wwroller Posted April 23, 2011 Report Share Posted April 23, 2011 Hi. Recently peerblock has been intercepting continuous outbound attempts to connect to an IP address belonging to Netvertising Ltd. whenever uTorrent is online. Netstat command line tool confirms these syn packets are being sent by the uTorrent..exe process. A full scan with Malwarebytes did not resolve the issue. Any ideas how this began and how to resolve it?WW Link to comment Share on other sites More sharing options...
wwroller Posted April 25, 2011 Author Report Share Posted April 25, 2011 Little help? Can't seem to get this figured out. Link to comment Share on other sites More sharing options...
moogly Posted April 25, 2011 Report Share Posted April 25, 2011 Which µT version?Can you post Hijackthis log please? Link to comment Share on other sites More sharing options...
wwroller Posted April 26, 2011 Author Report Share Posted April 26, 2011 Thanks. Version 2.2 build 23703. Hijackthis log follows:Logfile of Trend Micro HijackThis v2.0.4Scan saved at 5:52:17 PM, on 4/25/2011Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Boot mode: NormalRunning processes:C:\WINDOWS\Explorer.EXEC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Microsoft IntelliPoint\point32.exeC:\Program Files\Avira\AntiVir Desktop\avgnt.exeC:\Program Files\Hamachi\hamachi-2-ui.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Common Files\Java\Java Update\jucheck.exeC:\SOURCE\ADMIN TOOLS\PROCESS EXPLORER\V12.04\PROCEXP.EXEC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\uTorrent\uTorrent.exeC:\Source\Admin Tools\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scroogle.org/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66017R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66017R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.juno.com/s/search?r=minisearchR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66017R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8118R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://www.O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: (no name) - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - (no file)O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dllO4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exedO4 - HKLM\..\Run: [ATIPTA] C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXEO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /minO4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\Hamachi\hamachi-2-ui.exe" --auto-startO4 - HKCU\..\Run: [blue Frog] C:\Program Files\Blue Security\bluefrog.exeO4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10k_Plugin.exe -update pluginO4 - Global Startup: PeerBlock.lnk = C:\Program Files\PeerBlock\peerblock.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: En&queue current page with Bulk Image Downloader - file://C:\Program Files\Bulk Image Downloader\iemenu\iebidqueue.htmO8 - Extra context menu item: Enqueue link target with Bulk Ima≥ Downloader - file://C:\Program Files\Bulk Image Downloader\iemenu\iebidlinkqueue.htmO8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.htmlO8 - Extra context menu item: Open &link target with Bulk Image Downloader - file://C:\Program Files\Bulk Image Downloader\iemenu\iebidlink.htmO8 - Extra context menu item: Open current page with Bulk I&mage Downloader - file://C:\Program Files\Bulk Image Downloader\iemenu\iebid.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO14 - IERESET.INF: START_PAGE_URL=http://www.hp.comO16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CABO16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.4.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120627962831O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{979FFDD0-FB70-4CB1-8867-8049B79C20E9}: NameServer = 208.67.222.222,208.67.220.220O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dllO23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exeO23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\Hamachi\hamachi-2.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe--End of file - 8155 bytes Link to comment Share on other sites More sharing options...
Shilood Posted April 26, 2011 Report Share Posted April 26, 2011 Little help? Can't seem to get this figured out.Are you uploading or downloading a file with http://hank.cheggit.net listed as (one of) the tracker(s)? Sounds like someone is admitting to downloading pron.I hope that helps. Link to comment Share on other sites More sharing options...
moogly Posted April 26, 2011 Report Share Posted April 26, 2011 I know there was a survey link in some past µT builds but I think it's finished and I'm not not really sure if the outgoing connections you're seeing are related to this possible cause.Are you sure the destination IP really belongs to Netvertising Ltd? Can you post the IP displayed by PB? Link to comment Share on other sites More sharing options...
wwroller Posted April 26, 2011 Author Report Share Posted April 26, 2011 The IP is 84.2.34.107, always to port 2710, but originating from local ports ranging from 3xxx to 4xxx. PB lists it as "Netvertise Ltd." and that's my only reason for saying so. Link to comment Share on other sites More sharing options...
