From: "Geo." 

I think that's just a really old worm that used port 5000 so it's probably
going to change once you get new virus or firewall updates.

Geo.

"Ellen K."  wrote in message
news:lhsla0t4gnp26fsnin62deshgsuaq1q365{at}4ax.com...
> By me it's been sokets de trojan v.1 I think is the name of it... VERY
> insistent.
>
> On Tue, 18 May 2004 21:40:44 -0400, "Geo."
 wrote in
> message :
>
> >bobax
> >
> >http://www.us-cert.gov/current/current_activity.html
> >
> >They mention some other worm but that worm uses multiple ports and traffic
on
> >the other ports is normal so it's not that second worm.
> >
> >Geo.
> >
> >"Robert Comer" 
wrote in message
> >news:40aa0684$1{at}w3.nls.net...
> >> I thought it had the signs of a new worm, but nothing from the virus
> >> companies on it yet...
> >>
> >> - Bob Comer
> >>
> >>
> >> "Geo."  wrote in message
news:40a9df8d$1{at}w3.nls.net...
> >> > Port 5000 probes are not upnp, it's a new worm of some sort.
> >> >
> >> > Geo.
> >> >
> >> >
> >>
> >>
> >
>

--- BBBS/NT v4.01 Flag-5