Just a quick reminder: close at least port 135 to 139 and 445. We have one win2000 machine here (a client's not our's ;) and it shows a damn high activity at these ports. Last weekend some dumb head pushed two gigs through this machine within a few hours. Don't know how he did it - doesn't interest me anyway. ;)