Security Incidents mailing list archives
RE: Unusual volume: UDP:137 probes
From: "Scott, Michael R." <MICHAEL.R.SCOTT () saic com>
Date: Tue, 1 Oct 2002 08:31:28 -0700
There _may_ be an explanation here:- https://grc.com/x/news.exe?cmd=article&group=grc.security&item=59379&utag=
I found a copy of this scrsvr.exe on a Win95 machine connected to a cable modem, and it was, as expected, blasting 137 probes to various /16 blocks it appeared. The thing that initially caught my attention about the file, which was in c:\windows, was A) the filename didn't sound right for a standard windows screensaver related file, and B) the timestamp came up blank in windows Explorer (I think that's the M time in Win95). As of yesterday afternoon NAV did not report any problems with the file. I can supply traces or the binary if interested. Mike ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Re: Unusual volume: UDP:137 probes, (continued)
- Re: Unusual volume: UDP:137 probes Nick FitzGerald (Sep 30)
- RE: Unusual volume: UDP:137 probes Mark Forsyth (Sep 30)
- RE: Unusual volume: UDP:137 probes Joseph R. Gruber (Sep 30)
- Re: Unusual volume: UDP:137 probes Hugo van der Kooij (Sep 30)
- SV: Unusual volume: UDP:137 probes Peter Kruse (Oct 01)
- Re: Unusual volume: UDP:137 probes Christopher Albert (Sep 30)
- RE: Unusual volume: UDP:137 probes Richard . Grant (Oct 01)
- RE: Unusual volume: UDP:137 probes Nick FitzGerald (Oct 03)
- Re: Unusual volume: UDP:137 probes Alain Fauconnet (Oct 04)
- Re: Unusual volume: UDP:137 probes Matt Power (Oct 05)
- RE: Unusual volume: UDP:137 probes Nick FitzGerald (Oct 03)
- RE: Unusual volume: UDP:137 probes Scott, Michael R. (Oct 01)
- Re: Unusual volume: UDP:137 probes Axel Pettinger (Oct 01)
- Re: Unusual volume: UDP:137 probes James Sneeringer (Oct 01)
- maybe a simple problem Andrew Fison (Oct 02)
- Re: maybe a simple problem Igor D. Spivak (Oct 02)
- RE: maybe a simple problem Greg Reber (Oct 03)
- Re: maybe a simple problem Brad Arlt (Oct 03)
- Re: Unusual volume: UDP:137 probes James Sneeringer (Oct 01)
- Re: Unusual volume: UDP:137 probes John Sage (Oct 01)