Anyone ever heard of this?

R Kelly
R Kelly used Ask the Experts™
on
I have noticed over the past few days that when using SMS or our intrusion detection software, several of my servers are showing up with the letters "IS~" in front of them, for example, if the server name was: server1, now it shows up as: IS~server1. It doesnt show up with the IS~ in network place, just in such programs as SMS and Etrust Intrusion detection. It wasn't happening a few days ago, but in the last 2 days, 5 more servers are showing up this way, does anyone have any idea why this might be happening? I have a Windows 2000 domain.


Thanks,
Engellan
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
TodosNetwork Engineer

Commented:
Engellan,

Did you recently update the affected systems with patches? (either microsoft or Etrust or other software).

grtz

Commented:
Are these servers running new services?  IIS for example?
Unless you have recently updated something on your network servers(and maybe if you have), I would suspect a trojan or something similar.
The recent sobig worm identifies rpc holes and uses them for attacks, As I run linux firewalling and 3 way NAT, this has not been a problem for me, but 1 machine in the DMZ showed something similar.
check with your IDS provider.
THat is IIS it shows in our SMS 2.0 also. its perfectly normal netbios stuff.....
It shows up all over our network and has for quite a while. Do a nbtstat -a servername from a CMD prompt and it will show up on the box

Local Area Connection 3:
Node IpAddress: [10.91.3.459] Scope Id: []

           NetBIOS Remote Machine Name Table

       Name               Type         Status
    ---------------------------------------------
    serverTA          <00>  UNIQUE      Registered
    AMHC           <00>  GROUP       Registered
    serverTA          <03>  UNIQUE      Registered
    serverTA          <20>  UNIQUE      Registered
    AMHC           <1E>  GROUP       Registered
    INet~Services  <1C>  GROUP       Registered
    IS~serverTA.......<00>  UNIQUE      Registered

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial