Hello,

this is a BM3.8.5 on NW6.5.6

The Abend.log is mutilated, but one thing is jumping at me.
Looks like what I have seen with CIFS attacks: repetitive rubish in memory?



Memory at EDI
33BB4741 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4751 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4761 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4771 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4781 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4791 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB47A1 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB47B1 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB47C1 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB47D1 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB47E1 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB47F1 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4801 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4811 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4821 46656572 46656572-46656572 46656572 Feer Feer Feer Feer
33BB4831 46656572 46656572-46656572 46656572 Feer Feer Feer Feer



NFAP isn't active at all, NCP only bound to the private interface. While the
abend occured none of the just 5 workstations were switched on.


The ABEND.LOG also states:

Additional Information:
The hardware detected a problem while executing an interrupt service routine.
The code being executed is owned by SERVER.NLM. It may be the source of the
problem or there may have been a memory corruption.

I assume "Memory corruption" due to some whatsoever attack?

Memtest86 is fine. I'll try to attach a ZIP of the ABEND.LOG with this post.



Any suggestions appreciated,


Rudi.