On 3/2/06, Loki 74 <[EMAIL PROTECTED]> wrote: > Well I have received a few people all exhibiting this, and say it can > occur from a fresh-install, currently patched, no internet connection. > I suggest we investigate more, honeypot, full diff, etc. Anyone > interested in helping? >
Ok I am not a windows expert.. so please somebody with more knowledge jump in. I would look for the following info between machines: Drivers loaded Patch set order Registry dump looking for data in either ascii or hex for the ip address that the box was looking for last. Finding a comon denominator may turn out that the Tornado network driver if loaded with the XYZ chipset causes it to send calls up the network stack that MS services then send data out on the network in responce to a ghost packet it thought it saw. -- Stephen J Smoogen. CSIRT/Linux System Administrator
