What's sending this?

I've recently noticed that my machine is trying to reach ns.winroute.cz:80 on a regular basis. It seems hourly. Now, I'm in N. America, and have no ties to CZ at all, so I'm not sure why I would be trying to go there. Has anyone heard of this before?

On the same topic, is there any way to determine what software is generating those requests? It would have to be something that can sit and monitor for the attempts, and then identify what's trying to send it. The box is running Win2k Pro, btw.

I have no idea what it could be, but it's troubling me. Any suggestions would be appreciated.

Umm.. Have you got Anti-Virus software installed? Off-hand I'd guess one of two things: spyware or more likely Code Red. How up-to-date is your AV and when did you last do a FULL SCAN?

Hiya, looking deeper into this, the link translates to reg.kerio.com. The Domain info is as such:

Domain Name: KERIO.COM

Registrant:
fubar

Administrative Contact:
fubar [email protected]


Technical Contact:
VeriSign, Inc. (HOST-ORG) [email protected]
VeriSign, Inc.
21355 Ridgetop Circle
Dulles, VA 20166
US
1-888-642-9675

Record expires on 07-Feb-2004.
Record created on 02-Apr-2001.
Database last updated on 8-Apr-2003 18:48:36 EDT.

Domain Name Servers:

NS.WINROUTE.COM 194.213.194.16
NS.WINROUTE.CZ 194.228.3.66

Looks like Spyware to me........Winroute.com's contact info lists Tiny Software. Ad-Aware time..
Hope this helps....Bye for now.

Based on Wazz's reply:

You aren't by any chance running the Kerio personal firewall ( former Tiny)?

If this is the case, this could be your firewall connecting for something, probably to check for updates or something similar, I ve never used it so I cant tell... just a thought as usuall :)

As for discovering the service behind the resquest, a tool like TCPView v2.3 may help you. You can find that at www.sysinternals.com.

Port 80 is a HTTP:// port so I wouldn't worry about it much unless your infected with some adware/trojans. If you truely are infected with something then the program may bring up spam or pages that has plugins and updates for all the maleware on your PC. Do a nice www.google.com search and there are alot of free ad/spyware & trojan removal.

If it come out clean then its probably a legitamit windows program (IE) when your online and listening to music windows media-player will try loading some of MSN's webpages. Im sure that if you take a good look around your box you'll find a option to turn off auto-updates. Once you turn these things off it usually asks you to update over and over agian but alot of times you can just click a check box that says something like "don't show this window agian".

I Think you need to install Antivirus ok Then do a fullscan in your system .Then search in

www.google.com

to find what kind of virus n always update your virus ok.
Good Luck:)

You may want to capture the traffic to and from your machine. For all you know, a webpage your looking at is showing you an ad from that server.



PuRe

Thanks for all the responses. Here is some additional information:

• I always have my AV software running, and it's updated at least several times a week.
• I run Ad-Aware 6 around once every week or two.
• I had already found the connection between Kerio and Tiny software. Tiny makes a firewall product, called Tiny Personal Firewall, which I use. It's a pretty good firewall, generally. I guess I was having trouble believing they could have something to do with it. Heck, I was even trying to use it to help identify the application generating the traffic! :rolleyes: I'm surprised, and frankly disappointed by this kind of behavior. Even if it was just checking for updates, as was suggested, it would have been nice to know. I wonder what it's been sending.
• I have turned off TPF, and am monitoring with Windump for those packets. Haven't seen any since. Will monitor for the rest of the day just to see. Yesterday, I had the same windump string monitoring, and it picked up the traffic about every hour.
• This still doesn't provide what I wanted in terms of monitoring for which apps send out packets. Fport and TCPView can monitor what's running, but there doesn't seem to be a way to monitor - a la windump - for a given packet pattern from a specific app. That would be a cool thing to know, forensically. Especially when it's intermittent.

Thanks again for the help.

Could you not filter it to look for specific things like port 80 or winroute.cz? The only tool that I know that could filter as it's collecting would be something like Snort IDS where you can create your own ruleset and have it only detect those that match that pattern. All others it just ignores and let's pass.

Quote:

---

Could you not filter it to look for specific things like port 80 or winroute.cz? The only tool that I know that could filter as it's collecting would be something like Snort IDS where you can create your own ruleset and have it only detect those that match that pattern. All others it just ignores and let's pass.

