Re: Strange Traffic to ports 139 and 137 from a machine with no data

["Stephen J. Smoogen" <smooge () gmail com>]

On 3/2/06, Loki 74 <loki74 () gmail com> wrote:
> Well I have received a few people all exhibiting this, and say it can
> occur from a fresh-install, currently patched, no internet connection.
>  I suggest we investigate more, honeypot, full diff, etc. Anyone
> interested in helping?

Ok I am not a windows expert.. so please somebody with more knowledge
jump in. I would look for the following info between machines:

Drivers loaded
Patch set order
Registry dump

looking for data in either ascii or hex for the ip address that the
box was looking for last. Finding a comon denominator may turn out
that the Tornado network driver if loaded with the XYZ chipset causes
it to send calls up the network stack that MS services then send data
out on the network in responce to a ghost packet it thought it saw.





--
Stephen J Smoogen.
CSIRT/Linux System Administrator