Strange Traffic Coming from the NetBios Service

Strange Traffic Coming from the NetBios Service

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Strange Traffic Coming from the NetBios Service Dave 03-16-2006
Posted by =?Utf-8?B?RGF2ZQ==?= on March 16, 2006, 12:05 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

Im having a problem with 4 out of 6 of win2k server. The server keep issuing
Netbios enumeration requests (every second) to server which are in the range
of 128.X.X.X to 138.X.X.X. (Most of these server are class B network belong
to NEC and JP government).They are small packets, but this happening
continousaly.

It looks very like a virus but why would it be coming from the Service.exe
process. Ive unbound Netbios from the interfaces which has stoped the
speurios traffic but i still dont have an idea whats causing it, any why is
happening.

Posted by Roger Abell [MVP] on March 16, 2006, 9:13 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Keep in mind that your NetBIOS support services may just be
acting as proper little slaves doing the bidding of something (else)
that is running on those machines.

>
> Im having a problem with 4 out of 6 of win2k server. The server keep
> issuing
> Netbios enumeration requests (every second) to server which are in the
> range
> of 128.X.X.X to 138.X.X.X. (Most of these server are class B network
> belong
> to NEC and JP government).They are small packets, but this happening
> continousaly.
>
> It looks very like a virus but why would it be coming from the Service.exe
> process. Ive unbound Netbios from the interfaces which has stoped the
> speurios traffic but i still dont have an idea whats causing it, any why
> is
> happening.



Similar ThreadsPosted
Auditing Terminal service: strange trouble March 25, 2008, 1:25 pm
Netbios records (602 lifetime) June 8, 2006, 11:11 am
Netbios/fileshare scan September 19, 2006, 11:49 am
track netbios to ip addres May 14, 2007, 9:29 pm
Help me Please connecting trough netbios October 26, 2007, 9:37 pm
Keeps coming back February 25, 2006, 10:23 pm
Pop ups keep coming, vnr_creatives_history August 6, 2007, 11:01 am
Tracking where mail is coming from. December 20, 2005, 12:39 pm
Common files keep coming up January 17, 2006, 12:34 pm
how do I identify where a port address is coming from October 25, 2005, 11:42 pm

The site map in XML format XML site map

Contact Us | Privacy Policy