---

That's essentially what I did with windump. I filtered on traffic originating from my box, with a destination other than my internal net. Since I use a proxy server, all legitimate web traffic goes there, which is internal, so there wasn't much going directly outside. I was able to watch the traffic I sent out. I've got that problem pretty much under control.

What I'm still interested in, though, is something that would monitor the app that sent the packets. Your example of using snort, for instance, would enable me to see which computer is sending the packets, but that still doesn't tell me which application running on my machine is responsible for sending that packet.''

Hmm... maybe a HIDS would, though. But I'm really looking for a forensic tool that can be lightly deployed on a given box to watch what app or process is generating it. I think that could be a useful tool. (Wish I had the coding skills...)

ok jsut for a bit more information on the "who is" stuff: (See below) But here it is in a nut shell. You stated you are "back in the states" You where using a ISP in Europe. Mostly likely in Czech Rep...? ns.winroute.cz is a DNS server on the network. It is a public server and is available for DNS lookups. You can replicate this inofrmation by going to command prompt Type nslookup (W2K or better) Type: server ns.winroute.cz hit enter and your can do DNS lookup on that server. Why port 80.... Can't tell you that one but all in all I would not worry about this...

Paldie MCSE, CCNA, CCA, CCAI, CSSA, LMNOP

Summary:
Name: ignor.tinysw.cz
IP Address: 195.39.55.4
Location: PRAHA (50.090N, 14.410E)
Network: TINYSOFT-CZ

See Registrant Pane for registrant contact information.

Registrant:
This is the RIPE Whois secondary server.
The objects are in RPSL format.
Please visit http://www.ripe.net/rpsl for more information.

The object shown below is NOT in the RIPE database.
It has been obtained by querying a remote server:
(whois.nic.cz) at port 43.
To see the object stored in the RIPE database
use the -R flag in your query

REFERRAL START
This whois looks up records in off-line generated RIPE
databases maintained by the Czech Network Information
Center. Results needn't contain all available information,
see also on-line full information search service at the
web-site http://www.nic.cz/

Timestamp: 10.04.2003 (dd-mm-yyyy) 00:44 (hh:mm) CEST

domain: tinysw.cz
descr: Tiny Software CR, s.r.o.
descr: Plzen
admin-c: TH20-RIPE_XX
tech-c: TH20-RIPE_XX
bill-c: TINY-CZ
nserver: ns.winroute.cz ns.winroute.com


role: Tiny Software CR, s.r.o.
address: Sedlackova 16
address: Plzen
address: 301 11
address: The Czech Republic
admin-c: TH20-RIPE
tech-c: TH20-RIPE
nic-hdl: TH20-RIPE_XX


role: Tiny Software CR, s.r.o.
address: Sedlackova 16
address: Plzen
address: 301 11
address: The Czech Republic
nic-hdl: TINY-CZ
e-mail: [email protected]


person: Tomas Hnetila
address: Pobrezni 208
address: Blovice
address: 336 01
phone: +420 377338901
fax-no: +420 377328921
nic-hdl: TH20-RIPE
e-mail: [email protected]


Total 4 records
REFERRAL END

Network:

This is the RIPE Whois secondary server.
The objects are in RPSL format.
Please visit http://www.ripe.net/rpsl for more information.

inetnum: 195.39.55.0 - 195.39.55.255
netname: TINYSOFT-CZ
descr: Tiny Software CR, s.r.o.
country: CZ
admin-c: TH20-RIPE
tech-c: TH20-RIPE
status: ASSIGNED PA
mnt-by: GTSCZ-MNT
changed: [email protected] 20021112
source: RIPE

route: 195.39.0.0/17
descr: GTSNET - II
origin: AS2819
mnt-by: GTSCZ-A-MNT
changed: [email protected] 19980916
changed: [email protected] 20021018
source: RIPE

person: Tomas Hnetila
address: Kerio Technologies
address: Sedlackova 16
address: Plzen
address: 301 11
address: The Czech Republic
phone: +420 377338901
fax-no: +420 377338921
e-mail: [email protected]
nic-hdl: TH20-RIPE
notify: [email protected]
changed: [email protected] 19990524
changed: [email protected] 20020920
source: RIPE