How do I release Blocked Ports

[R3D3]

I have something in windows that I cannot get rid of.
It started long ago when machine first setup and Virus Checker/Firewall not yet installed.

Something is opening up ports and leaving them LISTENING.
After 36 hours all 5000 ports are left listening and there are none free for my applications to use.
Rebooting every day appears to the only option until I have chance to completely reinstall the machine.

I've tried various Virus Checkers and none of them have identified it as a known virus.

I have tried firewalls to Drop/Deny the TCP outgoing traffic but it still leaves the Port in a Listening State.

Incidently, it is attempting to communicate to 10.0.1.128:6667

Any ideas would be much appreciated.

 

[covski]

Really does sound like a virus / trojan. Although the fact it is trying to connect to a 10.x.x.x address indicates something on the LAN. So take a look at that machine, do a ping -a 10.0.1.128 to get its name.

Also, I think that port 6667 is one of the peer to peer network dynamic ports so that's worth looking into.

Hope this helps

 

[R3D3]

There is no machine with this address on the LAN.

I've heard that 6667 is more than likely an IRC trojan or a trojan using standard IRC ports to mimic an IRC server.

Isn't there a way of the firewall stopping the tcp packet from reaching the port? Or opening it up again after it has been denied?

 

[rphips]

HAte to be a late entry but if you check the following site

Windows 2000 security alert you will find 6667 indicate a intrusion and the only way to get rid of it is reformat.

http://www.unm.edu/cirt/security/win2k1.html

bob