> > Obviously they didn't filter 135, 137-139, 445, and 4444 inbound > > Not obvious. I know of several sites that were infected even though they > had filters in place, due to infected laptops being brought on-site. Filtering ports 135, 137-139, 445, and 4444 only delays the inevitable...