Firewall picking up regular, unknown activity from 1 machine on netwrk

[bankboysb]

I have one machine on my LAN that continually attempts to reach another box in an unusual way. Both machines are running XP Pro, the target machine has Sygate firewall, the source machine is not firewalled. All machines are behind a security router (Netgear RO318) on a DSL connection.

The source machine is trying to contact the target at approx. 5 minute intervals. Every time the target refuses the contact (stopped at the firewall) the source machine moves the attempt to contact upwards by one port number. It tends to start at around port 3040 and climbs upward in increments of one port. It never leaves the range of 3040-39xx.

This is very suspicious to me, I am concerned there is a keylogger or variant on the source machine. All virus scans have been negative, spyware is removed weekly.

Anyone have any idea what this is?

 

[MichealC4]

Are you familar with Ethereal? (

http://www.ethereal.com)

Set it up to log packets. That will help.

----------------------------
"Security is like an onion" - Unknown

 

[bankboysb]

Oh yeah, I am very familiar with it. That's probably a good idea. The thing that bothers me the most is that the port numbers being used keep changing. I have never seen this before.

 

[kio91]

Hi

Ports changing is a very common things with P2P apps.

For example skype, which allows to talk (like voip) using the net, starts at a port, if that one is firewalled, then in tries another one, till it succeds in stableshing a conecction.

Ports changing generally means 2 things:
A port Scan,
A P2P app, trying to bypass your firewall.
Spyware?

Something else you can try is to set a personal firewall in the "suspicious machine", one that provides application control, that way, the firewall will tell you which application is trying to connect. Then you can look the name of the app in the net.

Very good Luck!

Kio91

"Bitter winter, not a leaf left to fall"