PeerGuardian constantly blocks Declude Inc. only for me

  • Thread starter Thread starter donnie
  • Start date Start date
D

donnie

I don't see anyone on google who has asked this question ever but I'm
amazed if I'm being targeted by anyone.

I try to use "netstat -ban" to view connections to and from my WinXP PC but
netstat gives only one quick snapshot in time so it misses a lot.

In searching for a program which will log all the "connections" to/from my
computer, I found on SourceForge freeware called the "PeerGuardian2"
firewall for Windows XP (FAQ http://phoenixlabs.org/pg2/faq/).

Instantly after installing PeerGuardian, I was shocked at what I see
connecting to/from my computer! But one entry in particular frustrates me.

Can you help me ascertain who or what is connecting to me?

Most of the connections, when I look them up, have been reported before in
the usenet newsgroups but one.

The one that doesn't seem to have a google record is the google search:
"PeerGuardian Declude, Inc."

Specifically, PeerGuardian constantly logs hits such as:
Time: Range: Source: Destination: Protocol: Action:
15:23:12 Declude, Inc 192.168.1.2:3866 70.87.188.180:80 TCP Blocked
15:23:12 Declude, Inc 192.168.1.2:3872 70.87.188.180:80 TCP Blocked
15:23:12 Declude, Inc 192.168.1.2:3887 70.87.188.180:80 TCP Blocked
etc.

Two things initially puzzle me. The first is these seem to be OUTGOING
connections but I didn't ask to connect to anything (I tested it right
after a reboot with nothing running overtly and no web pages up). The
second is that Declude, Inc. appears to sell email security software but I
didn't order any email security software (News at
http://www.declude.com/site/innews.htm).

Why am I the only one trying to google for "Declude Inc" TCP:80 attacks?

donnie
 
donnie said:
I don't see anyone on google who has asked this question ever but I'm
amazed if I'm being targeted by anyone.

I try to use "netstat -ban" to view connections to and from my WinXP PC but
netstat gives only one quick snapshot in time so it misses a lot.

In searching for a program which will log all the "connections" to/from my
computer, I found on SourceForge freeware called the "PeerGuardian2"
firewall for Windows XP (FAQ http://phoenixlabs.org/pg2/faq/).

Instantly after installing PeerGuardian, I was shocked at what I see
connecting to/from my computer! But one entry in particular frustrates me.

Can you help me ascertain who or what is connecting to me?

Most of the connections, when I look them up, have been reported before in
the usenet newsgroups but one.

The one that doesn't seem to have a google record is the google search:
"PeerGuardian Declude, Inc."

Specifically, PeerGuardian constantly logs hits such as:
Time: Range: Source: Destination: Protocol: Action:
15:23:12 Declude, Inc 192.168.1.2:3866 70.87.188.180:80 TCP Blocked
15:23:12 Declude, Inc 192.168.1.2:3872 70.87.188.180:80 TCP Blocked
15:23:12 Declude, Inc 192.168.1.2:3887 70.87.188.180:80 TCP Blocked
etc.

Two things initially puzzle me. The first is these seem to be OUTGOING
connections but I didn't ask to connect to anything (I tested it right
after a reboot with nothing running overtly and no web pages up). The
second is that Declude, Inc. appears to sell email security software but I
didn't order any email security software (News at
http://www.declude.com/site/innews.htm).

Why am I the only one trying to google for "Declude Inc" TCP:80 attacks?

donnie
Click to expand...

Have you gone through Add/Remove Programs in the Control Panel to double
check to see if maybe you have a free trial of their mailprotector
program installed? If so, it may be trying to perform an autoupdate by
connecting to that IP's web address.

Also maybe try to use regedit and search for key values that include
"Declude"

James http://cronus.ath.cx
 
Have you gone through Add/Remove Programs in the Control Panel
Click to expand...

I couldn't find program entries for "Declude, Inc" using the WinXP
add/remove applet but Windows XP is notorious for missing installed
programs.

So I tried the better crap-cleaner add/remove freeware (features
http://www.ccleaner.com) which found a LOT more installed programs but not
anything starting with Declude.

So, it doesn't look like Declude is a program I installed on purpose.

Is there any way to see if Declude is pinging anyone else constantly?

donnie
 
Also maybe try to use regedit and search for key values that include
"Declude"
Click to expand...

Nothing called "Declude, Inc" in regedit but WinXP regedit is notorious for
missing keys for example hex or ascii equivalents so I installed the
Nirsoft freeware (download http://www.nirsoft.net/utils/regscanner.html).

Even Nirsoft came up empty.

Why would declude inc be attacking my pc ports.

Better yet, is there a better program than peerguardian for logging each
and every incoming and outgoing connection to/from my computer?

donnie
 
donnie said:
Nothing called "Declude, Inc" in regedit but WinXP regedit is notorious for
missing keys for example hex or ascii equivalents so I installed the
Nirsoft freeware (download http://www.nirsoft.net/utils/regscanner.html).

Even Nirsoft came up empty.

Why would declude inc be attacking my pc ports.

Better yet, is there a better program than peerguardian for logging each
and every incoming and outgoing connection to/from my computer?

donnie
Click to expand...

Try running netstat with a numerical value (x) after it and it should
run recurrently at (x) seconds. Sometimes I use "netstat -t 5" to get a
list of my TCP connections only, at an interval of every 5 seconds. You
could also maybe try a netstat -options (x) > somefile.log to log the
output of your netstat into a logfile you can reference later as well.

James http://cronus.ath.cx
 
donnie said:
I don't see anyone on google who has asked this question ever but I'm
amazed if I'm being targeted by anyone.

I try to use "netstat -ban" to view connections to and from my WinXP PC but
netstat gives only one quick snapshot in time so it misses a lot.

In searching for a program which will log all the "connections" to/from my
computer, I found on SourceForge freeware called the "PeerGuardian2"
firewall for Windows XP (FAQ http://phoenixlabs.org/pg2/faq/).

Instantly after installing PeerGuardian, I was shocked at what I see
connecting to/from my computer!
Click to expand...

Seems like the scaremonging works.
Can you help me ascertain who or what is connecting to me?
Click to expand...

Where exactly is your problem with typing "netstat"?
 
Nothing called "Declude, Inc" in regedit but WinXP regedit is notorious for
missing keys for example hex or ascii equivalents so I installed the
Nirsoft freeware (download http://www.nirsoft.net/utils/regscanner.html).

Even Nirsoft came up empty.

Why would declude inc be attacking my pc ports.
Click to expand...

They are not. You mentioned yourself that those were outgoing
conections.
Better yet, is there a better program than peerguardian for logging each
and every incoming and outgoing connection to/from my computer?
Click to expand...

IMHO, for your purpose everything that only logs and does not try to
intelligently act upon it would be better. I just out of curiousity
had a look at PG2. This is not something you should be using unless
you really know what you are doing. Otherwise you will just break your
network connections.
 
Back
Top