[windows] port 5000 web server?

[gorn]

i was in an aim chat with 2 of my friends and i sent this link to get the ip of one of them to screw with, then the other asked why i sent the linK (it was a picture of a duck) so i explained and she was like you can do it to me. so i said its windows so its different but if she has firewall software i'll set it off. so i scanned. had port 5000 open. i checked, seemed to be a webserver of a sort:

~
gorn@nixel % telnet xx.xx.xx.xx 5000
Trying blah...
Connected to blah.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 400 Bad Request

Connection closed by foreign host

so i search, port 5000:
port 5000 Back Door Setup, Blazer5, Bubbel, ICKiller, Sockets des Troie

any ideas which she has? and can i clean it from here?

thanks

[civ1492]

hmm i dont think its possible to clean the trojan from here, maybe when you get the trojan client you can deinstall it remotly...

[gorn]

ah i assumed the worsed

a windows box run by a family that uses internet explorer, aim, and mp3 sharing programs running a daemon. seemed to be a virus/trojan cause of the mp3 stuff, but was just windows me. good old microsoft.

[civ1492]

yep .. thats the problem with these things, trojans can be really nasty - you should tell them that they are infected and they should install a virus or trojan scanner asap...

[gorn]

twasnt a trojan, its microsoft upnp thing. ugh, that definatly should not be open to a external ip address.. no need.. stupid ms

[Compunuts]

You have already read this article,right??

There, they mentioned about M$ shipping XP with UPnP turned on by default....

[airhead]

Doh! ;D

[civ1492]

nice .. win XP - now with built in trojan .. no need to install one, M$ really cares for their customers :-/ ;D

[gorn]

this box is ME but i guess it has it also.

[Vendetta]

right, me an xp both have UPnP i think 98se has an option for it as well but not on by default.