Internet worm?

Our firewall logs are full of scans on many ports including 137,138 and 139. Here's a good place to stay informed. Make sure that you can't access any resources from the outside such as network shares. (i.e \\servername\c$)
http://www.dshield.org/port_report.php

Nando

Ok, Windows is real chatty. You have to remember that.
Now, these port connection attempts on UDP ports 137 and 138 are Netbios Name requests. This is, as frightening as it may seem, normal.
Windows usually does this whenever you connect to a remote resource. Windows likes to do a NetBIOS name lookup when you go to websites, or send e-mail, or connect to a steaming MP3 radio station with Winamp, or chat with MSN Messenger. It is just the nature of the beast that is Windows!
I don't think it is a virus. You would really see other stuff (like port 135 requests, or port 139) if it was a common virus. And since your antivirus scans have come out clean, I think this also adds credence.
If you are really worried, then on a machine that does this, just install a sniffer, and have it sniff the traffic this machine sends out. You'll probably just see it do name requests packets to the websites it is going to.
Ethereal is a good sniffer that runs on Windows:
www.ethereal.com

I would also recommend using the shieldsUP! site, at www.grc.com . It will test the security of your internet connection.

This question was closed by the author