Windows Forum

Ask something
Discussion Locked

what is twwinsdr.exe ?

0 helpful
3 replies

by bowieb 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My firewall has been reporting connections coming from port 58085 on one of my WinNT machines. The destination IP is always the same, but the port number keeps increasing. It has gone from 3527 to 3923 in the past two days (like a slow port scan).

I have traced the connections (I think) to a program called "twwinsdr.exe". Does anyone know what this program is? Or know anything about these connections?

3 replies

by mrdbcooper

Ok, I have found an old program called Mbone tools from 1996-1998. Its original intent was to video conference over Win95 and NT systems and share whiteboard presentations for information sharing.

I believe a variant version of the part of these tools (Sdr Sessions Manager) may have
been changed to do other things and are being employed against your firewall.
From the program's manual, this is what is said about Sdr and its connection:

"In the sdr information window, you can see which applications are used in a session, get the multicast ADDRESS, PORT and TTL (time to live) for every application and have some information about the session."

This may well be gleaning or trying to glean
information about your system. I could be wrong but I have seen old programs often used in new ways for all sorts of purposes.

I would get someone with some experience in
security to check this out further.

Hope this helps some.

This discussion is closed to new replies.