# Windows 2000 SMB???



## jdemnyan1116 (Mar 18, 2000)

I am using Windows XP and upon checking my log file from norton, A program Tries to log on all the time. It says Default Block Microsoft Windows 2000 SMB. Anyone have any ideas on what this is? It tries to log on quite a few times, using a different ISP number after 3 attempts. The most common ISP is 64.84.106.142. It uses port 445 and is a microsoft-ds. Its always blocked but since I don't have Windows 2000, why my computer?


----------



## cybertech (Apr 16, 2002)

That IP belongs to Westmoreland Online. Does that help?


----------



## Rockn (Jul 29, 2001)

The IP address resolves to .modem.cust.winbeam.com Is this you by chance? Port 445 is a file sharing port on Win2K and WinNT not sure how XP handles this port by default.


----------



## Mr. Peabody (Apr 13, 2003)

cybertech said:


> That IP belongs to Westmoreland Online. Does that help?


I googled on this "Default Block Microsoft Windows 2000 SMB". There are only two pages of references. I found nothing that identified the nature of this intrusion. There were enough inquiries to suggest that people are interested in finding out more about this. A typical entry is found below.

Rule "Default Block Microsoft Windows 2000 SMB" stealthed (81.248.115.230,microsoft-ds(445))
Inbound TCP connection
Local address,service is (server-name-i1(xx.xx.xxx.x),microsoft-ds(445))
Remote address,service is (81.248.115.230,2137)
Process name is "System"

The first concern is to learn if it is benign or malicious.
The second is to figure out the identity of the company that is being so persistent that it will not stop trying to connect to the computer.
Third, finding a way to terminate the attempt to connect / or permitting the connection if it is advantageous.

Mr. Peabody
Win 98SE
NPF


----------



## jdemnyan1116 (Mar 18, 2000)

Westmoreland online is my ISP providers address. winbeam is the company name. Logged on twice today and got the same message as above. Will keep my ports stealthed until it can be figured out. If it was my internet company, they would not be able to connect to my computer and I am connected. Thanks for all the help. It does seem to worry a few people though.


----------



## jdemnyan1116 (Mar 18, 2000)

Went to Microsoft.com , typed search Microsoft Windows 2000 SMB. Apparently it has to do with a group computer network. SMB stands for Server message block. It has something to do with sharing with other networks. Don't really understand it. I do not have Windows 2000 on my computer. Maybe you get it from a download from microsoft. As long as its not connecting, and being blocked, will try to find out more but do not quite understand all the meaning of it on the web site. Not that computer literate yet.


----------

