Suspiciouis IP message at start...trace?

Archived from groups: comp.security.firewalls (More info?)

"dontb" <dontb@yahoo.com> wrote in news:gvVHc.65072$rh.27271@okepread02:

> I get a unknown IP message sent each time I start my computer.
> Is there an application or some way that will allow me to associate
> the program on my computer with the momentary IP message sent from my
> computer at startup?
>
> Background/configuration:
> XP, Linksys Router
> Wallwatcher: I use Wallwatcher to monitor all IP activity at my
> Linksys router.
> Kerio Firewall: I also use Kerio firewall to block this IP each time,
> but at every startup a new IP message is sent from my computer.
> Each time I add the new IP address to the Firewall block, a new one is
> sent at the next startup.

Malware can beat any PFW solution at system boot because the PFW solution
is not an intergrated O/S component that can get to the TCP/IP connection
at boot before the malware can. However, XP's SP2 FW is able to get to
get to the TCP/IP at boot and stop outbound, because it's an intergrated
O/S component.

> I have used Spybot to cleanse and also Norton scan every day.

Obvisouly, they can be beaten as they are a dime short and a dollar late
with the protection.

>
> TCP View/Process Explore: I have used TCP View and Process Explore
> but I dont see how those help me track this momentary message.

>
> Is there an application or some way that will allow me to associate
> the program on my computer with the momentary IP message sent from my
> computer at startup?
>
> Any thoughts appreciated.
>
>
>

You can use Active Ports which I put a short-cut for Active Ports in the
Start folder so that I can get a clear picture as to what's happening at
the system boot and logon process with connections. You can set Active
Ports screen Refresh rate to High. If connections are being made at the
boot and logon process, you should be able to see it with AP.

I also use Process Explorer to look at running processes and PE can look
inside a running process to see what programs/processes are using the
process. You see it's not always the process that's running that wants
the access and is being used as a host so that the real culprit that
wants the access can get out.

I suggest that you find some documentation using Google on the features
of PE and how to use them as PE is one powerful piece of software that
can be used to point an exploit running on the machine.

<http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_an
d_Rootkit_Tools_in_a_Windows_Environment.html>

Of course any O/S componemt such as Svchost.exe or Dllhost.exe, etc, etc
that's not running out of the System32 directory is a Trojan.

Duane

Archived from groups: comp.security.firewalls (More info?)

there are 2 that i cant explain. The one from Amsterdam surely cannot be
something I want on my computer.

80.67.74.64 RIPE Network Coordination Centre in Amsterdam

69-44-123-105.wcg.net Wiltel communications in St. Louis.


"Lars M. Hansen" <badnews@hansenonline.net> wrote in message
news:e0o0f0p729ot9v2ma7uaogs998h54286h9@4ax.com...
> On Sat, 10 Jul 2004 10:20:58 -0700, dontb spoketh
>
> >I get a unknown IP message sent each time I start my computer.
> >Is there an application or some way that will allow me to associate the
> >program on my computer with the momentary IP message sent from my
computer
> >at startup?
> >
>
> It would certainly help to get some more specific information, but I
> suspect it's Norton AntiVirus that either checks for updates or checks
> in the crl.verisign.com.
>
> Lars M. Hansen
> http://www.hansenonline.net
> (replace 'badnews' with 'news' in e-mail address)

Archived from groups: comp.security.firewalls (More info?)

"dontb" <dontb@yahoo.com> wrote in message
news:lsZHc.65834$rh.28749@okepread02...
> there are 2 that i cant explain. The one from Amsterdam surely cannot be
> something I want on my computer.
>
> 80.67.74.64 RIPE Network Coordination Centre in Amsterdam

Common problem with doing a whois on a non-RIPE system for an IP allocated
to RIPE. RIPE allocates out IPs to the whole of Europe. Whenever you get a
RIPE response from the US whois database, goto www.ripe.net and do a whois
db lookup. That IP is allocated to Akamai, who run web systems for many
large companies (eg. Yahoo, Microsoft). For instance, Windows Update will
want to go that IP range.

Dan