sorry for not knowing a lot about NetBIOS... but couldn't you look to see what files have been modified recently (or modified within the time-frame of the attack)... You should also try to secure...