Security Incidents: Findfast connections on arbitrary networks

[Sean Brown <srbrown () NYX NET>]

Has anyone detected unusual Netbios Session
(TCP/139) attempts to arbitrary network addresses
and traced it back to the program Findfast.exe
(part of the Office 97 suite in the Microsoft
world)?  I have drilled down into various list
archives looking for references and found none. 
I've got some interesting captures emanating from
some devices inside my network.  I wanted to see
if anyone else had seen this type of activity.

Sean Brown
Applied Geographics, Inc.
Boston, MA  02110
srbrown () appgeo com