Incoming connection: Microsoft_DS ???

[Kaczor]

I was just trying out the Outpost Firewall and noticed a strange incoming connection:

Application: SYSTEM
Local Port: MICROSOFT_DS
Local Address: LocalHost
Protocol: TCP
Remote Port: 2724
Remote Address: ****.bccexpo.com

(I masked the first portion of the address)

I have no idea what this is, but I have seen a similar connection recently but to a totally differente remote address.

What is Microsoft_DS ?

Any help would be appreciated?

Thanks,

Pawel

 

[cleverhandle]

Microsoft Directory Services, used by Active Directory, lives on port 445. You'll see lots of attempts on that port if you look. I don't even bother to log it anymore.

 

[Kaczor]

So, should I be worried that there is a connection to a specific address?

pawel

 

[cleverhandle]

Well, I'm assuming they don't actually connect - the remote machine is just probing that port. If your OS logs show an actual connection, then that's not good. Are you running at least the Windows built-in firewall normally?

 

[Kaczor]

I am only running the Outpost Firewall.

I did notice that it shows zero sent and received bytes.

 

[bsobel]

There is a worm which attempts to connect via this connection, probably why your noticing the increased activity.
Bill