SOT: Odd Laptop Behaviour

[The Other John]

Slightly off topic but I hope the 'cure' will be DIY and I know there are a lot of clued up peeps hereabouts.

Seeing the laptop's activity light forever flashing I ran TCPEye to see if it was network activity and found that it is repeatedly connecting local ports, e.g. 49768 - 49847 to 'routerlogin.net:ssdp'

I've run anti-virus scan and Malwarebytes but nothing untoward was detected. I've tried Google but not seen anything similar mentioned.

The 'puter's running Windows 7 HP 32 bit and connects to the network by wifi. My desktop 'puter running win7 64 bit and wired to the router does not do this.

Any ideas what's going on?

[Toby]

If you go to Control Panel -> Network and Internet -> Network Connections Right click on your local LAN (WiFi) connection and select properties do you have Link Layer Topology discovery Mapper I/O Driver enabled?

If so, it will be trying to discover stuff on the network. That links looks like the address used by Netgear routers

If you go to an internet browser and shove routerlogin.net in the address bar, it will probably connect to your, probably Netgear, router.

[James Harris]

Is the activity light for the network (not all machines have that) or for the hard disk (which is more common and if it is flashing while your machine talks to something unexpected on the internet that is more concerning).

I have always kept my machines updated and virus protected yet once I found a machine pushing data out to a foreign host that I did not recognise. There is always a danger that a program gets installed on your machine and not picked up by protection software.

I don't use it any more but IIRC zonealarm was/is useful for limiting what outgoing connections a machine can make. This seems to be it:

One thing that caught me by surprise: if a domestic broadband router has uPNP enabled then any host on the LAN can tell the router to open up a port that can be connected to from the internet - i.e. an internet host can initiate the connection. That's not good! A port can be open to the world even if the router has been told to ignore all attempts to contact it from outside. So unless you need that facility you will probably want to ensure that the router doesn't have uPNP enabled.

James

[The Other John]

Yes it was - don't know why as I didn't know what it was for - maybe enabled is the default? Also noticed that remote assistance was enabled so I disabled that too.

Checked with TCPEye and all is quiet - thanks for that Toby.

[The Other John]

It's the disk, but I was concerned that it might be churning out data to the rest of the world!

Fixed it thanks to Toby's suggestion that it was Link Layer Topology causing it.

That's interesting, I'll look into that.