Closed Thread Icon

Topic awaiting preservation: [], port ntp [123] (Page 1 of 1) Pages that link to <a href="" title="Pages that link to Topic awaiting preservation: [], port ntp [123] (Page 1 of 1)" rel="nofollow" >Topic awaiting preservation: [], port ntp [123] <span class="small">(Page 1 of 1)</span>\

Maniac (V) Inmate

From: under the bed
Insane since: Feb 2000

posted posted 03-29-2004 01:54

Has anyone seen anything like this?

My firewall tells me that something from this address is trying to communicate with my my computer, through the svchost.

I have blocked all such requests, as I have been unable to find anything saying that this is in any way legitimate. I have, however, read things that lead me to think this is related to the mydoom worm...

Jsut curious if anyone with more knowledge in these areas knows what this is about?

[This message has been edited by DL-44 (edited 03-29-2004).]

Maniac (V) Mad Scientist

From: 127 Halcyon Road, Marenia, Atlantis
Insane since: Aug 2000

posted posted 03-29-2004 02:32

well, I haven't heard anything about it being related to a worm, but I know that WinXP has servers to allow you to keep your system clock accurate..

.... now, if only I could find the damn option again!

However, I don't know that it *doesn't* have something to do with mydoom... it could very well be updating itself by checking the correct time- as 'Michelangelo' used to do some years back... I remember the trick was to set your clock back so the virus wouldn't trigger...

Aha [-edit-]

To adjust the utility in any version of Windows XP, right-click the time display on the taskbar, choose Adjust Date/Time, click the Internet Time tab, and check Automatically synchronize with an Internet time server. - Is Microsoft's Time Warped? - Add More Time Servers
Windows XP: Adjust Internet Time Synchronization - Windows-Help.NET
Google Search: ""

This link mentions while talking about mydoom... It mentions it under the heading 'The victim host DNS query of the following host' but I'm not quite sure what the hell it is they are talking about...

Best of luck...

Code - CGI - links - DHTML - Javascript - Perl - programming - Magic -
ICQ: 67751342

[This message has been edited by Petskull (edited 03-29-2004).]

Maniac (V) Inmate

From: Charles River
Insane since: May 2002

posted posted 03-29-2004 03:47

Port 123 is a valid port for the NTP protocol, is a valid server for adjusting the time. I have just used it with no problems. I don't believe this is anything bad.

Tyberius Prime
Paranoid (IV) Mad Scientist with Finglongers

From: Germany
Insane since: Sep 2001

posted posted 03-29-2004 08:20

indeed, windows xp can finnally synchronize it's time against ntp servers [network time protocol].
Annoyed the hell out of me the first time, when I installed it, and it adjusted my system clock, which intentionally was 10 minutes fast ;-).
So, don't worry about it.

Maniac (V) Inmate

From: under the bed
Insane since: Feb 2000

posted posted 03-29-2004 20:37

Just very odd....I haven't changed any settings (for the firewall or the clock) and yet this is the first time I have seen this connection alert.

Always safer to be paranoid, anyway

Thanks for the replies.

(searching for gave no replies. I didn't think to add quotes )

Paranoid (IV) Inmate

From: France
Insane since: Jun 2002

posted posted 03-30-2004 01:17

That thing probably occured just now beacuse of the summer/winter hour shift we had this WE.

« BackwardsOnwards »

Show Forum Drop Down Menu