DreadWingKnight Posted April 26, 2011 Report Share Posted April 26, 2011 Do you have any torrents with a tracker that has port 2710?And why do you think that peerblock is actually protecting you from anything? Link to comment Share on other sites More sharing options...
wwroller Posted April 26, 2011 Author Report Share Posted April 26, 2011 Are you uploading or downloading a file with http://hank.cheggit.net listed as (one of) the tracker(s)? Sounds like someone is admitting to downloading pron.Sounds like someone knows a LOT more about pr0n than I do. ;-) Shilood is right that I had some DLs from cheggit (although i don't know if they were that specific tracker or not). Still not sure where to go from there, though, as far as whether these outbound attempts are something to worry about.I hope that helps.It will after I understand how you came to that conclusion, and whether there's any harm to it... Thanks, I think. Link to comment Share on other sites More sharing options...
wwroller Posted April 26, 2011 Author Report Share Posted April 26, 2011 Do you have any torrents with a tracker that has port 2710?Well, I've deleted the torrents but based on Shilood's insight I can only assume that I did.And why do you think that peerblock is actually protecting you from anything?Based on an admittedly incomplete body of reading I was led to believe it was better than nothing. After all, it at least led me to ask the questions in this thread, for whatever that's worth. But I'd be grateful for any hint in a better direction if you'd be so kind. Link to comment Share on other sites More sharing options...
wwroller Posted April 26, 2011 Author Report Share Posted April 26, 2011 OK, sure enough, here's a tracker:http://hank.cheggit.net:2710/358028/HAcqm9Ks/announceSo now I just want to know whether there's any harm to these outbound attempts or whether this is a non-issue. (and perhaps a link on where i can learn why)Thanks. Link to comment Share on other sites More sharing options...
Firon Posted April 26, 2011 Report Share Posted April 26, 2011 No, and peerblock is useless. it's lists are based on an incorrect premise, so take anything it tells you with a grain of salt. Link to comment Share on other sites More sharing options...
wwroller Posted April 26, 2011 Author Report Share Posted April 26, 2011 No, and peerblock is useless. it's lists are based on an incorrect premise, so take anything it tells you with a grain of salt.Thanks. Any place I can learn more on the protection side, then? Link to comment Share on other sites More sharing options...
moogly Posted April 27, 2011 Report Share Posted April 27, 2011 Just use blocklists to ban torrent poisoners and real IPs monitoring p2p activity.A better security (but not invincible) is to use a VPN dedicated to p2p. Link to comment Share on other sites More sharing options...
wwroller Posted April 28, 2011 Author Report Share Posted April 28, 2011 Just use blocklists to ban torrent poisoners and real IPs monitoring p2p activity.Makes sense but I thought that was exactly what PB was doing. It updates the IP block list each time it starts up and prevents inbound and outbound to all those ip's. Is it's failure due to a bad block list, or bad functionality? And either way, where would I find the blocklists you are advising me to use? If the answer is here in the UT community already, which I admit I haven't had time to go through, then forgive the question and just say "look it up" :-)A better security (but not invincible) is to use a VPN dedicated to p2p.Do you mean a paid VPN service, or is this something I could accomplish using openVPN or Hamachi or something? (and if the latter, where would I be connecting to on the other end?) As above, if the answer is already here, I'll take the smack.Thanks again. Link to comment Share on other sites More sharing options...
moogly Posted April 28, 2011 Report Share Posted April 28, 2011 PB's lists need to be verified and nobody does it. Make the calculation, these lists block millions of IP, in fact, it's not very reasonable.In addition, a company monitoring p2p activity can use residential internet connections, etc...In your case, 84.2.34.107 is in Hungary (http://whois.domaintools.com/84.2.34.107) but we can't know why PB is blocking this IP (maybe due to spam from a previous blocklist, who knows...).Yes, a VPN using PPTP e.g. Or SSL (OpenVPN client) is better (but more expensive). Link to comment Share on other sites More sharing options...
KarlMarx999 Posted May 4, 2011 Report Share Posted May 4, 2011 This IP came up "suddenly" in PB because the tracker changed ISPs and they are using new IP Adresses. This change happened in April. BTW, PB can be a real pain! Link to comment Share on other sites More sharing options...
wwroller Posted May 5, 2011 Author Report Share Posted May 5, 2011 Thanks for the help, everyone. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.