Over the past week the SO and I have been traveling to California and back. At the various places we were staying, we had access to wireless connections at the hotels. Being uber-geeks, we also had our laptops.
I use a Mac and never use the root account. I use a guest account for most things. I was using Comcast web access for my email. My computer worked well for the entire trip. The SO uses WinXP Media Edition. He uses the Zone Alarm Suite but always connects using his Administrator account (yes, I will be changing that).
So here’s the thing. Very much like the Blaster32 and its variants, he has got svchost trying to access the Internet on various ports. It always begins by trying to reach port 135 from source IP 0.0.0.0. When it is denied access, it will start going for ports in the 2000 range from the computer’s home IP. With every denial, it will try to get to an incrementally higher port number.
SO is trained to do a backup of his registry on a monthly basis along with a backup of his files. If I had to I could rebuild the machine but he would prefer that I not do that. We could also permanently deny svchost from reaching out to port 135 via Zone Alarm and never see the warning again. But that solution doesn’t address the root cause, only the symptom.
My machine is fine. He should buy a Mac and be done with it…
The spec on the box- HP dv8000
WinXP Media Center Edition
2002 SP 2
T2400 @ 1.83 GHz
987 MHz, 2.0 GB RAM
The svchost version is 5.1.2600.2180 and shows no modification from it’s initial installation.
All a Google search shows is information from the Blaster problem and the most recent data available is dated 2004. Theory has it that SP 2 was to have resolved that exploit. I haven’t put SP 3 down yet because the test environment that I have running indicated that it fights with stuff he uses routinely. I did take the step of checking with Gibson Research only to discover that his machine is stealthed from our home connection. I did not check him from any other connection we were using on the trip.
What do you wonderful people think?