Odd Behavior! Remotely initiated connection attempt from msnews.microsoft.com server?

[Steven L Umbach]

That is used for nntp - newsgroups. If you are not hosting newsgroups
I would recommend disabling the and using a firewall. --- Steve

 

[Clueless]

Could someone explain me why msnews.microsoft.com would attempt to establish
a remote connection with my machine from port 119?

 

[Clueless]

Thanks. Indeed, the firewall is the one that caught the intrusion. It is
setup not to accept server conections. I am not hosting newsgroups. So, from
what you said, I can assume it is not a normal use connection for me and
never give acces when it ask ever. I am glad I did not. Oddly enough, the
connection was attempted after closing OutLook Express but not inmediatedly
afterwards.

 

[Herb Martin]

It almost certainly would not do that.

Two major possibilities:
1) you were trying to download news and YOUR machine
established the connection with MSNews (which only
answered.)

2) A probe (by a network snooper) was forged to hide the
real identity [unlikely but more likely than Microsoft's server
just deciding to call you for no reason.]

I guess you COULD be running a newsfeed on that machine and
Microsoft thought your were the provider, but the odds of this
without your knowledge are slim to none.

 

[Herb Martin]

Thanks, Herb. You are right, I have no clue what a newsfeed is.

[You chose the name "clueless"; I would never suggest this of
someone who is smart enough to ask for help. <grin>]

News-servers transfer news from other servers -- those source
servers are referred to as a "newsfeed" or are said to "provide
a newsfeed" (the latter is slightly more accurate.)

Microsoft wouldn't be using your servers as a Newsfeed so
the most likely case is that you ran Outlook Express to download
THESE messages from the Microsoft newsgroups and that
opened the connection (or another news reader, e.g., Agent, etc.)