Author Topic: avast Port Scanning  (Read 11171 times)

0 Members and 1 Guest are viewing this topic.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
avast Port Scanning
« on: August 30, 2004, 04:32:41 PM »
My firewall is reporting continuous (every day) attacks from avast website. Any information about this?

10:51:57
Attack Detection Report
Port Scanning has been detected from download3.avast.com (scanned ports:TCP (3558, 3557))
The best things in life are free.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:avast Port Scanning
« Reply #1 on: August 30, 2004, 04:58:23 PM »
Hmm does this by change happens 6 times a day? I am thinking of the Avast update that takes place every 4 hours, well at least the checking for updates.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re:avast Port Scanning
« Reply #2 on: August 30, 2004, 05:21:58 PM »
Well, what's the reason for the attack?
My system control the updates, the time for it, checks if the server is on... Why the Incoming attack?  ::)
The best things in life are free.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re:avast Port Scanning
« Reply #3 on: August 30, 2004, 05:30:54 PM »
Do you use Pro version? And are you sure its inbound? I think this was explaind dew months ago. It was the common problem for Sygate firewall.
Visit my webpage Angry Sheep Blog

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:avast Port Scanning
« Reply #4 on: August 30, 2004, 05:53:57 PM »
Technical, download3.avast.com is not, by any way, connecting to your machine. You can be confident about that...
If at first you don't succeed, then skydiving's not for you.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re:avast Port Scanning
« Reply #5 on: August 31, 2004, 12:47:39 AM »
Technical, download3.avast.com is not, by any way, connecting to your machine. You can be confident about that...

I use Outpost Firewall.
That was a copy & paste information from it. I'm not trying to panic nobody  :'(
The best things in life are free.

kubecj

  • Guest
Re:avast Port Scanning
« Reply #6 on: August 31, 2004, 09:09:09 AM »
IMO it's just a misinformation. If you get the very same message again, try running 'netstat' from commandline.

I think you'll see something like
TCP yourip:3558 download03:80 somestatus
TCP yourip:3557 download03:80 somestatus

Let me know.

It's not the first time when somebody reported such behaviour. I have to track if such users only use Outpost.

And let me state it again:
There is _NO_ scanning software installed on _ANY_ of our servers.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:avast Port Scanning
« Reply #7 on: August 31, 2004, 09:18:53 AM »
Quote
Port Scanning has been detected.....
If it really was port scanning, the one (whoever it is/was) wouldn't just scan 2 ports if you ask me. Strong indication of a false report by the firewall.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re:avast Port Scanning
« Reply #8 on: August 31, 2004, 03:05:04 PM »
Kubecj, I'll try to do what you asked me. Right now, the log was automatically empty and I can't see it again. Sorry.
The best things in life are free.

inthewildteam

  • Guest
Re:avast Port Scanning
« Reply #9 on: September 01, 2004, 12:10:43 AM »
netstat -a -n might give a little more info

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re:avast Port Scanning
« Reply #10 on: September 02, 2004, 05:45:57 PM »
Well, it happens again  :'(
The best things in life are free.

guestja

  • Guest
Re:avast Port Scanning
« Reply #11 on: September 03, 2004, 11:14:08 PM »
technical,
Have you had any luck determining what is happening with that  "port scanning"  poblem?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re:avast Port Scanning
« Reply #12 on: September 04, 2004, 12:32:32 AM »
technical,
Have you had any luck determining what is happening with that  "port scanning"  poblem?

No, I haven't.
I used the command: netstat -a -n
but I get nothing, no ports opened at that time, but, of course, the firewall have blocked them before.
Am I making something wrong?  ::)
The best things in life are free.

inthewildteam

  • Guest
Re:avast Port Scanning
« Reply #13 on: September 04, 2004, 01:03:54 AM »
Technical, if netstat doesn't show any established connections (other than the expected ones for your browser etc) you are at least safe.

It could be ip spoofing, have you cleared out your temp internet files/cookies?

Also try from cmd ipconfig /flushdns

I recently switched to Outpost and don't have any problems with Avast's servers at all.
 Edit

I noticed in an earlier post your screen shot.  I use the free Outpost firewall and can't find anything like that in my version, the blue shield might be the clue.
« Last Edit: September 04, 2004, 01:13:27 AM by inthewildteam »

neal62

  • Guest
Re:avast Port Scanning
« Reply #14 on: September 04, 2004, 02:30:39 AM »
Technical, are you using the paid for version of Outpost firewall? It might be just that version that is causing you to see this information. I believe the free version of Outpost does not cause this problem as mentioned in the post above mine.
« Last Edit: September 04, 2004, 02:32:36 AM by neal62 »