Do you have port 5000 open?
another post by Internet Storm Center The Port 5000 (tcp) scans/attacks, are showing in logs again. Almost 70000 scans/attacks in the last few days in the logs that the storm center captures. Check your systems – have they been scanned? Alpha scan them to see what the evil hacker is seeing.