Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2008 box running as a Domain Controller. I have noticed in my Cisco ASA firewall logs that this box is continuously sending out (like a thousand requests a second) requests on TCP port 445 to external hosts. I have made an effort to deny this outbound traffic from getting on the internet (using the ASA), however I would like these requests to stop from even occurring at all. I have tried disabling TCP/IP over NetBIOS. I have even turned on Windows Advanced Firewall on the box itself to block outbound 445 but the ASA still detects this particular traffic hitting it. I have other DC's and similar type boxes which are not behaving the same way as this box.
Is this normal? Is there a way to stop this spamming? Have I been infected?

Before I denyed on my firewall it is sending to IP addresses on the internet. In syslog it looks like:

4 Jun 01 2010 07:50:36 106023 192.168.50.15 59890 38.250.160.20 445 Deny tcp src inside:192.168.50.15/59890 dst outside:38.250.160.20/445 by access-group "OUTSIDE-OUT" [0xb2cd162d, 0x0] 4 Jun 01 2010 07:50:36 106023 192.168.50.15 59808 37.216.197.51 445 Deny tcp src inside:192.168.50.15/59808 dst outside:37.216.197.51/445 by access-group "OUTSIDE-OUT" [0xb2cd162d, 0x0] 4 Jun 01 2010 07:50:36 106023 192.168.50.15 59853 158.105.129.67 445 Deny tcp src inside:192.168.50.15/59853 dst outside:158.105.129.67/445 by access-group "OUTSIDE-OUT" [0xb2cd162d, 0x0] 4 Jun 01 2010 07:50:36 106023 192.168.50.15 59811 69.158.49.125 445 Deny tcp src inside:192.168.50.15/59811 dst outside:69.158.49.125/445 by access-group "OUTSIDE-OUT" [0xb2cd162d, 0x0]

Thank you universe.

share|improve this question
    
Can you give us more specifics. Is is it sending to the broadcast address for the network or to specific ip addresses? TCP port 445 is used for SMB over TCP, are these packets requests or announcements? –  joeqwerty Jun 1 '10 at 11:13
1  
Have you considered running something like wireshark to see what the traffic is? –  Bart Silverstrim Jun 1 '10 at 11:40
    
And are you running up-to-date antivirus on the machine? –  Bart Silverstrim Jun 1 '10 at 11:41
add comment

1 Answer

k. it was a virus.

share|improve this answer
1  
Looking at your syslog entries gives you a clue. Any time you see traffic that normally should be internal (ARP, SMB, etc) trying to go to external ip addresses, you need to suspect malware of some sort. Glad you found it. –  joeqwerty Jun 1 '10 at 12:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.