DH probe?

BWX · Apr 4, 2004, 10:49 AM

Hmm, noticed a probe from DH- never happend before that I know of- I got 4 or 5 of these right in a row..

actually 4 of them, all today at 3:25AM...

Weird.

"A computer at driverheaven.net has attempted an unsolicited connection to TCP port 1821 on your computer.
TCP port 1821 is commonly used by the "donnyworld" service or program."

Zardon · Apr 4, 2004, 11:01 AM

donnyworld? is that like disneyworld?

what firewall are you using?

BWX · Apr 4, 2004, 11:19 AM

Quote:

Originally posted by Zardon
donnyworld? is that like disneyworld?

what firewall are you using?

LOL, I have absolutely no idea.. Right now I'm using McAfee personal firewall plus 2004. I've been using it for a few months now..

I'd send you my log but this stupid program will only collect the log files in .elog format (not text) and I cannot convert .elog files into text, doc, or word files... Anyway- it only happened 4 times, all in the same minute.

3:25:11 am, 3:25:13 am, 3:25:16 am, 3:25:23 am. source port- 80 , destination port- 1821,
hostname- driverheaven.net, source IP- 216.127.74.135.

Weird huh?

Also i noticed Peerguardian is blocking an ad from driverheaven when and if I have Peerguardian turned on (I don't 99% of the time)- But I think it's a double-click ad on the front page, not sure which one or if that has anything to do with it or not..

But still a weird thing to see in my firewall log- actually, I don't even log anymore, I just happened to have the firewall program open and saw it in the notification area (where it logs things, then erases them the next time you reboot if you have logging off..) I did archive this one though so I could review it again if needed.

Zardon · Apr 4, 2004, 12:44 PM

the only thing that could possibly cause this is some rogue ad, ive checked through the scripts and everything looks ok, its hard to really tell as I dont have any of the ad codes on the DH server, they run from the ad companies server (and they are one of the nets largest companies - not a disreputatable company by any stretch of the word), ive emailed them the information you passed to me in this thread so they can check but really I would possibly put it down to McAfee firewall. I used to be a beta tester for mcafee in the period of time when they were buying over alot of smaller companies and incorporating them into their "fold", great companies like neoworx who made an awesome firewall neowatch, and an ever better tracer, Neowatch.

Mcafee software is the greatest load of garbage and its probably a program bug interpretting a genuine request for a cookie or something on your machine as something malicious.

BWX · Apr 4, 2004, 02:05 PM

I wouldn't doubt it- It very well might have been an error by McAfee- (I hate McAfee too, but I had to try their firewall)

I am in the process of getting another firewall and getting rid of McAfee. I installed this after reading a good review about it, it is very easy to set up, however it's configuration is VERY limited and some of the things you cannot configure are ridiculous. I have tried Zone Alarm, Sygate, McAfee, Symantec, The best was Sygate but it was a complete hassle to set up and get it working properly. I had to know the subnet and all this other info about an IP address to ban an IP- it was way harder than it had to be. ZAP was buggy and used up too many system recourses-

Now I think I will try Outpost, and maybe some of those free ones like Tiny or Kerio personal firewall. ( I think they are both free)===

Eventually I will find one I like until I can get a nice router..

Linksys BEFSX41 I hope!

THis one

If it happens again I'll let ya know, it's weird that it only happened once like that... I'll go through my old logs and see if I see anything similar.

BWX · Apr 4, 2004, 02:22 PM

http://www.ec11.dial.pipex.com/port-num1.shtml

http://donnyworld.com/

http://www.ezgoal.com/house/publishe...+Inc.&Software

This is what it is- maybe they are part of one of the advertisers or they hijacked an ad or something.. Who knows..

Apr 4, 2004, 10:49 AM	#1
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,669 Rep Power: 110 System Specs	DH probe? Hmm, noticed a probe from DH- never happend before that I know of- I got 4 or 5 of these right in a row.. actually 4 of them, all today at 3:25AM... Weird. "A computer at driverheaven.net has attempted an unsolicited connection to TCP port 1821 on your computer. TCP port 1821 is commonly used by the "donnyworld" service or program." __________________

Apr 4, 2004, 02:05 PM	Thread Starter #5
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,669 Rep Power: 110 System Specs	I wouldn't doubt it- It very well might have been an error by McAfee- (I hate McAfee too, but I had to try their firewall) I am in the process of getting another firewall and getting rid of McAfee. I installed this after reading a good review about it, it is very easy to set up, however it's configuration is VERY limited and some of the things you cannot configure are ridiculous. I have tried Zone Alarm, Sygate, McAfee, Symantec, The best was Sygate but it was a complete hassle to set up and get it working properly. I had to know the subnet and all this other info about an IP address to ban an IP- it was way harder than it had to be. ZAP was buggy and used up too many system recourses- Now I think I will try Outpost, and maybe some of those free ones like Tiny or Kerio personal firewall. ( I think they are both free)=== Eventually I will find one I like until I can get a nice router.. Linksys BEFSX41 I hope! THis one If it happens again I'll let ya know, it's weird that it only happened once like that... I'll go through my old logs and see if I see anything similar. __________________

Apr 4, 2004, 02:22 PM	Thread Starter #6
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,669 Rep Power: 110 System Specs	http://www.ec11.dial.pipex.com/port-num1.shtml http://donnyworld.com/ http://www.ezgoal.com/house/publishe...+Inc.&Software This is what it is- maybe they are part of one of the advertisers or they hijacked an ad or something.. Who knows.. __________________

Apr 4, 2004, 11:01 AM	#2
Zardon DriverHeaven Founder Join Date: May 2002 Posts: 32,480 Rep Power: 179	donnyworld? is that like disneyworld? what firewall are you using?

Apr 4, 2004, 12:44 PM	#4
Zardon DriverHeaven Founder Join Date: May 2002 Posts: 32,480 Rep Power: 179	the only thing that could possibly cause this is some rogue ad, ive checked through the scripts and everything looks ok, its hard to really tell as I dont have any of the ad codes on the DH server, they run from the ad companies server (and they are one of the nets largest companies - not a disreputatable company by any stretch of the word), ive emailed them the information you passed to me in this thread so they can check but really I would possibly put it down to McAfee firewall. I used to be a beta tester for mcafee in the period of time when they were buying over alot of smaller companies and incorporating them into their "fold", great companies like neoworx who made an awesome firewall neowatch, and an ever better tracer, Neowatch. Mcafee software is the greatest load of garbage and its probably a program bug interpretting a genuine request for a cookie or something on your machine as something malicious.