Universal Plug n Play (security risk)

How can I determine which devices on my PC use the Windows Universal
Plug and Play component? I run Windows 98 SE.

My firewall alerted me to a scan on port 5000, saying it was likely to
determine whether there was a trojan horse on my pc or whether I was
using Univeral Plug and Play. It added that currently no devices on
my PC were listening on Port 5000.

Which begs the question, well, what devices use it? What if I had had
a device usimg it at the time? I don't know how to tell whether any
devices on my PC use that component. I'd like to at least be aware
when I am making myself vulnerable.

Considering that uPnP is NOT a component of Win9x, only WinME and WinXP, the only way to
have a component on a Win98 PC is for you to have installed the Gateway Service (for uPnP
compliant Routers) or you do have an infector using port 5000.

Chances are you would know if you had the Gateway Service client installed so it leads me to
believe you do have some sort of Malware.

Dave




"BArun" wrote in message
om...
| How can I determine which devices on my PC use the Windows Universal
| Plug and Play component? I run Windows 98 SE.
|
| My firewall alerted me to a scan on port 5000, saying it was likely to
| determine whether there was a trojan horse on my pc or whether I was
| using Univeral Plug and Play. It added that currently no devices on
| my PC were listening on Port 5000.
|
| Which begs the question, well, what devices use it? What if I had had
| a device usimg it at the time? I don't know how to tell whether any
| devices on my PC use that component. I'd like to at least be aware
| when I am making myself vulnerable.

Windows ME and XP include native UPnP support; Windows 98 and 98SE do not include
native UPnP support, but it can be installed via the Internet Connection Sharing
client that ships with Windows XP.
--
Glen Ventura, MS MVP W95/98 Systems
http://dts-l.org/goodpost.htm

"David H. Lipman" wrote in message
...
Considering that uPnP is NOT a component of Win9x, only WinME and WinXP, the only
way to
have a component on a Win98 PC is for you to have installed the Gateway Service
(for uPnP
compliant Routers) or you do have an infector using port 5000.

Chances are you would know if you had the Gateway Service client installed so it
leads me to
believe you do have some sort of Malware.

Dave




"BArun" wrote in message
om...
| How can I determine which devices on my PC use the Windows Universal
| Plug and Play component? I run Windows 98 SE.
|
| My firewall alerted me to a scan on port 5000, saying it was likely to
| determine whether there was a trojan horse on my pc or whether I was
| using Univeral Plug and Play. It added that currently no devices on
| my PC were listening on Port 5000.
|
| Which begs the question, well, what devices use it? What if I had had
| a device usimg it at the time? I don't know how to tell whether any
| devices on my PC use that component. I'd like to at least be aware
| when I am making myself vulnerable.

On Sun, 15 Aug 2004 17:09:12 -0400, "glee"

Windows ME and XP include native UPnP support; Windows 98 and 98SE do not include
native UPnP support, but it can be installed via the Internet Connection Sharing
client that ships with Windows XP.

Interesting bit of stealth installing there. Next step would be to
stealth in an attackable RPC and LSASS, so that Win9x can emulate the
"immediately infected" mileage of patched XP :-)



--------------- ----- ---- --- -- - - -
Dreams are stack dumps of the soul
--------------- ----- ---- --- -- - - -