Re: Strange Traffic to ports 139 and 137 from a machine with no data

On 28 Feb 2006 16:31:55 -0000, loki74@gmail.com <loki74@gmail.com> wrote:
> Hello all,
>  I have a machine that is sending out empty data packets destined to random 
> ip addresses with a destination port of 137 and 139.  All the IP Addresses 
> seem to be a military and NOC location.  I have attached some of the IP's 
> below.  I have ran antivirus, anti-spyware and rootkit detectors 
> (sysinternals, and f-prot) all came up empty.  I had found one other person 
> on the internet that seemed to have this problem, but no resolution. Any 
> ideas?

Find when the traffic started and try to correlate suspicious log
entries and file timestamps to the start of the traffic.

Also try netstat -avonb (the -b being the important one) if this is an
XP box, and look for suspicious bindings to the above mentioned ports.

Also, take the HDD of the offending PC and hook it up as a slave
device to another winbox, this is the only for-sure method of finding
a rootkit

-JP