×
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
theflyingmonkey
Former Member
Message 1 of 3

Odd Firewall Entries

Hi, I am using XP Home Service Pack 3 with McAfee Internet Security.  Okay, I noticed that in my incoming events in the History and Logs of McAfee it said that there were 4 incoming events one of which was done by the same ip address.  However, the odd thing is that these activity or events' times were after I had exited Firefox.  The first ip was 74.125.53.138 and it was accessing TCP Port 1204, the second was 74.125.224.251 accessing TCP Port 1167, and last was 72.235.63.18 accessing TCP Port 1302 with a minute of its first attempt.

The odd thing is that after I started Firefox, I went to only check my Yahoo email, when I did a reverse ip lookup the first two belong to Google I believe.  The odd thing is that if I used the site http://www.yougetsignal.com/tools/web-sites-on-web-server/ it says that this domain (s0.2mdn.net) is hosted on this ip address (74.125.224.251).

What is even odder is that this ip address was trying to access TCP Port 1167, upon googling this port.  Speedguide.net and pc-library list that this port is used by Trojans.  pc-library list the trojan as Downloader-AAA and Speedguide.net listed it as Crazzynet.

Basically, what the heck is going on?  I didn't even go to google and it is possible that this TCP Port 1167 (aka Downloader-AAA) is on or infected my computer?

2 Replies
exbrit
MVP
MVP
Message 2 of 3

Re: Odd Firewall Entries

Incoming Events is basically there just to tell you that Firewall is blocking unknowns - they are all failed attempts.  We all see them in that section of SecurityCenter.  Many are legitimate of course but some not and that list is really only there as an FYI.   You have no need to do anything further or worry about them.

It looks scary, but there is no need to worry about those I assure you.

newjack
Former Member
Message 3 of 3

Re: Odd Firewall Entries

You could try this.Open a Command prompt. Start button,the Run,type CMD.Then when the window opens type in netstat -ano.This will show what connections are established.Make sure you don`t have any browsers open when doing this.Also there is a space between the netstat and -ano

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community