Is this harmless?
Results 1 to 5 of 5

Thread: Is this harmless?

  1. #1
    Junior Member
    Join Date
    Jan 2002
    Posts
    12

    Is this harmless?

    I'm running ZoneAlarm on my PC. Usually I see a ping here and there and the occasional port scan. Today I saw this for the first time.

    The firewall has blocked Internet access to jennyb6107.homestead.com (209.157.71.37) (HTTP) from your computer [TCP Flags: S].

    User:
    Program: Internet Explorer
    Time: 2/20/02 2:52:58 PM

    It also said it was going from port 2003 on my system to port 80 at the other location.

    I did click "more info" on ZA, but none of their suggestions seemed to apply (like ZA not starting at startup). Would one of you gurus care to give some more insight on this?

    Thanks,
    Moody

  2. #2
    Banned
    Join Date
    Oct 2001
    Posts
    1,463
    Inform Homestead.com about this... Someone is trying to gain access to your computer through a trojan port... Did you do a virus scan recently?

  3. #3
    Old-Fogey:Addicts founder Terr's Avatar
    Join Date
    Aug 2001
    Location
    Seattle, WA
    Posts
    2,007
    Was this inbound? In other words, started by the other side? If so, they're being pretty sneaky, using 80 as a source port. By default, 80 is the port HTTP servers run on. Ever seen an url like "http://blah.com:80/"? The ":80" bit specifies a port for your browser. If it's not there, the browser assumes it is port 80 anyway.
    [HvC]Terr: L33T Technical Proficiency

  4. #4
    Junior Member
    Join Date
    Jan 2002
    Posts
    12
    I did a virus scan the other day. I also look and see if I've had any files created or modified in the last 24 hours pretty much every day.

    This was an outbound thing.....going from port 2003 to port 80 at that Homestead site.

    Am I correct in assuming that anything using such a high port is most likely trojan related?

    Thanks again
    Moody

  5. #5
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    were you doing at the time this happened?

    your computer will normally make an http request using a local port in the 3k range, (just do a netstat and see for yourself.) to port 80 remote.

    that ip address is in a block belonging to verio net. let me guess, where you reading your email?
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •