Author Topic: NBNS Scanning  (Read 2897 times)

0 Members and 1 Guest are viewing this topic.

Serverboats

  • Guest
NBNS Scanning
« on: May 11, 2004, 02:22:53 AM »
I have an ill Compaq running XP. I have removed Nachi-B, Blaster, Blaster-B and Sasser-B from the system. I have verified their removal by running Symantecs specific removal tools. I have run A complete and through scan using the latest Avast!. I have installed all applicable patches.

This system still kills my Netgear firewall router in < 3 Mins. My sniffer shows multiple NBNS Registration requests and TCP scans of random ip addresses by altering the 4th octet using the first 3 octets of my subnet.

This sounds like SASSER or a variant but neither Symantec or Avast tools can find anything. Have I missed something here?

Please Advise,

Serverboats

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re:NBNS Scanning
« Reply #1 on: May 11, 2004, 09:59:21 AM »
Hard to say...
Are there any suspicious items in the system autostart entries? (e.g. in HKLM\Software\Microsoft\Windows\CurrentVersion\Run)