TCP + UDP ports

  • Thread starter Thread starter Estuardo Alvelais
  • Start date Start date
E

Estuardo Alvelais

Has anyone else found suspicious looking TCP and UDP port
accesses enabled in windows internet connection firewall
settings that appear to be associated with windows
messenger. In the list of the services that can create
accesses through the firewall, I found the following:

msmsgs 13598 TCP
msmsgs 15873 UDP

Since I discovered these two accesses, I began to closely
monitor messenger because I don't use it very often.
Despite the fact that I had disabled it from running at
startup or in the background, I noticed it would still
run automatically and restart itself even if I ended the
msmsgs.exe process in the task manager. Moreover, I did
not have this problem until recently. I then decided to
delete the TCP and UDP accesses in the firewall settings
only to discover that two new accesses with new numbers
were generated almost immediately after I deleted them.
After deleting these newer entries several times, I
became more suspicious. My temporary solution was to
disable messenger, but I used to have messenger enabled
without this issue. If someone can tell me whether or
not the msmsgs TCP and UDP accesses are legitimately
associated with Windows Messenger, I would greatly
appreciate it. Any other information regarding this
issue is also welcome.
 
The various flavors of MS Messenger use Universal Plug and Play to talk
to the Internet Connection Firewall and create port holes to allow
incoming connections to listening ports setup by Messenger.

Security for those open ports is entirely up to Messenger. If you want
to close those ports, then shut down Messenger and keep it off. Then you
can remove those entries from ICF.

For more complete application security, get a personal firewall that
watches what applications do. ZoneAlarm, Kerio and Tiny are good
examples.
 
Back
Top