[Dshield] Microsoft Network Security Hotfix Checker, 2.1

Jonathan G. Lampe jonathan at stdnet.com
Wed Aug 15 23:10:47 GMT 2001

It's not just port 138...the checker also uses ports 137, 139 and 
445.  (Remember, win2k networking "embraces and extends" legacy 
NetBIOS!)  It may also PING the remote host - in all a fairly noisy scan if 
you're wondering it it's being used against you.

- Jonathan Lampe, Standard Networks, 608-227-6100, jonathan at stdnet.com

P.S. - If you need incentive not to point this thing across the Internet 
vs. other people's sites, remember it sends out your current username, 
machine name, domain name and IP address as part of the process of finding 
out about the remote machine.  (SNORT it for yourself ...  ;)

More information about the list mailing list