OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
NTBugtraq And NTSecurity Archives: Help - Strange Group and Uni

Help - Strange Group and Unique Mapping type showing up in WINS

Subject: Help - Strange Group and Unique Mapping type showing up in WINS
From: Gregory, James (jgregoryDAYCASEBEER.COM)
Date: Wed Dec 08 1999 - 12:58:29 CST

Let me preface this by saying that this may be do to something I have
installed, but I would really like to know what!

The other day when looking at WINS, I noticed a strange group and unique
mapping type running on all of my clients and servers, I am not sure what it
is, or what it is from and am afraid it may be an intruder or a virus. If
someone can shed some light on what it is it would be greatly appreciated
and sleep a little better at night ; ). Anyway, here is what the mappings
look like.

1) Entry for clients and servers look something like this:

MLI0E54A183BRAD [42h]

Active is checked when the computer is running and not when the computer if
off. The icon before it appears as a multihomed sometimes, and other times
as a unique entry on similar clients. The number after the MLI does not
correspond to the MAC address of the computer that has the same IP address
as this entry in WINS...

2) One Entry that seems to be on different computers at different times, but
it always only appears once:

MLI_GROUP_BRAD[42h]

The icon before it always appears as a group icon. The active check is
always there. This group is attached to different clients at different
times. This group does not appear in network neighborhood.

I search Technet and the MS web site for what type of service is running
when the 16th bit = 42h, but came up empty....

I am stumped... Any suggestions at how to get to the bottom of this, please
let me know.

Thanks in advance

James Gregory
Director of Information Systems
Day Casebeer LLP
e-mail: jgregorydaycasebeer.com

This archive was generated by hypermail 2b27 : Thu Dec 09 1999 - 11:24:09 CST