Netbios Name Scans/opaserv worm

From: <rocky_scotti(at)na.dole.com>
Date: Thu Feb 06 2003 - 12:49:07 EST

Recently I have seen an increase in the amount of netbios name scans from internal hosts to what appears to be random public and/or private addresses. In one case we found the w32.opaserv.worm and cleaned, but the scans continued. In other cases antivirus software found nothing. My question to the group is:

Is there any legitimate reason for these types of random netbios name scans, or any netbios name scan for that matter? Also, does anyone know if there is any way to remotely detect this worm on a machine without running a local virus scan?

Thanks and Regards
Rocky Scotti
Sr. Network Engineer
Dole Food Company, Inc.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Feb 6 16:44:40 2003