554 stop spreading - no Microsoft services use that port?
Shouldn't you be blocking 445 instead?

--- BBBS/NT v4.01 Flag-5