Fact Or Rumor?

I have heard that when connected to the net WinXP contacts a Microsoft server and exchanges data about your computer. During this time M$ can detect the number of copies of XP you may be running. And so, if you happen to be running the same version on more then one comp, or a warez version they can detect it. I know it is illegal to run one version on more then one comp unless you buy some kind of license. This is the only barrier keeping me from upgrading to any form of XP, so is it true or not?

I've heard the same,but not positive it's true.I know there's a way around it though for two reasons.1.It's Windowz made by M$
2.It's all over the net 4 free.
I'll try and find more info on the subject,and where the detection program is stored so you can get rid of it.Knowing M$,they probably just hid it and if you can find the file name,do a file search and delete it.That seems to be about the extent of Windowz security.

I heard the same thing, but I also heard that there is a way around it - some sort of way to configure your machine not to contact M$. I'll let you know what I find if gg doesn't first.

The way to block xp from phoning home is to use a firewall like sygate and block all ports. Also there is a free program out there that allows you to turn off all of the "phone home" programs...It can be found here : http://www.xp-antispy.de/ NOTE this program is 100% free and legal to use. This site is in german, but click on the download tab and you can get the english version of the program. Enjoy. It has an easy to use interface that allows for all spyware in windows to be turned off without having to do a manual search....

I found (thru my firewall) where connections were being made to *my computers name*.mshome.net...ports 1615 and 5000....I'm not sure if this is the feature in question or not, but I went ahead and specified a rule to block the connections anyway.

The people I know in Redmond have downplayed this as a rumor, but then again, thats what one would expect from M$.....so I can't give a definite answer either.

But since we're on the subject, I have a question about Windows processes trying to connect to the Internet. I'm really not a Windows person at all and hardly ever use it, so maybe you guys that use it all the time can shed some light on this.

When I install XP, I always unplug the cat 5 during installation until I get AtGuard installed and configured to be sure nothing gets in or out until I'm ready. IMMEDIATELY when I plug the cable in, I get an alert for Generic Host Process for Win32 trying to connect to an IP address on port 1900. I've always blocked it and never had any problems that I can see. What is that?

Don't know if that's the correct port or not, since I'm not familiar with XP...but what port is used to detect whether or not updates are available for your computer? The "Automatic Update" feature that many people gripe about. Is that the same as GHP?

the port 1900 deal is the UPNP service trying to find UPNP devices on your network..

Don't remember too well, but wasn't there a major security flaw with the uPnP port?

http://www.antionline.com/showthread...highlight=upnp
http://www.antionline.com/showthread...highlight=upnp

Though isn't port 5000 the one for uPnP?

Heres another one regarding the flaw from our very own Euclid. :)
http://www.antionline.com/showthread...highlight=upnp

Also, running a search for uPnP will give a bunch of threads to view.

Cheers.

Thanks for the info guys.

the UPNP problem was the first HUGE security flaw found in xp, or atleast the first huge one released to the public. however, you can check out http://www.grc.com where Steve Gibson has some applications designed to point out and fix alot of the xp security flaws. Also there is a great deal of information as to what the exact problems are in XP, like how UPNP is a security risk.

And I believe that the traffic that problemchild is seeing is a broadcast by his pc looking for other UPNP devices on his network. the traffic should probably looks somthing like this..

your.ip.addr.here -> your.domain.here.255:1900

where you will see anything else on your network that happens to respond to broadcasts replying that the port does not exist, that is unless you have another xp system on the network that doesn't have UPNP turned off.

This traffic puzzled me as well. One LAN party I went to I was approached by the host asking me to get my norton updates and scan my pc because he thought i had a virus. Once the host saw that my box was clean with the latest updates he did a little checking. And suggested i turn off the UPNP service. I went to http://www.grc.com and got the little app "Unplug n' pray" and turned it off. The traffic stopped and they left me alone. Oddest thing in my mind that night was that I was the only person running XP.

So if you're concerned about the traffic go get that app and check your system. Upon running the program it will open a dialog that tells you that your system is either safe or unsafe and gives you the option to turn UPNP on or off depending on it's current state.

And while you're there you might want to check out some of his other applications.