jlovett4
join:2004-03-26
Smyrna, GA
|  [Standard] McAfee Personal Firewall with Comcast
I keep getting alerted that NS9.ATTBI.COM is trying to access various ports on my system. McAfee marks these with event information of TROJAN or various company names. The IP address is 204.127.202.19 McAfee logged 223 events for this IP address in one day.
Should I trust this IP address?
Thank You,
Jason |
|
IGGY
No Guru Just Here To Help
Premium,MVM
join:2001-03-30
Chatham, IL
| That should just be this.
"Internet Service Providers (ISPs) periodically send heartbeat messages to their connected dial-up customers to make sure they are still there. If the ISP cannot determine that the customer is there, it might disconnect the customer so that the user's IP address can be given to someone else."
As long as your not having any connection issues there is no need to allow or trust that address. If your coming up with a clean machine. After scanning with an updated antivirus. I'd say you have nothing to worry about. If your extremely concerned you could download a trial version of an anti-trojan software and scan with it as well. My thought is - this is nothing to worry about.
Comcast uses AT&T as their backbone ( bandwidth ) provider.
--
Test Your Security Benefit for Children's Cancer Cable Diagnostics My Blog |
|
VirtualLarry
Premium
join:2003-08-01
| reply to jlovett4
Re: [Standard] McAfee Personal Firewall with Comca
"Various ports on my system" - judging by the name, that's a nameserver for the AT&T network. Are the "attacks" have a source or destination port of 53? UDP? If so, then they are just late DNS replies, probably due to an overloaded DNS server, and your software firewall is just a little bit too sensitive on the UDP connection timeout periods. Thus leading to false-alarms.
If they are TCP connection attempts, are they to specific ports each time? Perhaps port 80, 25, 113, 135, 137, 445, 4242, 1080, or 6667? They may be scanning your connection, for either running servers, open proxies, vulnerable Windows file-sharing ports, or all of the above. |
|
