I'm Being Eaten ALIVE

[EzyStvy]

I'm getting unauthorised established connections to port 445 on one of my servers which is in a Data Center.

C:\>netstat -an | find ":445"
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP xx.xx.124.114:445 70.77.239.144:3052 ESTABLISHED
TCP xx.xx.124.114:445 70.78.198.57:4327 ESTABLISHED
TCP 127.0.0.1:1748 127.0.0.1:445 TIME_WAIT
UDP 0.0.0.0:445 *:*

The techs at the DC have been helping but I think they're getting as frustrated as I am. They setup a IPspec rule and Windows Firewall and in theory, this machine should be locked down pretty darn tight.

We do have a small number of ports open to access the two different types of databases on the machine...(all the machine does is host databases)

Before the IPspec rule - there would be as many as 50 established connections to port 445....I could sit there and kill the connections one at a time...and slowly but surely they come back.

File and print sharing has been disabled.

If I do telnet xx.xx.xxx.xx 445 -> It won't connect.

There was a couple of trojans on the machine a couple of months ago. We had FSecure installed for a few months but have since switched to Norton 2009 and it scans are clean.

Any thoughts?

[EzyStvy]

It looks like the DC tech guys found a whole in the rules and fixed it...