Since late yesterday 4/28/04 afternoon around 4pm our firewall started throwing alarms on netprobes. We are seeing a large amount of probes coming from one machine that is probing random IPs on port 445. The source port is random as well. We traced it back to a Japanese Win2K machine w/SP4 installed. No idea if it's fully patched or not, I have no desire to put it back on my network to patch it until I get this figured out. I scanned the machine in safe mode as well as booting normally using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing. Is anyone else seeing anything like this? Tony Abell Network Administrator OSG Tap & Die
