Another New Worm or Worm Variant?

From: David Gillett (gillettdavid_at_fhda.edu)
Date: 12/11/03

  • Next message: Jim Harrison (ISA): "RE: services.exe file" 
    To: <incidents@securityfocus.com>
Date: Thu, 11 Dec 2003 12:17:18 -0800

      Lately, I seem to be seeing various Internet addresses trying
    to do a UDP/137 (NetBIOS name service, match "*") of our whole
    address block.
      Of course I've seen UDP/137 traffic before, and have been
    blocking it for ages, but I don't recall seeing methodical scans
    using it.
      Anyone know what tool/worm this is?

    Dave Gillett

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Jim Harrison (ISA): "RE: services.exe file"

    Relevant Pages

    • Re: What is FQDN ?
      ... Active Directory setup Wizard didn't add my computer name which is "DC1DNSAD". ... Connection-specific DNS Suffix. ... I think at one Point AD Setup Wizard ask you Question What should be NETBIOS ... How to Configure OEx for Internet News ...
      (microsoft.public.windows.server.dns)
    • Re: netbios vuln
      ... Don't get hung up over the reference to NetBIOS. ... > computer with spurious internet traffic, ... > server had a DDOS attack and was offline for a short ... > Its network manager Mark Frater said two individuals ...
      (Incidents)
    • Re: Internet Explorer file:// URL issues
      ... Subject: Internet Explorer file:// URL issues ... > remote host via NetBIOS. ... LAN shares and Internet shares. ...
      (Bugtraq)
    • Re: Domain Name too long? - Problems
      ... It's very clear in the KBs I've looked at that MS strongly recommends ... against using a Netbios name over 14 characters long. ... > wanted to connect the clients, this wasn't possible because there were ... > real domain name in the Internet, ...
      (microsoft.public.windows.server.sbs)
    • New Computer - XP
      ... can stop it (Mcafee support tell me that im on the ... Your Internet port 139 does not appear to exist! ... Unable to connect with NetBIOS to your computer. ...
      (microsoft.public.windowsxp.security_admin)