Browser Master

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Hi,
I'm running Win2000 pro with an always-on connection from
my local ISP. I am not in any network apart from the one
from my ISP.
I have been hit by port scans on ports 80, 139, 6129,
3127, 1025 and 445 from 10.1.2.90(which I think is a
reserved address).

When i check my logs I saw this entry:

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 8/7/2004
Time: 9:33:42 AM
User: N/A
Computer: RACHEL
Description:
The master browser has received a server announcement from
the computer SWARUP that believes that it is the master
browser for the domain on transport NetBT_Tcpip_{157A4C5F-
76F9-4392-A1. The master browser is stopping or an
election is being forced.

I dont know any computer named 'SWARUP'.
Is someone trying to hack my comp. Or is it just Normal?

Thanks a lot in advance

-webb

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Are you running a firewall?? If not you need one ASAP or check yours for proper
configuration. You can go to http://scan.sygatetech.com/ to do a simple quick test of
your basic vulnerability. There are many free firewalls available such as Zone Alarm
or Sygate. You should NOT be seeing other computer names in your Event Viewer when
you are not on a lan with other computers and are not using VPN connections. Either
install a firewall or configure the one you are using to work correctly and then do a
complete virus scan on your computer using the latest definitions from your vendor's
website. --- Steve

http://www.microsoft.com/athome/security/protect/default.aspx
http://www.snapfiles.com/Freeware/security/fwfirewall.html --- free firewall for
personal use.

"webb" <anonymous@discussions.microsoft.com> wrote in message
news:1c4e01c47c37$ee96c400$a401280a@phx.gbl...
> Hi,
> I'm running Win2000 pro with an always-on connection from
> my local ISP. I am not in any network apart from the one
> from my ISP.
> I have been hit by port scans on ports 80, 139, 6129,
> 3127, 1025 and 445 from 10.1.2.90(which I think is a
> reserved address).
>
> When i check my logs I saw this entry:
>
> Event Type: Error
> Event Source: MRxSmb
> Event Category: None
> Event ID: 8003
> Date: 8/7/2004
> Time: 9:33:42 AM
> User: N/A
> Computer: RACHEL
> Description:
> The master browser has received a server announcement from
> the computer SWARUP that believes that it is the master
> browser for the domain on transport NetBT_Tcpip_{157A4C5F-
> 76F9-4392-A1. The master browser is stopping or an
> election is being forced.
>
> I dont know any computer named 'SWARUP'.
> Is someone trying to hack my comp. Or is it just Normal?
>
> Thanks a lot in advance
>
> -webb

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

The network neighborhood browsing function can work
based on lists of network hosts/resources a machine gets
from a Master Browser. When a machine comes online
that believes it is more macho and should be the master it
challenges the existing. This is what you are seeing. The
machine SWARUP has told your RACHEL that it believes
RACHEL should not be master browser.

This should not be happening on the network you describe.
You should either or both of
1. run a firewall
or
2. go into the properties of your outbound (only) network
connection, highlight Tcp/Ip in the list, and click into its
properties, and in there uncheck MS networking and File
and Print sharing. (you did indicate you have one machine
without network save the ISP connection).


--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"webb" <anonymous@discussions.microsoft.com> wrote in message
news:1c4e01c47c37$ee96c400$a401280a@phx.gbl...
> Hi,
> I'm running Win2000 pro with an always-on connection from
> my local ISP. I am not in any network apart from the one
> from my ISP.
> I have been hit by port scans on ports 80, 139, 6129,
> 3127, 1025 and 445 from 10.1.2.90(which I think is a
> reserved address).
>
> When i check my logs I saw this entry:
>
> Event Type: Error
> Event Source: MRxSmb
> Event Category: None
> Event ID: 8003
> Date: 8/7/2004
> Time: 9:33:42 AM
> User: N/A
> Computer: RACHEL
> Description:
> The master browser has received a server announcement from
> the computer SWARUP that believes that it is the master
> browser for the domain on transport NetBT_Tcpip_{157A4C5F-
> 76F9-4392-A1. The master browser is stopping or an
> election is being forced.
>
> I dont know any computer named 'SWARUP'.
> Is someone trying to hack my comp. Or is it just Normal?
>
> Thanks a lot in advance
>
> -webb