Sockets de Trois v1? Anyone know about this?

[nigma2]

Hey all,

I recently was working on my computer and I get this message from my firewall "Someone recently tried to access you computer, the attempt was blocked. Would you like to view more details?" I click yes it says they tried to connect to port 5000(which on that computer was open), I do search on that and find out that port 5000 is used for a program called Sockets de trois v1, it is supposed to be a Trojan Horse or something. Has anyone experienced this?

I would close the port but am not sure if a critical systam task is running on it, this is the service that my firewall reports that it is running: MPREXE.EXE. The next day the same thing is reported by firewall so it is possible that if this is a Trojan horse that the person trying to utilize it is constinentily trying to connect.

Thanks for all help and advice provided.

-Nigma

 

[WheeDoggy]

If you are running Win XP, this is probably the Universal Plug and Play service.

Go to:

http://v4.windowsupdate.microsoft.com/en/default.asp

See if any patches.

Should take care of the problem.

 

[SESaskDFC]

Howdy:

Sockets de Troie aliases: Blazer5, Kamikaze, Ailleurs, Sockets23, Win32.HLLP.DeTroie. Other spellings: Sokets de Troie, Sokets du Troie, Sockets des Trois, Sokets des Trois, Sokets de Trois

Go to the following url for removal instructions..

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllp.detroie.html

Murray

 

[nigma2]

Thanks a bunch for the help. I am very appreciative of all your suggestions and esp. the link.

Thanks again.

-Nigma

 

[Xemus]

Port 5000 is most commonly for Universal Plug and Play, like wheedoggy said. GRC.com has a quick and easy program to close this hole.

http://www.grc.com

MCSE, A+