RE: Strange Netbios connections

["Hall, Philip" <phall@xxxxxxxx>]

Oliver

> > yesterday, we had some strange netbios TCP/IP connections on 
> > our AS/400's (both of them). 
> > A PC from a remote WAN location was connecting on port 445 to 
> > internal ip-addresses of our 
> > 810 and 820.

Here's some more info;

"port 445 is also an attack vector for RPC-DCOM and 445 is only found on 2k/
xp / 2k3 as well. As a side note, ASP running on IIS links to dcom functions, 
and port 80 is also another vector. With the prevelance of the dcom exploit, i 
imagine the port 445 scan is a side affect of routine exploit fingerprinting 
from would-be attackers."

And

"We've been seeing increased activity from Randex.D worm infections, which
generated similar types of scan patterns:

http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.d.html";


--phil