Strange connection attempt

blablabla

2003-09-01 12:36:53

Why does SmartFTP (v1.0.978) try to connect to some strange addresses?
The logfile of our firewall is full of entries like the one below. They start when I start SmartFTP, and stop after I quit SmartFTP. And DST is NOT the ftp-server I'm connected to....

<snip>
SRC=x.x.x.x DST=24.210.194.144 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=34461 DF PROTO=TCP SPT=1987 DPT=6796 WINDOW=64240 RES=0x00 SYN URGP=0
<snip>

These connections seem to me totally unnecessary. Looks more like some builtin spy-tool or trojan to me.
Could someone please explain. I wouldn't like to switch to another FTP-client, because I really like SmartFTP, but these connection-attempts..?

blablabla

2003-09-02 08:35:33

No replies? Does any of you have a firewall? (just kidding :)

Could one of the SmartFTP developers please explain these connection attempts? I really don't know the purpose of these connections.
Thanks!

Louie

2003-09-02 10:12:56

Hello,

I can assure you that SmartFTP does not contain spyware and of course
doesn't contain a trojan in the software as well.

Systems getting probed are a common thing that happens to all of us in a
day by day basis.

For it to happen to you when you have SmartFTP open is just a coincidence.

You can find more information, on the systems that are probing you, from free online
services, such as GeekTools and SamSpade, and many others searching via Google.

You can also obtain a freeware application such as Ethereal, which is a network traffic
utility, that will display whats going on behind the curtains on your computer system.

blablabla

2003-09-03 06:53:26

Hello!

Thanks for your answer. I also don't think that SmaftFTP contains spyware or something similar, but that makes these connections even more strange.
And to get this clear: my system is not getting probed! The connections I'm talking about are _outgoing_ from my PC. They start after I start SmartFTP and stop after I quit. (There's no doubt about that. I can simply try it out. All programs and background-tasks closed, and then start SmartFTP...) (and btw, my PC is "clean", no viruses or spyware that any scanner could detect)

I know that systems get probed all the time. But our "firewall-admin" wouldn't have told me, if these connections weren't originating from my PC, inside our Intranet.

If you say, that SmartFTP has nothing to do with it (what I, with all respect, doubt), then I'll have to try Ethereal or something similar, to find out what these connections are about.