RE: Port 5000 and Windows XP

From: dave kleiman <dave(at)netmedic.net>
Date: Wed Aug 13 2003 - 21:18:51 EDT

Unplug-n-Pray

https://grc.com/unpnp/unpnp.htm  

---

Dave Kleiman
dave@netmedic.net
www.netmedic.net

"High achievement always takes place in the framework of high expectation." Jack Kinder  

-----Original Message-----
From: Myers, Marvin [mailto:MRMyers@anteon.com] Sent: Wednesday, August 13, 2003 12:22
To: Adam Newhard; security-basics@securityfocus.com Subject: RE: Port 5000 and Windows XP

The utility that I think you are referring is XPANTISPY. Google for it, it's out there. Port 5000 can and will be held open by the SSDP service also. I am seeing this in a lot of machines. Even ones that have XPANTISPY installed. This just started after the latest round of updates.

Hope this helps

-----Original Message-----
From: Adam Newhard [mailto:atnewhard@microstrain.com] Sent: Wednesday, August 13, 2003 9:16 AM To: security-basics@securityfocus.com
Subject: Re: Port 5000 and Windows XP

Side note, at one point in time, while working on a bunch of XP home and professional machines, going to services.msc and disabling upnp didn't always work. Since you don't really need it or want it, you should fully
remove it from the system. In other words, after disabling it and rebooting, port scan the machine. There is/was a utility that'd remove upnp
completely, but i forget where it is (i found it on google). Being a *nix
head, I can't tell you exactly how to completely remove it, but i'm sure someone here can.
adam

---

Adam Newhard
Microstrain, Inc.
If vegetarians eat vegetables, watch out for humanitarians

• Original Message ----- From: "dos cerveza" <dos_cerveza@mail.com> To: "matt willson" <mwillson@sbcglobal.net>; <security-basics@securityfocus.com> Sent: Tuesday, August 12, 2003 1:27 PM Subject: RE: Port 5000 and Windows XP

> Port 5000 TCP is used together with port 1900 UDP for UPnP (universal
plug
and play). It is open on a default Windows XP install.
> If you don't use it (and you probably don't) you can easily disable
the
mentioned ports from listening by opening 'services.msc' from a run box and
stop the folowwing services:
> 'Universal Plug and Play Device Host' &
'manual' to
prevent them from starting up on a reboot.
> http://www.grc.com has a nice article about this too.

>

> Sincerely
open
> > on
> > it. Subsequent research has shown that this is normal (albeit
stupid).
> >
> > However, when I connect to port 5000, I get an "HTTP/1.1 400 Bad
> > Request". Also, fport /ap shows port 5000 open, but will not
associate
> > an
> > application with it. Am I overly paranoid or has this box been
> > compromised?
> >
> > Thanks

>
>

> --
> __________________________________________________________
>
> CareerBuilder.com has over 400,000 jobs. Be smarter about your job
search
> http://corp.mail.com/careers

>
>
>
------------------------------------------------------------------------

--
-
>
------------------------------------------------------------------------
--
--
>


------------------------------------------------------------------------
---
------------------------------------------------------------------------
----


---------------------------------------------------------------------------
----------------------------------------------------------------------------





---------------------------------------------------------------------------
----------------------------------------------------------------------------

Received on Thu Aug 14 13:33:18 2003