Newbie:Open port warning - Mischel Internet Security Forum

Jobs | About | Blog | Contact

Download TrojanHunter Now
Free 30-day trial!

Latest TrojanHunter Version:
TrojanHunter 5.0

Order Now
License file delivered within minutes.

Welcome, Guest. Please Login or Register.

Aug 29^th, 2008, 5:22pm

   Mischel Internet Security Forum
   Malware
   Trojans (Moderators: Helena, Gavin_Coe, Magnus)
   Newbie:Open port warning

« Previous topic | Next topic »

Pages: 1

Notify of replies

Send Topic

Author

Topic: Newbie:Open port warning (Read 827 times)

ceevee
Newbie

I love YaBB 1 Gold!

Posts: 2

Newbie:Open port warning
« on: May 18^th, 2002, 4:52pm »

Quote

Modify

Sorry if this is a FAQ (or too basic) but couldn't find it. I get an open port warning about port 50000. What sort of risk does this imply ? How do I know if any application I've installed uses it ?

Also, is there any way to block just that port in XP ? All I know is Control Panel> Network and Dialup Connections>Local Area Connection> Properties>Internet Protocol (TCP/IP) > Properties>Advanced>Options> TCP/IP filltering> Properties> Enable TCP/IP filtering

and that seems to work by ports you want to allow rather than block. I don't know enough yet to come up with the list of ports I should allow.

TIA,
Chet

IP Logged

Magnus
Administrator

Ad astra per aspera.

Posts: 4092

Re: Newbie:Open port warning
« Reply #1 on: May 18^th, 2002, 4:59pm »

Quote

Modify

You'll probably want to find out what's holding the port open. See question #3 at http://www.misec.net/trojanfaq.jsp

IP Logged

Ian
Stole All the Forum Stars

Good things come to those who wait ...

Posts: 2907

Re: Newbie:Open port warning
« Reply #2 on: May 18^th, 2002, 5:03pm »

Quote

Modify

Hi Chet,

Useful links page to port numbers and issues is at
http://lists.gpick.com/pages.asp?page=Port_Lists
and
http://www.stengel.net/tcpports.htm
Magnus has one at:
http://www.mischel.dhs.org/portlist.jsp
which is what TrojanHunter detects.

From this, it suggests that the port is used by (amongst other things) Infector.180, a known Trojan

Don't get alarmed right away, though. Ports over 1024 are allocated in a funny way, dished out by the OS whenever something asks for one. 50000 is a bit high for a system file, so look to your AutoStart programs for something that may open that port.

Investigative tools:-
TCPView Pro - tells you open ports and the application using them(www.winternals.com) - I can vouch for the effectiveness of this tool. Grin

I use Sygate 4.1 (free) to lock down ports - you can create rules about any port number for any transport method (TCP, UDP etc) installed on your PC.

AFAIK, the WinXP 'firewall' is not up to much - get ZoneAlarm or something similar (not Blackice Defender, though... - go to www.grc.com to see what some of the best advice in security has to say about things you could try).

HTH

« Last Edit: May 18^th, 2002, 5:12pm by Ian »

IP Logged

... but crap arrives pretty much straight away.

chetvora
Guest

Re: Newbie:Open port warning
« Reply #3 on: May 30^th, 2002, 3:41am »

Quote

Modify

Remove

Hi folks,

I think I messed up. I downloaded and installed TCPVIew Pro. I saw a bunch of connections which certainly looked suspicious (esp gator.com - probably spyware) and I tried to do a del in TCPView. Well call it a coincidence or a result of my stupid doing, but I couldn't connect any longer to the internet. (I didn't realize this until I fired up my connection next day). In XP, when I open up a URL in IE, it says "Site found. Waiting for reply..." and just churns there without ever coming back. Other things like Yahoo messenger etc also don't work. My guess is I probably screwed up my portmap or something. I don't know what else could've caused it.

Well anyways, I would be really glad to get help on how to restore my internet connection. Will really appreciate any pointers.

Chet

IP Logged

ceevee
Newbie

I love YaBB 1 Gold!

Posts: 2

Re: Newbie:Open port warning
« Reply #4 on: May 30^th, 2002, 5:04am »

Quote

Modify

Well, guess what, my connections work on uninstalling TCPView Pro. It was probably preventing some of my ports from being used. What gives ?

Chet

IP Logged

Ian
Stole All the Forum Stars

Good things come to those who wait ...

Posts: 2907

Re: Newbie:Open port warning
« Reply #5 on: May 30^th, 2002, 8:05pm »

Quote

Modify

How did you delete ports/processes in TCPView? Huh

AFAIK it has no delete function - it's just a viewer (Win98/TCPView Pro 1.06 - current version). There is a filter option, but that doesn't shut ports (only stops the display of certain items).

It is probably a function of XP, not TCPView, although if removal of that app restored your connections then perhaps something was amiss with the installation. XP is based on NT, so would have some ability to filter out IP addresses - did you filter out your ISP?

IP Logged

... but crap arrives pretty much straight away.

spy1
Full Member

I love YaBB 1 Gold!

Gender:

Posts: 227

Re: Newbie:Open port warning
« Reply #6 on: Jun 2^nd, 2002, 7:28pm »

Quote

Modify

http://grc.com/unpnp/unpnp.htm (try to ignore the hype - you can either use his small program to disable the feature, or simply turn it off yourself).

Are you using PestPatrol, by any chance? it sometimes wants to use port 5000 also.

HTGH Pete

IP Logged

Darkfire
Guest

Re: Newbie:Open port warning
« Reply #7 on: Aug 14^th, 2002, 4:36am »

Quote

Modify

Remove

i have: TCP 661 Noknok.800, Noknok.820 it looks like it's deleting files how do i close that port?

IP Logged

Jamming
Stole All the Forum Stars

Remember when a Trojan was just for protection.

Gender: male

Posts: 2038

Re: Newbie:Open port warning
« Reply #8 on: Aug 14^th, 2002, 5:34am »

Quote

Modify

Turn off you modem to the Internet and Ctrl+Alt+Delete to freeze the operations on your computer. �If Files are being deleted its too late and time to shutdown by turning off the power.

« Last Edit: Aug 14^th, 2002, 5:34am by Jamming »

IP Logged

Team Z Member

Servare cives, major est virtus patriae patri.
- Lucius Annaeus Seneca
I was born an American; I live an American; I shall die an American!
- Daniel Webster

Darkfire
Guest

Re: Newbie:Open port warning
« Reply #9 on: Aug 14^th, 2002, 6:43am »

Quote

Modify

Remove

hmm ok the only things it looks like it deleted is: While scanning C:\WINDOWS\SYSTEM\nwiz.exe: File not found
While scanning RUNDLL32.EXE: File point32.exe not found
While scanning C:\PROGRAM FILES\AIM95\aim.exe: File hpfsched not found
No trojan files found

i turned off my firewall for a sec and did the trojan scan it found another open port that has skydancer.some number there and it has keystroke and password grabber etc, but when i turn my firewall back on it goes away somehow i closed the other port and it's gone for now, any ideas?

IP Logged