our samba-servers are getting the following messages in the logs:

Feb 14 04:56:47 njord smbd[5767]: Your machine may be under attack by someone attempting to exploit an old bug.
Feb 14 04:56:47 njord smbd[5767]: Attack was from IP = x.x.x.225.
Feb 14 06:59:06 njord smbd[6026]: [2006/02/14 06:59:06, 0] smbd/reply.c50)
Feb 14 06:59:06 njord smbd[6026]: ERROR: Invalid password length 4222.
Feb 14 06:59:06 njord smbd[6026]: Your machine may be under attack by someone attempting to exploit an old bug.
Feb 14 06:59:06 njord smbd[6026]: Attack was from IP = x.x.x.225.
Feb 14 07:18:41 njord smbd[6085]: [2006/02/14 07:18:41, 0] smbd/reply.c50)
Feb 14 07:18:41 njord smbd[6085]: ERROR: Invalid password length 4222.
Feb 14 07:18:41 njord smbd[6085]: Your machine may be under attack by someone attempting to exploit an old bug.
Feb 14 07:18:41 njord smbd[6085]: Attack was from IP = x.x.x.225.

I have virusscan'ed and run ad-aware on the pc with IP x.x.x.225, but its still making log-entries.

Does anyone have any suggestions? its a win2k pc. our samba-servers are linux and hp-ux.

Use netstat to see what process is opening ports 137-139 or 445. For example, netstat -pn.

netstat -n | grep 137, 138, 139 and 445 gave me no results from unknown pc's (139 gave me the list over pc's using samba.. ).

Sorry, I was suggesting you might try that on the Win2k machine as well. If something is hitting your samba machine from there, that should show the connection.

when running "netstat -n" on my own pc I get up approx. 17 lines of comms.

-on the suspect pc I get about 250 lines..

That's alot running. Anything on the SMB front?

scanned the pc with Stinger from McAfee, and got the following report:Scan initiated on Fri Feb 17 08:38:09 2006
C:\WINNT\msnet32.exe
Found the W32/Sdbot.worm.gen.h virus !!!
C:\WINNT\msnet32.exe has been deleted.
Number of clean files: 31579
Number of infected files: 1
Number of files deleted: 1

No more warnings in the samba-log after the scan so I hope its been fixed now.