Windows RPC DCOM Overflow

[ncamilli]

On a daily basis, for as long as my logs go back (over a month), my 1811 router has been flagging %IPS-4-SIGNATURE: Sig:3327 Subsig:1 Sev:5 Windows RPC DCOM Overflow and Subsig:0 multiple times daily from all different external ip addresses on random ports to one of my inside ip on port 135.

Does anyone have any idea what is going on?

Thanks in advanced.

[eddie.mitchell]

It is probably the conficker/downadup worm or a variant attempting to propagate from infected systems out on the Internet. Make sure your Windows systems are all patched and you are blocking TCP ports 135 and 445 inbound to your networks.

Hope this helps.

[ncamilli]

Thanks.

[yuliang13]

Well ,it's not actually advisable to publish netbios port (135-139,445) to the internet. Perhaps you should source limit it.

cheers