High CPU Utilization Occurs with Windows Media Monitor Service (276465)

Microsoft Windows Media Services 4.0

Microsoft Windows Media Services 4.1

This article was previously published under Q276465

SYMPTOMS

A port attack on the Windows Media Monitor Service may cause high CPU utilization to occur.

CAUSE

The Windows Media Monitor Service listens on port 7778. Repeatedly sending a buffer full of zeros to port 7778 can cause CPU utilization to be excessively high.

RESOLUTION

Find the attacker that is sending the garbage data.

If you suspect that your computer is the target of an attack, you can type the following command at a command prompt to view connections state:

" netstat -n " (without the quotation marks)

This command may cause the following text to appear on your screen:

 Active Connections

 Proto  Local Address          Foreign Address        State
 TCP    x.x.x.x:7778           x.x.x.x :45776         ESTABLISHED

You can use a network analyzer to track the problem further. It may be necessary to contact your Internet Service Provider (ISP) for assistance in attempting to trace the source.

STATUS

Microsoft has confirmed that this is a problem in Windows Media Services versions 4.0, 4.1.

Modification Type:

Major

Last Reviewed:

10/31/2003

Keywords:

kbprb KB276465