I'm having exactly the same problem on our Windows 2008 server. I also found it because our IP had been blacklisted, also found massive incoming traffic on port 6515, but also found massive outgoing traffic through our router to numerous ip/ports, including
to ports 25 (ie we were sending spam!).
Wa have received a traffic data limit warning from our ISP (100GB in a few days!), who indicated that it started 31/12/11 and peaked over a couple of days, but is now going back to normal (due to my detective work so far).
What I've learnt so far: the RumorServer service (Mcafee Peer Distribution Service) is at fault/infected (I haven't found any dodgy files or registry entries to date, mcafee doesn't find any, I have also run kaspersky TDSSKiller - no root kit). Disable the
service and it all stops (It may however restart on automatic upgrade). Disabling the Windows Firewall incoming rules for Managed Services Agent, and adding incoming/outgoing rules to block program MyAgtSvc.exe on service RumorServer on all ports/protocols
stopped the 6515 traffic getting in, which stopped the outgoing traffic (the outgoing rule did not work on it's own, the infection must have own tcp stack or something).
The incoming 6515 calls must be generating the outgoing connections, as the incoming firewall rule seems to stop both types of activity.
We are still getting many incoming 6515 connection requests but the number is dropping slowly. Outgoing spam/DOS etc connections have stopped.
I have also filed a support request with mcafee. Their reply was to take server offline for hours to run a safe mode scan using beta dat, and to attach a tcpview file - I haven't yet done this as taking server offline causes problems, and I can't get into
the service portal with the grant no I was given, BT calls to their 'Free' 00800 number will cost a bomb (BT couldn't even tell me how much!) and I can't email them cause they have blacklisted me!
I also need a permanent solution!
