ntoskrnl.exe is sending UDP message

Ntoskrnl.exe is trying to send a UDP message from my PC
using port 137 (NETBIOS-NS Browsing request of NetBIOS
over TCP/IP) or 138 (NETBIOS-DGM Browsing datagram
response of NetBIOS over TCP/IP).

This started immediately after upgrading XP to SP1.

Is this because of the XP upgrade or something more
sinister?

Is this normal or should I be concerned?

garyw
Mon Dec 01 14:33:45 CST 2003

Hi,

UDP packets on port 137 and 138 are normal. However, port 137 is used to
discover other Windows hosts. The implication is malware can make use of
port 137 to locate external hosts to attack. You may want to check out the
listing at this URL to see graphically what ports are scanned most often on
the Internet: http://www.dshield.org/. Port 137 is one of the top six
ports listed.

I am interested in the fact you discovered ntoskrnl.exe is sending the
packets. Ntoskrnl.exe is a valid exe for Windows, but normally this exe is
not shown as a running process on the machine.

I recommend you scan the machine with good virus software to help determine
if malware is at work on the machine.

Thanks.

Gary Whitley

This posting is provided "AS IS" with no warranties, and confers no rights.