Server with unbound NetBios goes out to Internet on port 139

[krysiunia]

What would cause a natted server behind a firewall to try and contact valid Internet and same network (0.0.0.0) addresses on port 139?
I unbound NetBios from the adapter a couple of days ago but it is still doing it.
This does not happen when there is no one at the office (Sat, Sun, eveninigs).
Below are the entries from yesterday's log.
Any insight much appreciated ...

07/24/2003 09:02:29.256 - TCP connection dropped - Source:192.168.1.2, 1570, LAN - Destination:133.5.0.32, 139, WAN - 'NetBios' - Rule 20
07/24/2003 11:09:24.768 - TCP connection dropped - Source:192.168.1.2, 1603, LAN - Destination:110.115.102.111, 139, WAN - 'NetBios' - Rule 20
07/24/2003 11:22:11.560 - TCP connection dropped - Source:192.168.1.2, 1609, LAN - Destination:97.108.32.125, 139, WAN - 'NetBios' - Rule 20
07/24/2003 11:29:17.816 - TCP connection dropped - Source:192.168.1.2, 1615, LAN - Destination:0.0.32.0, 139, WAN - 'NetBios' - Rule 20
07/24/2003 11:37:51.000 - TCP connection dropped - Source:192.168.1.2, 1619, LAN - Destination:32.32.32.32, 139, WAN - 'NetBios' - Rule 20
07/24/2003 12:06:18.160 - TCP connection dropped - Source:192.168.1.2, 1633, LAN - Destination:70.69.78.70, 139, WAN - 'NetBios' - Rule 20

 

[manarth]

http://www.iss.net/security_center/advice/Exploits/Ports/139/default.htm

"All File and Printer Sharing on a Windows machine runs over this port"

I'd suggest it's possible you have a virus / trojan (fortunately you also have a firewall!): perhaps forum760 can offer some more advice on that subject.

My guess is that there's a rogure program on the server that is trying to connect (over Netbios) to all the computers it can see.

Of course - this is just one suggestion; there may be a legitimate reason that i'm not aware of!

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[bcastner]

Even looks like the old SQL Code Red at work.