[wplug] Strange IP Traffic

[Ken]

I inadvertently listed the IP incorrectly, my apologies.
It should have been 69.25.27.171 and I noticed 69.25.27.172 as well.
 
The traffic is coming from services.exe on the windows box. If I
restrict it's ability to access the net, traffic stops.
 
I have also adjusted my WPLUG email address since it was distracting to
some. The account of wplug at ramblernet.com has been replaced by
ken at ramblernet.com. Messages sent to the previous will bounce.
 
Thanks - Ken

-----Original Message-----
From: wplug-bounces+wplug=ramblernet.com at wplug.org
[mailto:wplug-bounces+wplug=ramblernet.com at wplug.org] On Behalf Of Ryan
Brown
Sent: Friday, August 20, 2004 10:42 AM
To: 'General user list'
Subject: RE: [wplug] Strange IP Traffic



Canonical: dialup-67.25.27.171.Dial1.Miami1.Level3.net Numerical:
67.25.27.171

 

Are you by chance talking to someone in Miami on an instant messenger
client?

 


  _____  


From:  Ken 
Sent: Friday, August 20, 2004 10:08 AM
To: wplug at wplug.org
Subject: [wplug] Strange IP Traffic

 

I've noticed some strange IP traffic from one of my W2K systems across
the firewall. 
It appears that packets are going from my Windows box to IP 67.25.27.171
on incremental TCP ports (reporting open ports?). I've used the various
virus & Trojan scans that report nothing. I'm not positive but it looks
like services.exe may be sending the data or being used by another app.

Has anyone seen this before? 

Thanks 
Ken 


-- 
This message has been scanned for viruses and
dangerous content by Ramblernet's MailScanner,
 and is believed to be clean.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://penguin.wplug.org/pipermail/wplug/attachments/20040820/fe5e127b/attachment-0001.html