Strange behavior ... New trojan?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I was observing strange behavior in my computer recently.
I am running Windows Me with Outpost firewall. On the Open Ports
page of Outpost firewall I see that Internet Explorer sequentially
tries to open ports. For example

IExplorer.exe   1017
IExplorer.exe   1018
IExplorer.exe   1019

A few seconds later I see

IExplorer.exe   1020
IExplorer.exe   1021
IExplorer.exe   1022


IExplorer.exe   1023
IExplorer.exe   1024
IExplorer.exe   1025

And so on. The Outpost is in Block Most mode. In addition to that I defined
rules that block all well known ports like 135-139, 389, 445, 593, 636,
3368-3369, 1025, 1720, 1503 and 443 (both TCP and UDP, both inbound and

Besides that I used DCOMBobulator utility from web site to shut
down DCOM.

Does anyone encounter similar behavior?

Any ideas why is it happening?

Might it be new trojan?

May be the IExplorer.exe was infected/modified by some virus/trojan?

I did check my computer regularly and neither Spybot, nor Adaware, nor Norton
Antivirus find any viruses/trojans.

Thanks in advance

Re: Strange behavior ... New trojan?

Bobby wrote:
Quoted text here. Click to load it

I suspect that this is just IE doing its thing. It is making several outgoing
using sequential source port numbers. This is normal. The only question is: do
expect IE to be making calls at this time? Does it have a page open that needs to
be refreshed occasionally (including adverts)?


Re: Strange behavior ... New trojan?

On Thu, 06 May 2004 21:29:36 +0100, Steve Horsley spoketh

Quoted text here. Click to load it

Should probably mention that it is common for web browsers (and other
applications as well) to open multiple simultaneous connections. It's
the OS that assigns the port numbers used as the source port, and they
are sequential.

It's a little odd that the number are lower than 1024, but that could be
a typo (??)

Lars M. Hansen
Remove "bad" from my e-mail address to contact me.
"If you try to fail, and succeed, which have you done?"

Site Timeline