Avast WEBforum

Other => General Topics => Topic started by: Lisandro on August 30, 2004, 04:32:41 PM

Title: avast Port Scanning
Post by: Lisandro on August 30, 2004, 04:32:41 PM
My firewall is reporting continuous (every day) attacks from avast website. Any information about this?

10:51:57
Attack Detection Report
Port Scanning has been detected from download3.avast.com (scanned ports:TCP (3558, 3557))
Title: Re:avast Port Scanning
Post by: Eddy on August 30, 2004, 04:58:23 PM
Hmm does this by change happens 6 times a day? I am thinking of the Avast update that takes place every 4 hours, well at least the checking for updates.
Title: Re:avast Port Scanning
Post by: Lisandro on August 30, 2004, 05:21:58 PM
Well, what's the reason for the attack?
My system control the updates, the time for it, checks if the server is on... Why the Incoming attack?  ::)
Title: Re:avast Port Scanning
Post by: RejZoR on August 30, 2004, 05:30:54 PM
Do you use Pro version? And are you sure its inbound? I think this was explaind dew months ago. It was the common problem for Sygate firewall.
Title: Re:avast Port Scanning
Post by: Vlk on August 30, 2004, 05:53:57 PM
Technical, download3.avast.com is not, by any way, connecting to your machine. You can be confident about that...
Title: Re:avast Port Scanning
Post by: Lisandro on August 31, 2004, 12:47:39 AM
Quote from: Vlk on August 30, 2004, 05:53:57 PM
Technical, download3.avast.com is not, by any way, connecting to your machine. You can be confident about that...

I use Outpost Firewall.
That was a copy & paste information from it. I'm not trying to panic nobody  :'(
Title: Re:avast Port Scanning
Post by: kubecj on August 31, 2004, 09:09:09 AM
IMO it's just a misinformation. If you get the very same message again, try running 'netstat' from commandline.

I think you'll see something like
TCP yourip:3558 download03:80 somestatus
TCP yourip:3557 download03:80 somestatus

Let me know.

It's not the first time when somebody reported such behaviour. I have to track if such users only use Outpost.

And let me state it again:
There is _NO_ scanning software installed on _ANY_ of our servers.
Title: Re:avast Port Scanning
Post by: Eddy on August 31, 2004, 09:18:53 AM
Quote
Port Scanning has been detected.....
If it really was port scanning, the one (whoever it is/was) wouldn't just scan 2 ports if you ask me. Strong indication of a false report by the firewall.
Title: Re:avast Port Scanning
Post by: Lisandro on August 31, 2004, 03:05:04 PM
Kubecj, I'll try to do what you asked me. Right now, the log was automatically empty and I can't see it again. Sorry.
Title: Re:avast Port Scanning
Post by: inthewildteam on September 01, 2004, 12:10:43 AM
netstat -a -n might give a little more info
Title: Re:avast Port Scanning
Post by: Lisandro on September 02, 2004, 05:45:57 PM
Well, it happens again  :'(
Title: Re:avast Port Scanning
Post by: guestja on September 03, 2004, 11:14:08 PM
technical,
Have you had any luck determining what is happening with that  "port scanning"  poblem?
Title: Re:avast Port Scanning
Post by: Lisandro on September 04, 2004, 12:32:32 AM
Quote from: guestja on September 03, 2004, 11:14:08 PM
technical,
Have you had any luck determining what is happening with that  "port scanning"  poblem?

No, I haven't.
I used the command: netstat -a -n
but I get nothing, no ports opened at that time, but, of course, the firewall have blocked them before.
Am I making something wrong?  ::)
Title: Re:avast Port Scanning
Post by: inthewildteam on September 04, 2004, 01:03:54 AM
Technical, if netstat doesn't show any established connections (other than the expected ones for your browser etc) you are at least safe.

It could be ip spoofing, have you cleared out your temp internet files/cookies?

Also try from cmd ipconfig /flushdns

I recently switched to Outpost and don't have any problems with Avast's servers at all.
 Edit

I noticed in an earlier post your screen shot.  I use the free Outpost firewall and can't find anything like that in my version, the blue shield might be the clue.
Title: Re:avast Port Scanning
Post by: neal62 on September 04, 2004, 02:30:39 AM
Technical, are you using the paid for version of Outpost firewall? It might be just that version that is causing you to see this information. I believe the free version of Outpost does not cause this problem as mentioned in the post above mine.
Title: Re:avast Port Scanning
Post by: S.Z.Craftec on September 04, 2004, 02:39:05 AM
Yeah, I was geeting same reports before while I was using Pro version. Now, I'm on Freeware 1.0 version and all those reports are gone...

See one of my old threads in here:

http://forum.avast.com/index.php?board=1;action=display;threadid=5513;start=msg40611#msg40611 (http://forum.avast.com/index.php?board=1;action=display;threadid=5513;start=msg40611#msg40611)

Also, there is screenshot...

Cheers !
Title: Re:avast Port Scanning
Post by: inthewildteam on September 04, 2004, 02:56:09 AM
Thought the blue shield was Kerio?  It certainly isn't here in Outpost ver 1 free version.
Title: Re:avast Port Scanning
Post by: S.Z.Craftec on September 04, 2004, 03:48:03 AM
What blue shield ? I used to use Outpost Pro and back then I've got all those reports... Now I switched back to v1.0 (Freeware) and all those reports are nothing but history...

Cheers !
Title: Re:avast Port Scanning
Post by: Lisandro on September 04, 2004, 03:48:22 AM
Sasha, many thanks... I'm not alone  :'(
Title: Re:avast Port Scanning
Post by: S.Z.Craftec on September 04, 2004, 04:07:22 AM
Well, you are now... hehe... I'm not using Pro version any more... Freeware v 1.0 is as good as Pro, especailly combined with my hardware router/firewall - perfect combination.

Cheers !
Title: Re:avast Port Scanning
Post by: lee16 on September 04, 2004, 12:04:44 PM
Technical

Mabey you should contact Outpost about this, it might be a "false positive" but in firewall terms.

Or try emailing avast about it.

Goodluck

--lee