Background Intelligent Transfer Service, Possible Security Hole?

[Jim Garrigan]

I believe that someone was connected to my laptop via the
Background Intelligent Transfer Service. When I shutdown
the service the session was disconnected. I confirmed
this interaction by starting the service. After the
service started the session was connected again via
another port. Once again I shutdown the service and the
session dropped.

Active Connections

Proto Local Address Foreign Address
State
TCP laptop001:3083 208.172.48.132:http
ESTABLISHED

Active Connections

Proto Local Address Foreign Address
State
TCP laptop001:3085 208.172.16.132:http
ESTABLISHED

 

[Lanwench [MVP - Exchange]]

Get a firewall (either software like BlackIce or www.sygate.com 's freebie,
or a hardware appliance, if it's a true firewall and not just a NAT box).

Also run a full AV scan with updated software, and download/run AdAware from
www.lavasoftusa.com - update it first. Also, go to
windowsupdate.microsoft.com on a regular basis to get patched.