On Sun, Oct 27, 2002 at 10:08:17PM +0100, Wolfgang Pfeiffer wrote:
> On Oct 27, 2002, 11:47 (-0800) Rob Saul wrote:
> > On Sunday, October 27, 2002, at 11:19 AM, Wolfgang Pfeiffer wrote:
> > >
> > > So what is this "Windows probing port 137" thing .. does this mean
> > > every Windows home user machine on WWW probes other machines it thinks
> > > are part of its LAN or so?
> >
> > Well, once possibility is a new piece of spamware that probes for open
> > Windows boxes and pops up Messenger Service dialogs when it can.
> >
> > bit more info here : http://www.theregister.co.uk/content/55/27634.html
I THINK the port 137 probes are coming from BUGBEAR virus, or so I've
been told. I get 30-40 of them a day in my firewall logs.
I've also had a few on port 445, which I think is the messaging
issue you spoke of, but nowhere NEAR as many as on 137.
> ... yeppers, thanks, that seems to be it:
> (Excerpt:)
> #########################
> So we have here essentially a NetBIOS attack tool. It's capable of
> attacking entire IP ranges, but will not (the company says) get past a
> firewall or provide a hyperlink in the alert to the attacker's
> commercial Web site.
> ##########################
>
> That seems to fit my logs:
> These whole scans are happening nearly all time I'm connected to www:
> Months ago I got scanned perhaps once or twice per hour when being
> online, now (as I said previosly) the scans come extremlely shortly
> after having connected my machine to the Internet (this is new, IIRC),
> and extremely often to port 137, and the whole scanning activity
> against my machine seems to have increased about 10 or 15 times as
> much compared to 2 or 3 months ago ...
>
> Gentlefolks, you might want to check your firewalls ... :)
>
> Wolfgang
--
---- Fred Smith -- [EMAIL PROTECTED] -----------------------------
The Lord detests the way of the wicked
but he loves those who pursue righteousness.
----------------------------- Proverbs 15:9 (niv) -----------------------------
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@;redhat.com?subject=unsubscribe
https://listman.redhat.com/mailman/listinfo/redhat-list
