Strange Probe Activity. Need Help!

Printable View

January 18th, 2002, 06:03 PM
Megazoid

Strange Probe Activity. Need Help!

This is the first time i have ever had so many probes in the one day.

I have had over 700 Probes all in a 15 minute time-span (I am using ZoneALARM -
Latest Versions). The VisualROUTE program is reporting 'KAZAA' as the source
of the attacks (And Port 1214 As the Target - Kazaa Port).

I am now getting around 1 probe a second, i have even
shutdown the Kazaa program and still these attacks come. I am sick of this. Is this normal? can anyone give me any advice on this ?

When i have KAZAA Running i dont get as many attacks (no TCP/IP probes - Just the 'odd' NETBios one, and quite a few ICMP Unreachable's). When i shut kazaa down i get tons of probes (i have over 500 in 10 mins). I dont know if this is spyware or just KAZAA, but why so many attacks when KAZAA is closed? Hopefully some has the answers!

Thanks in advance guys!

Regards,
Dave
January 18th, 2002, 06:17 PM
dcongram

of course

Kazaa, like Morpheus, and other MP3 programs 'EXPECTS' you to open a port in your computer to allow others to access your MP3 files. ZoneAlarm has opened the port for Kazaa inbound and outbound.

When you quit using Kazaa, it is no longer advertising your share, but your IP has been advertised on the net, and all those other Kazaa computers keep updating their database looking for you.

Solution ? IF you can use Kazaa without sharing your files....you will no longer advertise your presence. Eventually (it will take some time) the 'probes' will diminish, then stop.

OR leave Kazaa running (as they intended) and hope their is no exploit.
January 18th, 2002, 06:38 PM
Vorlin

Quote:

I dont know if this is spyware or just KAZAA, but why so many attacks when KAZAA is closed? Hopefully some has the answers!

Kazaa has known spyware, and, with the update, if you remove it from the registry (like with AdAware), it won't even run. I suggest getting rid of Kazaa and go with Audiogalaxy. Much more efficient and reliable (as I've found anyways), with no known spyware.
January 18th, 2002, 07:08 PM
antihaxor

Also make sure that you are not setup as a "supernode" In morpheus being set up as one can cause zonealarm and blackice to go crazy.