attacks on local port 1025

I use XP Home and noticed on several occasions attacks on local port 1025. On this port svchost.exe is listening (TCP). These attackers manage somehow to establish an incoming connection on this port using PASV FTP. Luckely I deny inbound traffic for svchost.exe if it's using PASV FTP. In my firewall log I can see these attackers have rather exotic ip's as 220.168.167.245 (CHINANET HUNAN PROVINCE NETWORK) and 219.145.23.169 (CHINANET SHANXI PROVINCE NETWORK). I suggest if someone notices similar inbound traffic on local port 1025 to report it here. It could be that there's someone outthere exploiting a system vulnurability.

jeff
Sun Jun 27 15:45:06 CDT 2004

On Sat, 26 Jun 2004 23:52:01 -0700, "Erwin Michiels"
<ErwinMichiels@discussions.microsoft.com> wrote:

>I use XP Home and noticed on several occasions attacks on local port 1025. On this port svchost.exe is listening (TCP). These attackers manage somehow to establish an incoming connection on this port using PASV FTP. Luckely I deny inbound traffic for svchost.exe if it's using PASV FTP. In my firewall log I can see these attackers have rather exotic ip's as 220.168.167.245 (CHINANET HUNAN PROVINCE NETWORK) and 219.145.23.169 (CHINANET SHANXI PROVINCE NETWORK). I suggest if someone notices similar inbound traffic on local port 1025 to report it here. It could be that there's someone outthere exploiting a system vulnurability.

First, why isn't your firewall blocking this? Second, port 1025 is a
common port used for many access reasons, and FTP is one of those.
Third, port 1025 is an often used port for a number of scripted attack
vectors, usually a compromised system that has had ServU installed.

Jeff

ErwinMichiels
Sun Jun 27 18:26:01 CDT 2004

My firewall (Agnitum Outpost) is blocking this inbound traffic when svchost.exe uses PASV FTP (TCP) on port 1025 and a range of others. Nevertheless my firewall logs the connection request ("attack") on port 1025 (TCP) and also the attempted inbound connection with svchost.exe using PASV FTP on the same port. As written in my first post my firewall then denies the request. My point is that SVCHOST.EXE ALLOWS THIS INBOUND TRAFFIC on port 1025. So this is a system vulnurability. I doubt this is caused by a trojan having called home or some other virus. I run a fully patched system checked with MBSA, a firewall checked with grc.com (fully stealthed), an up-to-date anti-virus application and an up-to-date spyware blocker. If this is caused by a virus of some kind it has to be completely new. But I will look into ServU. Thank you for the suggestion.

"Jeff Cochran" wrote:

> First, why isn't your firewall blocking this? Second, port 1025 is a
> common port used for many access reasons, and FTP is one of those.
> Third, port 1025 is an often used port for a number of scripted attack
> vectors, usually a compromised system that has had ServU installed.
>
> Jeff

jeff
Mon Jun 28 09:40:51 CDT 2004

On Sun, 27 Jun 2004 16:26:01 -0700, "Erwin Michiels"
<ErwinMichiels@discussions.microsoft.com> wrote:

>My point is that SVCHOST.EXE ALLOWS THIS INBOUND TRAFFIC on port 1025. So this is a system vulnurability.

SVCHOST doesn't allow or deny traffic on any ports. SVCHOST is a
generic name, used to indicate any process running from a DLL. Try
this to see what the real process might be:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;314056

Jeff