I feel bad, but a great learning experience...

[m.w.chang]

why would they open ports 137-139? puzzling...
I logged many connection attempts to these 3 ports (and the SQL Server
ports as well) with my iptables.

> studies and prevention. The bottom line is; they had netbios going over the
> firewall...
> Anyways, if you have the interest and your usenet has the group... search for:
> Our large network hacked

-- 
Swiftly. Silently. Invisibly.  .~.   In Linux We Trust.
news://news.hkpcug.org        / v \  http://www.linux-sxs.org
news://news.linux.org.hk     /( _ )\ http://www.linuxfromscratch.org
                               ^ ^   http://beyond.linuxfromscratch.org
For starters: http://new.linuxnow.com/tutorial/preface.html