PC's continuously hitting various external IPs on Various Ports

[rpciam]

There are 4 different PC's in our internal network that are continuously hitting various external IPs on Various Ports according to the Firewall logs. We have scanned these PC's using Spybot, Malwarebytes and our anti-virus Trend Micro but they came up clean.

Any Suggestions?

 

[Grenage]

Does netstat give any indication of services accessing the addresses? It might be worth trying a few more apps to scan the machines.

"We can categorically state that we have not released man-eating badgers into the area" - Major Mike Shearer

 

[rpciam]

Thank, I will try that. I notice 2 of the machines are trying to hit a particular machine in our DMZ on Port 9100.

 

[jet042]

A quick search turned up that TCP 9100 is used by HP JetDirect printers. Don't know if that sheds any light on the situation or not.

 

[MichealC4]

Incidentally, if it is actually printers that it is hitting, I'd recommend closing up the port from external access. Bad Things Can Happen(tm).

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[rpciam]

Thanks for all your suggestions. 2 of the machines that were constantly trying to go out on Port 9100 had old Print Jobs in the queue that were trying to hit a DMZ address for some reason (Jobs were deleted).

A few other machines we just re-imaged which is quicker than spending all day trying to find the problem ( although I wish I had the time to work on them).