1
Maybe this isn't the right forum to ask this question, but here it goes. Whenever I boot my vista machine, right after login there has been an extended delay until the actual desktop appears. I also noted recently that my other machines on the same network... their antivirus firewall is reporting that there is a broadcast of TCP traffic on port 139.
I've scanned my machine up and down for viruses, but haven't been able to find any. Could anybody think of something non-malicious that could be causing this? Is this a particularly well hidden rootkit?
1If I were writing a virus I'd use a port that wouldn't immediately arouse suspicion - don't be so quick to call it safe. – Phoshi – 2010-02-24T20:43:38.593
1That should not be possible because of Windows binding to that port on startup.
If you really want to be sure, you can check with wireshark and see if the packets are really the expected ones. – marcusw – 2010-02-24T21:10:15.760
Aye, but it's not exactly unheard of for a virus to patch itself into normally clean system files, unfortunately. – Phoshi – 2010-02-24T21:31:21.367
@marcusw: Of course I know what the port is. However, many viruses have been known to proliferate through windows file sharing, which is why it caused alarm, one could see it as the virus trying to spread itself to other computers. Also, just because windows file sharing is bound to port 139, that doesn't mean it can't transmit to other devices on that port (it doesn't use 139 as the source port). – Brett – 2010-02-25T16:24:48.233
Well, I am neither a virus writer, security expert, person who has read the related RFC pages, or otherwise qualified individual, so you can tweak my advice all you want :) Just trying to help out, though I will stick to my point about error messages. – marcusw – 2010-02-25T17:32:33.437