Another New Worm or Worm Variant?

From: David Gillett (gillettdavid_at_fhda.edu)
Date: 12/11/03

  • Next message: Jim Harrison (ISA): "RE: services.exe file" 
    To: <incidents@securityfocus.com>
Date: Thu, 11 Dec 2003 12:17:18 -0800

      Lately, I seem to be seeing various Internet addresses trying
    to do a UDP/137 (NetBIOS name service, match "*") of our whole
    address block.
      Of course I've seen UDP/137 traffic before, and have been
    blocking it for ages, but I don't recall seeing methodical scans
    using it.
      Anyone know what tool/worm this is?

    Dave Gillett

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Jim Harrison (ISA): "RE: services.exe file"

    Relevant Pages

    • Re: What is FQDN ?
      ... Active Directory setup Wizard didn't add my computer name which is "DC1DNSAD". ... Connection-specific DNS Suffix. ... I think at one Point AD Setup Wizard ask you Question What should be NETBIOS ... How to Configure OEx for Internet News ...
      (microsoft.public.windows.server.dns)
    • Re: computer name length issue
      ... This length is reflective of the old NETBIOS computer name which was 8 characters, 15 on then newer Windows OSes. ... However, what Microsoft did a long time ago when they finally added Internet support over its NETBIOS based LAN support, was WINS which ties the IP address of the machine with the netbios computer name. ... That is only TRUE when the network administrator has made it that way via DNS and WINS. ...
      (microsoft.public.vc.language)
    • Re: netbios vuln
      ... Don't get hung up over the reference to NetBIOS. ... > computer with spurious internet traffic, ... > server had a DDOS attack and was offline for a short ... > Its network manager Mark Frater said two individuals ...
      (Incidents)
    • Re: Internet Explorer file:// URL issues
      ... Subject: Internet Explorer file:// URL issues ... > remote host via NetBIOS. ... LAN shares and Internet shares. ...
      (Bugtraq)
    • New Computer - XP
      ... can stop it (Mcafee support tell me that im on the ... Your Internet port 139 does not appear to exist! ... Unable to connect with NetBIOS to your computer. ...
      (microsoft.public.windowsxp.security_admin)