[nsp-sec] 139,445,9988-scans

[Torbjorn.Wictorin at cert.sunet.se]

Hello,

last weeks we have seen an increasing number of scans with pattern:

Larger number of 139 and 445 probes combined with probes against port 9988 
on a few hosts. This was common until about a year ago, but there seems 
to be a new round and maybe this is not the same (bot?) as before. 
isc.sans.org show the same pattern with respect to sources/day and port 
9988.

Anyone who has any idéa what this is about?

Torbjörn Wictorin, SUNet CERT