[I was very disappointed with my answer. I claimed that I handled this, but I could not answer the question satisfactorily] It was an attack on Windows SMB port. We blocked some ports in external facing firewalls and at the same time upgraded the Windows 2008 and the win 7 workstations