Topic awaiting preservation: time.windows.com [207.46.130.100], port ntp [123]

Has anyone seen anything like this?

My firewall tells me that something from this address is trying to communicate with my my computer, through the svchost.

I have blocked all such requests, as I have been unable to find anything saying that this is in any way legitimate. I have, however, read things that lead me to think this is related to the mydoom worm...


Jsut curious if anyone with more knowledge in these areas knows what this is about?



[This message has been edited by DL-44 (edited 03-29-2004).]

well, I haven't heard anything about it being related to a worm, but I know that WinXP has servers to allow you to keep your system clock accurate..

.... now, if only I could find the damn option again!

However, I don't know that it *doesn't* have something to do with mydoom... it could very well be updating itself by checking the correct time- as 'Michelangelo' used to do some years back... I remember the trick was to set your clock back so the virus wouldn't trigger...

Aha [-edit-]

quote:

---

To adjust the utility in any version of Windows XP, right-click the time display on the taskbar, choose Adjust Date/Time, click the Internet Time tab, and check Automatically synchronize with an Internet time server.

---

PCWorld.com - Is Microsoft's Time Warped?
TweakXP.com - Add More Time Servers
Windows XP: Adjust Internet Time Synchronization - Windows-Help.NET
Google Search: "time.windows.com"

[-edit2-]
This link mentions time.windows.com while talking about mydoom... It mentions it under the heading 'The victim host DNS query of the following host' but I'm not quite sure what the hell it is they are talking about...
http://personal.ie.cuhk.edu.hk/~shlam/virus/novarg.html

Best of luck...


Code - CGI - links - DHTML - Javascript - Perl - programming - Magic - http://www.twistedport.com
ICQ: 67751342

[This message has been edited by Petskull (edited 03-29-2004).]

Port 123 is a valid port for the NTP protocol,
time.windows.com is a valid server for adjusting the time. I have just used it with no problems. I don't believe this is anything bad.

indeed, windows xp can finnally synchronize it's time against ntp servers [network time protocol].
Annoyed the hell out of me the first time, when I installed it, and it adjusted my system clock, which intentionally was 10 minutes fast ;-).
So, don't worry about it.

Just very odd....I haven't changed any settings (for the firewall or the clock) and yet this is the first time I have seen this connection alert.

Always safer to be paranoid, anyway

Thanks for the replies.

(searching for time.windows.com gave no replies. I didn't think to add quotes )

That thing probably occured just now beacuse of the summer/winter hour shift we had this WE.