interesting firewall alarm..

Norton firewall has been popping up this message a few times today:

Quote:

---

Microsoft Office 2000 component is attempting to access the Internet

At X:XX PM on X/XX/XX, the following communication was detected:
Application: C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
Protocol: TCP (Outbound)
Remote Address: www.irs.gov (66.77.65.247) : http (80)
Local Address: Service port 1159
This file is not infected with a virus. There is no autoconfiguration data for this application. This application is from a known company (Microsoft Corporation). This application does not have a digital signature or the digital signature is invalid.

---

any thoughts?
(btw, my mother just did her taxes on it today)

In the startup there usually is findfast... I have never found out what it does but its not neccissary so just get it out of there and it wont be running.... dont think it'll try to connect out if its not running.

Rule of thumb if you never use the program or have never heard of it; never let it access the internet.

Find fast is a program that is included w/ ms office. What its supposed to do is index your documents on your drive for faster searches. Why its trying to get port access, no clue. I havn't ever heard of that. As tuskin said you can easily disable it.

I'm wondering why it wants the IRS

Conspiracy note... This is very interesting. Here are my thoughts.

1) The program Findfast should NOT be tring to access ANY ports what so ever. The fact that this program's design is to catalog everything on your HD causes a bit of concern to me. This leads me to believe that it may be infected with somthing.

2) The fact that its trying to contact the IRS homepage also worries me. Hmmm... I did a whois on the IP and got this:

Quote:

---

Qwest Cybercenters (NETBLK-QWEST-CYBERCENTER-2)
1200 Harbor Boulevard
Weehawken, NJ 07087
US

Netname: QWEST-CYBERCENTER-2
Netblock: 66.77.0.0 - 66.77.191.255
Maintainer: QCYB

Coordinator:
Wysocki, David (DW820-ARIN) [email protected]
201-770-4133

Domain System inverse mapping provided by:

DCA-ANS-01.INET.QWEST.NET 205.171.9.242
SVL-ANS-01.INET.QWEST.NET 205.171.14.195

ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE

Record last updated on 25-Mar-2002.
Database last updated on 14-Apr-2002 19:58:00 EDT.

---

I may be wrong on this, but would the IRS use Qwest as an ISP? I would think they would use their own lines. Okay, possibly the website is hosted by Qwest.

Ughh, If I hear another AOL ad on TV I'm gunna go completly... sorry.

Anyways where was I? Oh yeah...

[PARANOIA] Okay, here comes the "What If" part. What if while your mother was on the computer doing her taxes via an on-line tax generator, the tax website downloaded a trojan controlled by the government? I see this this as a perfect opportunity for the government to install backdoor Carnivore, Magic Lantern, type of software to thousands of computers.[/PARANOIA]

I may be way off on this, but what if?

Your thoughts?

Halo found this later: FindFast
It has no reason to connect out. Very, Very strange.

/me hides.

I think someone's a bit paranoid. But I also don't think that this is something to be ignored. Just kill the program, don't let it run, don't let it access any ports, don't let it eat, don't let it poop, don't let it... well, you get the idea. I personally think it is the spawn of Satan, and we all know that Satan answers to his alternate identity of the IRS...

God bless,
--PhirePhreak

Xmaddness might be a little paranoid but he has a point trust no one. I would update you virus scanner and do a complete scan. But a virus made by the government wouldn’t be detected by a virus scanner. There to smart to fall for that one. They could know that you’re posting on this forum and dispatch a secret irs commando death squad after you. My advice to you would be to pack up all you stuff and go live in a shack with no power on the side of a snowy mountain. And what about us. Now we know and they’ll be after us to. Oh man I need a beer.

cwk9 ... you have a point... y did I ever reply?? I am putting my life and future in danger... lol, no if it were the goverment you would have more difficulty finding the 'issue'. FINDFAST trying to acces the internet is definately odd and I'd be currious... M$ has no reason to have FINDFAST really in the fist place, his idea of 'convience'... :conflicting issues! My first comment will work... if it says still that the goverment is trying to get.... I mean FINDFAST is trying to get out... something is triggering "FINDFAST" and you will have to determine the cause.

