Any good network detectives out there?

Your best bet is probably to get a packet sniffer. Set it to flag anything attempting to access the port. Go over to that PC, pull it off the network and image it. It's probably one computer that you haven't checked or forgot about that got infected and keeps hitting you're PCs over and over.

On your router, increase your connection and connection times but set it so it will not create a connection unless it receives the ACK.

DoS is using a SYN attack on you. It's not recieving an ACK so it waiting for it. Set the ACK time lower so it'll drop the connection after so many seconds.

There are other methods out there.. but I'd just download a packet sniffer or something like Snort, flag port 445 so anything sending on that you can find the IP address, remotely shut it down and go reimage it off your network. But you need to find them all because obviously your image isn't update to date to block this from getting infected. As soon as you put it back on the network, chances are within 5 minutes it'll get reinfected.

Unless you have a way of denying the port, either through your switches/routers, or AD or whatever structure you have, you'll in it for the long haul.

Ethereal should work.

Basically, you want to set up your monitoring to watch any PC broadcasting trying to access the Port which the virus/trojan/worm is using. It should tell you the IP address of the PC broadcasting and the IP address it's trying to access.
Whatever PC is trying to access another computer on that port.. well, that's your culprit.

Take that PC off the network, reimage it.. but keep watching to see if anything else is trying to use that port again before putting that reimaged PC back on the network.

ive used that technique to find printers that were advertising apple talk protocals. its easy to set up the sniffer that comes with server 2k to filter out stuff you dont want to see.

go tell your alien brothers, that ronnie cordova says they're gay!!! <A HREF="http://sockbaby.com" target="_new"> sock baby </A>

get windows 2k server, install the packet sniffer that comes with it. you have to select it durring the install or add it later with add windows components. i dont have it handy so i cant really walk you through it but there is a setting to filter out all data from the log file that you dont need to see, that will make it easyer. you should be able to tell it to only log attempts on certain ports.

go tell your alien brothers, that ronnie cordova says they're gay!!! <A HREF="http://sockbaby.com" target="_new"> sock baby </A>