CPF is a busy little ■■■■■■ on my machine, which is good, I think, but one thing that is frustrating me is that CPF doesn’t tell me what program(s) (legit or not) is/are doing all of the violating. More specifically, CPF is logging a medium severity alert every 30-45 seconds with the same description each time: Outbound Policy Violation (Access Denied, ICMP = Port Unreachable). Stuff like that always piques my interest, especially when half of the destination IP’s are not resolvable by WHOIS and the other half are so exotic:
218.164.12.118 - Taiwan
83.157.180.181 - France
60.16.84.62 - China
60.53.79.2 - Malaysia
222.164.239.27 - Singapore
Since CPF is blocking the access, I can’t use, for example, TCPView to see who’s attempting to communicate with these exotic destinations.
Multiple spyware scanning applications come up clean, including RootKitRevealer v1.71, so I am really stumped as to what is going on here. Any ideas on how to ferret out the violator(s)?
It is probably because CPF does not know the application that are associated with these messages. Based on the message (ICMP = Port Unreachable) & the wide range of IPs involved I suspect that these are being generated because of some sort of P2P program (eMule, Torrent, etc…) or it could be some other form of network (instant messaging, etc…).
Thanks for the response, kail. I don’t have any IM clients installed (I’m one of those people who hates Windows Messenger so much I edited the registry to block it from ever loading). I do have a P2P client installed, uTorrent, but it is not running (though it does work fine when I do run it - green check mark and everything). Other applications currently running that I have eliminated as being the cause are Firefox 2.0.0.1, Thunderbird 1.5.0.9, avast! 4.7.892 and Intel Audio Studio 2.0. In short, whatever is “dialing out” is not obvious!
Foundstone has a whole bunch, including SuperScan, FPort, etc. Bound to be something there that can help you.
PortQuery Will allow you to scan ports (range, specific, etc) to see what activity is going on.
SIW will show you what’s communicating (listening, active, even just “holding” a port), if you look under the Network section. You might be surprised by what you see…
You could also try Filemon or Process Monitor from SysInternals: http://www.gtopala.com/ to see what’s running. Hey, for that matter, What’s Running has a lot of Connections info in it as well. You can get it from MajorGeeks: Download What's Running - MajorGeeks
Thanks for chiming in, Little Mac. I’ve tried a few of the programs you recommended but I still haven’t been able to correlate an application with a particular CPF log entry. I believe this is so because CPF is, indeed, blocking access to these exotic IPs so there is nothing for, say., What’s Running to report. Just for completeness, here’s a sample entry from the exported CPF log:
Date/Time :2007-01-04 20:23:15
Severity :Medium
Reporter :Network Monitor
Description:Outbound Policy Violation (Access Denied, ICMP = PORT UNREACHABLE)
Protocol:ICMP Outgoing
Source: 192.168.1.102
Destination: 201.15.157.25
Message: PORT UNREACHABLE
Reason: Network Control Rule ID = 8
Is it possible that I am being pinged and CPF is blocking the return response? I thought there was another network control rule specifically for that but at this point I’m basically scratching my head…
I doubt these are the result of pings, since CFP would, by default, have blocked the inbound ICMP Echo Request & the return should have been a ICMP Echo Return. If your IP address is static or you were at some point connected to the P2P network with the current IP, then these still could be from the P2P network (other P2P users who think you are still connected).
But, if you still suspect this is something else, the perhaps you should try HiJackThis to see if it can find anything.
Thanks for the follow-ups, kail and Rotty. Here’s the HiJack This log:
`Logfile of HijackThis v1.99.1
Scan saved at 7:15:43 AM, on 1/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
The only thing that really jumps out to me is the O21 entry, but none of the usual spyware scanning programs like AdAware have anything to say about it…
I suspect Microsoft may be the offender. I had a similar problem at work where we are on a network and after much analysis using Hijack this and running various malware removal tools I came to the conclusion that the outbound policy violation was something to do with microsoft networking components.
Incidentally, if you have a file called WINotify.dll (not the spelling is different from Winotify.dll)on your pc I have found I get many less outbound policy violations if I disable it using the Startup section of spybot.