• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Kazaa Lite security question: TCP port 1214

M

morkinva

Diamond Member
For the last week or so I've been getting hundreds of 'internet alerts' (about 600-1000 per day) from zonealarm, mostly on tcp port 1214 -- I think, but I'm not sure, that it coincides with installation of Kazaa Lite. But it's not even running most of the time. Before this started there were maybe 25 per day. Is anybody else experiencing this? I'm on Comcast cable.
 


<< Here is a list of ports >>



Thanks Ameesh thats a cool link.

What I don't understand is how Kazaa opens this port. Kazaa isn't loading on startup that I can see, I've looked in win.ini, system.ini, and startup. Is there something in the registry? What can I do to close it, and is it anything to worry about. Apparently Kazaa works fine with zonealarm constantly blocking port 1214.
 
All of the attacks are probably stemming from the way Kazaa is setup. Most likely your instance of Kazaa is setup as to function as a Super Node. A Super Node acts as a server for other Kazaa users when they are trying to search. The reason you are getting all of the alerts is because the other users think you are still online and they are sending search requests to you. If you leave Kazaa offline long enough the alerts should subside since the other clients will no longer use you as a server.
 
What I don't understand is how Kazaa opens this port. Kazaa isn't loading on startup that I can see,
Kazaa doesn't use that port on my system, but then I'm not using the lite version.
It should be easy enough to see if it's running though. Just hit ctrl + alt + delete , and check the task manager for Kazaa.exe.
 
This is what I have running when I ctrl-alt-del:

outlook express
anandtech forums-microsoft internet explorer
explorer
OSD (this and the next one appear to be for the rocketboard keyboard, when I eliminate them the 'attack' continues)
versato
zonealarm
Em_exec (logitech wireless mouse)
avgcc32 (antivirus)
haca (happy calendar)
systray
rundll
avgserv9 (antivirus)
 


<< Did you remove all the spyware? >>



There is one spyware I didn't remove, as per instructions for installation of Kazaa Lite. It's called cd_clint.dll. But cd_clint.dll doesn't show up in win.ini, system.ini startup or the registry. As per nightowl I checked the box in Kazaa Lite that says 'do not function as a supernode', and rebooted. The result is the same.

Is there a way, other than uninstalling the Kazaa Lite, to disable the loading of this dll? Am I the only one experiencing this phenomenon?

edit>> This happens even after I reboot and don't load Kazaa Lite
 
It is related to both the functioning of a "SuperNode" and whenever someone trys to download from you, they will attempt to conect to this port. Don't worry about it, and it will keep on happening.

Armani
 
It is related to both the functioning of a "SuperNode" and whenever someone trys to download from you, they will attempt to conect to this port. Don't worry about it, and it will keep on happening.

I'm setup as a Supernode, and I don't get this. Why would he still be getting hit if he's not on Kazaa?

 


<< Why would he still be getting hit if he's not on Kazaa? >>


My guess is that if he was a supernode, other people are still looking for him - sending a request to his IP and port #.

Rob
 
I've uninstalled the program, removed the Kazaa subdirectory from program files, and STILL getting hit. Now what? My IP is static.
 
It's likely that your IP is somehow stale in search results, esp. since your IP is static.

Even though you aren't logged in at the moment, other nodes return search hits that reference files you had been sharing.

So they attempt to contact your Kazaa server.

If Kazaa is truly not running, then this is probably what's happening. I wouldn't really worry about it that much.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top