up vote 1 down vote favorite
share [g+] share [fb]

Maybe this isn't the right forum to ask this question, but here it goes. Whenever I boot my vista machine, right after login there has been an extended delay until the actual desktop appears. I also noted recently that my other machines on the same network... their antivirus firewall is reporting that there is a broadcast of TCP traffic on port 139.

I've scanned my machine up and down for viruses, but haven't been able to find any. Could anybody think of something non-malicious that could be causing this? Is this a particularly well hidden rootkit?

link|improve this question
75% accept rate
feedback

2 Answers

up vote 1 down vote

It might be worthwhile to install Wireshark on another machine on your network and see what the packets are. As @marcusw and @Phoshi have noted, it could be windows sharing, or it could be a virus, so it seems like investigating the two possibilities.

What is your antivirus situation? Have you given Rootkit Revealer a try?

As for boot times, it might be worth opening up event viewer and looking in the System log and seeing if there are any obvious gaps between messages. Since you're on Vista, I believe there is some decent tracing of startup issues available, as per this article. If you go into its image gallery, the author walks you through investigating some programs that are slowing down the boot process. Unfortunately I don't have access to a Vista or 7 computer at the moment to confirm.

link|improve this answer
feedback
up vote 0 down vote

A quick google of the port mentioned turns up that it is used by the system for Windows File and Printer sharing. Try that first next time?

Oh, and I can't really help with the long boot times; Windows gives you no diagnostic information to go on and no system logs to look at, so you are about stuck unless your system crashes and happens to flash an error message (which you somehow manage to read before it goes away), which google may be able to identify for you.

link|improve this answer
1  
If I were writing a virus I'd use a port that wouldn't immediately arouse suspicion - don't be so quick to call it safe. – Phoshi Feb 24 '10 at 20:43
1  
That should not be possible because of Windows binding to that port on startup. If you really want to be sure, you can check with wireshark and see if the packets are really the expected ones. – marcusw Feb 24 '10 at 21:10
Aye, but it's not exactly unheard of for a virus to patch itself into normally clean system files, unfortunately. – Phoshi Feb 24 '10 at 21:31
@marcusw: Of course I know what the port is. However, many viruses have been known to proliferate through windows file sharing, which is why it caused alarm, one could see it as the virus trying to spread itself to other computers. Also, just because windows file sharing is bound to port 139, that doesn't mean it can't transmit to other devices on that port (it doesn't use 139 as the source port). – Brett Feb 25 '10 at 16:24
Well, I am neither a virus writer, security expert, person who has read the related RFC pages, or otherwise qualified individual, so you can tweak my advice all you want :) Just trying to help out, though I will stick to my point about error messages. – marcusw Feb 25 '10 at 17:32
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.