Strange Ports..Ip's....

[vassil3427]

OK, a buddy of mine has a U.S. Robotics router hooked up to his DSL and 2 pc's...recently strange ports have been opening on the randomly on the router and is becoming freaky. They wont go away and seem to be multiplying, even if you reset the router, they come back within the hour...the ports are listed below(they change everyday though)


18820
36512
61622
21648
19592
11148
44953
33444
9630

It refuses to let you block or delete these ports, and they change occasionally anyways...please help him

 

[Nodsu]

Where and how do you see those ports listed?

 

[vassil3427]

On his router under Port Forwarding

 

[vassil3427]

Anyone?

 

[Rick]

Do you suppose someone has gained access to his router?

Try changing the password.

 

[vassil3427]

I think perhaps someone has gained access to his router and his system, mainly because he said when one of the ports shows up his computer slows down incredibly... I think there may be a key logger on his system though, because he set a password on it immediatly after the ports first started popping up...

 

[Nodsu]

Unless it is an uPNP router, someone has gained access to it. Change the admin password and disable router management from outside.

It may be that it is some "intelligent" router that can allocate ports dynamically for certain protocols like FTP..

If it is an uPNP device, disable uPNP if at all possible.