On Oct 27, 2002, 11:47 (-0800) Rob Saul wrote: > > > On Sunday, October 27, 2002, at 11:19 AM, Wolfgang Pfeiffer wrote: > > > > So what is this "Windows probing port 137" thing .. does this mean > > every Windows home user machine on WWW probes other machines it thinks > > are part of its LAN or so? > > Well, once possibility is a new piece of spamware that probes for open > Windows boxes and pops up Messenger Service dialogs when it can. > > bit more info here : http://www.theregister.co.uk/content/55/27634.html
... yeppers, thanks, that seems to be it: (Excerpt:) ######################### So we have here essentially a NetBIOS attack tool. It's capable of attacking entire IP ranges, but will not (the company says) get past a firewall or provide a hyperlink in the alert to the attacker's commercial Web site. ########################## That seems to fit my logs: These whole scans are happening nearly all time I'm connected to www: Months ago I got scanned perhaps once or twice per hour when being online, now (as I said previosly) the scans come extremlely shortly after having connected my machine to the Internet (this is new, IIRC), and extremely often to port 137, and the whole scanning activity against my machine seems to have increased about 10 or 15 times as much compared to 2 or 3 months ago ... Gentlefolks, you might want to check your firewalls ... :) Wolfgang > > > -- > Rob Saul.|.wyrdATtriskelionDASHnovaDOTcom.|.prohibitions void where > offered > de recta non tolerandum sunt > > > > -- Key on: http://home.t-online.de/home/520050060325-0001/ Key fingerprint = 5FFA E2D1 6DB5 C023 0C5F 3FA7 4E08 5F9F 1560 0BA8 Home Page: www.geocities.com/wolfgangpfeiffer/ -- END TRANSMISSION -- -- redhat-list mailing list unsubscribe mailto:redhat-list-request@;redhat.com?subject=unsubscribe https://listman.redhat.com/mailman/listinfo/redhat-list