(If findfast is closed [not in startup] and its trying to get out, something is opening it or posing as it)
well I hope I helped...
Tuskin

Dang I forgot to say: Good paranoia = self determination to understand how to protect yourself from "it" and of course do it.

LOL.. maybe they'll offer me a job in their secret underworld.... naw.. probably not..

Y'know.........Linux doesn't have findfast.exe........and if the government's figured out how to install a trojan on a Linux box like that, then they're a lot smarter than I thought they were..........

</obligatoryLinuxPlug>

lol, It'd be really interesting to find on a linux machine: FINDFAST.exe attempting to reach www.uscrewed.gov on port 666 ....

first the ability to have an exe just without any other apps running in the background supporting it would be cool... dangerous... and well the gov would look 1=clumbsy... so easily detectable and 2=resourceful... how did they get that exe to work?

I dont know but if it starts hitting Linux machines... worry lol

Glad their are firewalls.......................Block block block

This is really scary, Quest actually does lease a few ip- blocks to the irs, so it IS the IRS causing findfast to access the internet.

Trying 66.77.65.247 at ARIN
Trying 66.77.65 at ARIN
Qwest Cybercenters (NETBLK-QWEST-CYBERCENTER-2) QWEST-CYBERCENTER-2
66.77.0.0 - 66.77.191.255
Bantu Inc (NETBLK-QWEST-IAD-BANTU) QWEST-IAD-BANTU 66.77.65.32 - 66.77.65.47
Society for Human Resource Management (NETBLK-QWEST-IAD-SHRM1) QWEST-IAD-SHRM1
66.77.65.48 - 66.77.65.63
Bantu Inc (NETBLK-QWEST-IAD-BANTU2) QWEST-IAD-BANTU2 66.77.65.64 - 66.77.65.95
Internal Revenue Service (NETBLK-QWEST-IAD-IRS5) QWEST-IAD-IRS5
66.77.65.96 - 66.77.65.111
IBM (NETBLK-QWEST-IAD-IBM2) QWEST-IAD-IBM2 66.77.65.112 - 66.77.65.119
IBM (NETBLK-QWEST-IAD-IBM3) QWEST-IAD-IBM3 66.77.65.120 - 66.77.65.127
Vocus, Inc (NETBLK-QWEST-IAD-VOCUS) QWEST-IAD-VOCUS66.77.65.128 - 66.77.65.191
CCBN (NETBLK-QWEST-IAD-CCBN5) QWEST-IAD-CCBN5 66.77.65.192 - 66.77.65.223
Internal Revenue Service (NETBLK-QWEST-IAD-IRS7) QWEST-IAD-IRS7
66.77.65.224 - 66.77.65.239
Internal Revenue Service (NETBLK-QWEST-IAD-IRS8) QWEST-IAD-IRS8
66.77.65.240 - 66.77.65.255

/me sees Big Brother outside of Kezil's house
/me goes back down to the Cave of Solitude to plot and plan his next move

Kezil - I reccomend getting Anti-FBI spray, it keeps all those pesky critters away ;)

You may want to check out http://www.****microsoft.com/content...-files.shtml#2 to see just how FindFast works and it does more then index local files. Also there is how to safely remove findfast. In short it wants to send out search info to MS for their search engine, being taxtime I bet a few people are searching for IRS info.

Umm.. actually that is refering to the find utility on the start menu. The findfast is something completely different. Also, It still has no reason to try and send out info to anyone, let alone the irs website.

consider this, taxes are submitted by a tax contractor to the irs ( you cant at this time submitt directly to the IRS) If done via a web generator, chances are theres a cookie placed, and perhaps java, vbs activex and a few other nasties that wouldnt be detected by a standard scan, clear history, clear temp, clear cookies,(they help to create state) and use teh file compare feature in windoz. If all else fails, back up all docs, turn off macros, and wipe disk-re-install clean.