Unexplained apps in Linksys port forwarding

I have a linksys wireless router - BEFW11S4 and I have a desktop and
laptop using wireless connections to the router. Everything works
fine.
I wanted to FTP to the desktop from outside my house so I loaded a FTP
server and because I was told it would be safer - I mapped a random
high port number ot port 21 . All this worked fine.
Recently I went back into the router and noticed that there were 2 new
apps in th port forwarding which I did not add! I can't find anything
about them. Or - I can't understand how they got there. I couldn't
find anything about potential security problems with the router except
vague references .
I disabled all of it

However,
How can apps get added to port forwarding in the router? Is this a
hack or security thing? or is there a way for apps to update the
router. (I changed the admin password from the default) .

As far as the apps added - they are:

ELFP—Ð from Ext port - 1334 to Int. port 5292 using UDP
and
ELF?—Ð from Ext port 2837 to Int port 5276 using UDP

I don't see any of the ports using netstat -a

Any ideas on how this happend or what these are?
Thanks!

sabino <(E-Mail Removed)> hath wroth:

>I have a linksys wireless router - BEFW11S4 and I have a desktop and
>laptop using wireless connections to the router. Everything works
>fine.
>I wanted to FTP to the desktop from outside my house so I loaded a FTP
>server and because I was told it would be safer - I mapped a random
>high port number ot port 21 . All this worked fine.
>Recently I went back into the router and noticed that there were 2 new
>apps in th port forwarding which I did not add! I can't find anything
>about them. Or - I can't understand how they got there. I couldn't
>find anything about potential security problems with the router except
>vague references .
>I disabled all of it
>
>However,
>How can apps get added to port forwarding in the router? Is this a
>hack or security thing? or is there a way for apps to update the
>router. (I changed the admin password from the default) .
>
>As far as the apps added - they are:
>
>ELFP—Ð from Ext port - 1334 to Int. port 5292 using UDP
>and
>ELF?—Ð from Ext port 2837 to Int port 5276 using UDP

Welcome to Universal Plug and Play. Go to:
http://www.linksysdata.com/ui/BEFW11...nistration.htm
on your router and disable UPnP. The ports are probably owned by MSN
Messenger and are random. If you're using MSN Messenger, then leave
UPnP turned on as many of the features don't work unless it is
enabled. There are also other programs that use UPnP to automagically
configure holes in your firewall for their benifit.

You can also turn it off on the computah end. In Windows XP:
Start -> Control Panel -> Add/Remove ->
Add/Remove Windows Components.
Scroll down to Networking Services, and uncheck "Universal Plug and
Play".

Light reading:
http://grc.com/UnPnP/UnPnP.htm

http://www.microsoft.com/windowsxp/u..._02july22.mspx
http://www.upnp.org

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558