New Worm??? - High level of activity on port 445
Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes coming
from one machine that is probing random IPs on port 445. The source port is
random as well. We traced it back to a Japanese Win2K machine w/SP4
installed. No idea if it's fully patched or not, I have no desire to put it
back on my network to patch it until I get this figured out. I scanned the
machine in safe mode as well as booting normally using SAV 8.1 with 4/28/04
Rev 38 defs and came up with nothing.
Is anyone else seeing anything like this?
Tony Abell
Network Administrator
OSG Tap & Die