Unusual Firewall Entry

  The Nuclear Boy Scout 17:00 26 Aug 2003
Locked

Hi everyone,

OS: Windows XP Home Edition
Firewall: XP Internet Connection Firewall

When checking that my firewall was in order this morning, I noticed this entry which was checked:

dplaysvr (255.255.255.255:47624) 47624 UDP

I don't know how it got there, and whether or not it is malicious or part of some program. Does anyone know anything about this? Is it OK to remove it?

Thanks

Oliver

  canard 17:09 26 Aug 2003

I'm told that 255x4 addresses are usually spoofed[it's the last available number]. So hope it didn't get in because it is probably ill intentioned.

  bremner 17:15 26 Aug 2003

A check on dplaysvr.exe on Google shows a couple of things to do with sound card drivers but it does include references connecting it to the W32.magitr.24786 virus!

Have you run a virus check recently

  The Nuclear Boy Scout 17:39 26 Aug 2003

Yes I ran a full virus scan this morning with no problems, also ran Adaware and Spybot (and Spybot found a keylogger which was deleted). So afer getting paranoid, I decided to check my firewall and found dplaysvr on it!

Thanks for the posts.

Oliver

  hugh-265156 17:44 26 Aug 2003

Filenames that the virus can use include

CFGWIZ32.EXE
CHLINST.EXE
DPLAYSVR.EXE
MAKETAG.EXE
MKCOMPAT.EXE
MLSET32.EXE
MSOOBD.EXE
MSOOBE.EXE
OEMRNCE.EXE
SETMODD.EXE
SUCATREG.EXE
SULFNBK.EXE
UNREGASF.EXE

Please note that these files are often found on uninfected systems, so their mere presence on your computer is not necessarily an indication of infection by this virus


DPLAYSVR.EXE is a compac monitor driver.

  hugh-265156 17:46 26 Aug 2003

sorry i should have provided the link to my cut and paste above click here

does your monitor check for updates? :-)

  The Nuclear Boy Scout 17:50 26 Aug 2003

I have a Hansol monitor, and to my knowledge it doesn't check for updates (I'm quite sure it doesn't).

I also found just now that dplaysvr was a Microsoft DirectPlay server, for Microsoft games. I installed Microsoft Flight Simulator 2004 a few weeks ago - possibly related?

Oliver

  hugh-265156 18:03 26 Aug 2003

my last was a poor attempt at humour,sorry.

i think you could be correct about flight sim 04 online.DPLAYSVR.EXE(direct play helper) i have since found out is installed by direct x.

  hugh-265156 18:08 26 Aug 2003

yes its part direct x.

click start, click run and type dxdiag and click ok.click on the directx files tab and scroll down a bit.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Best phone camera 2017

Stunning new film posters by Hattie Stewart, Joe Cruz & more

iPad Pro 10.5in (2017) review

28 astuces pour profiter au mieux de votre iPhone