02-03-2009 03:04 PM - edited 03-10-2019 04:29 AM
On a daily basis, for as long as my logs go back (over a month), my 1811 router has been flagging %IPS-4-SIGNATURE: Sig:3327 Subsig:1 Sev:5 Windows RPC DCOM Overflow and Subsig:0 multiple times daily from all different external ip addresses on random ports to one of my inside ip on port 135.
Does anyone have any idea what is going on?
Thanks in advanced.
02-06-2009 01:46 PM
It is probably the conficker/downadup worm or a variant attempting to propagate from infected systems out on the Internet. Make sure your Windows systems are all patched and you are blocking TCP ports 135 and 445 inbound to your networks.
Hope this helps.
02-06-2009 02:13 PM
Thanks.
02-15-2009 10:56 PM
Well ,it's not actually advisable to publish netbios port (135-139,445) to the internet. Perhaps you should source limit it.
cheers
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide