Windows RPC DCOM Overflow

Unanswered Question

On a daily basis, for as long as my logs go back (over a month), my 1811 router has been flagging %IPS-4-SIGNATURE: Sig:3327 Subsig:1 Sev:5 Windows RPC DCOM Overflow and Subsig:0 multiple times daily from all different external ip addresses on random ports to one of my inside ip on port 135.

Does anyone have any idea what is going on?

Thanks in advanced.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
eddie.mitchell@... Fri, 02/06/2009 - 13:46
User Badges:
  • Silver, 250 points or more

It is probably the conficker/downadup worm or a variant attempting to propagate from infected systems out on the Internet. Make sure your Windows systems are all patched and you are blocking TCP ports 135 and 445 inbound to your networks.

Hope this helps.

yuliang13 Sun, 02/15/2009 - 22:56
User Badges:

Well ,it's not actually advisable to publish netbios port (135-139,445) to the internet. Perhaps you should source limit it.



This Discussion