HTTP changed to port 8083

[shayv]

Hi

strange problem began last week:
on my windows XP, i'm trying to browse, and after 2-3 min. the browsing stops.

I look in the snifer - and see that the port of the HTTP packet goes out with - 8083, instead of port 80!

tried to look in the registry for "8083" but couldn't find anything.

Any ideas?

 

[linney]

Do you have any type of Proxy Server setting in use?

 

[smah]

This is a common misconception - the packets going out of the client can be sent on almost any port above 1024. Only the server will be listening on port 80.

 

[shayv]

Hi

I don't have any proxy settings in use.

When the packet goes out of the client it looks like this:
source - random port (above 1024)
Destination - port 8083

and then the reply from the HTTP server is RST, since he's not expect getting this packet on this port.

While normal session should look like this:
source - random port (above 1024)
Destination - port 80

Thanks

 

[smah]

OK, if the packet is being sent to destination (remote server) port 8083, something is telling it to. About the only reference that seems consistant seems to be related to a vulnerability in jboss server. You might be infected with something that's trying to take advantage of that vulnerability. I suggest that you go through a couple of different virus scans - Free online scanners faq760-3862