Security

Ask something
Discussion Locked

Does server have virus (see below text)?

0 helpful
5 replies

by dr dij

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is this a virus on our florida server? One of our PCs (the one of a few with ZoneAlarm installed) keeps getting pinged like below. It increments the port# and retries at intervals ranging from 8 hours to 2 minutes. Or is it some kind of server discovery packet? The incrementing port#s make me think is a virus but not sure. The machine in florida is some kind of NT or 2000 machine.

sample zone alarm message:
The firewall has blocked Internet access to your computer (NetBIOS Session) from 172.28.8.100 (TCP Port 1243) [TCP Flags: S].

Time: 4/16/02 1:27:08 PM

5 replies

by jayanth

Your Florida server is receiving NetBIOS connections from some other machine on the network. Most likely your florida server is a windows NT/2K machine and some other windows m/c on the network is trying to access the shared folders/drives on the florida server. this is what triggers a NetBIOS session and ZoneAlarm promptly disallows it, giving you that error message. For more explanation, click on the Link that is given with the error message in zone alarm.
No, I dont think this is any virusactivity.

by mancca74

That does not sound like a virus or anything else trying to screw with you, it's quite normal. Take the notice on the machine and click on the button for more info and you'll be taken to zonelabs homepage for a very probable explanation!

But if you are being scanned by someone it could be worse. Why not open your dos-prompt and do a tracert to the above address to get a name or location. I'd bet on a nameserver on your network!

Good hunting!

This discussion is closed to new replies.