Network port problems. Virus?!?

[Cirrus9]

Hi guys,
If you have addressed this topic, please forgive me. I didn't have time to read through. I have been fighting viruses on this hybrid network (28 clients 3 servers/ servers are NT 4.0 & clients are XP Pro and 2K Pro) There are problems getting mail and going to certain internet sites I have removed nimda.d (which was sitting right on the solomon server), the download trojan virus and beagle. There were also problems with sasser which I think have been irradicated with the security patches from MS.

I am having problems, however, with port 8383 being inundated with hits but I can't find where it is coming from. Even when viewing webmail going through port 8383 there is a problem. Are there any viruses that are particularly bad right now that the profile might fit or that I have overlooked? I used remote scanning tools (Panda & Trend-Micro). I spoke to another local Network Admin and he is having the same problem. Any suggestions will be appreciated.

 

[Lemon13]

get i.e. analyzer, do a capture and check the capture for port 8383. there you will see wich machine creates the traffic.

 

[torin8]

An even easier way of finding which machine is banging out to the port is to shut each machine down one by one. Check the port each time you shut a machine down and when it stops you more than likely have your culprit.

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;en-us;837243