[tollewerbung]

Hello,

after installation of Nokia PC Suite 6.5 (same effect with 6.6.16) on a relatively fresh installed Windows XP Home SP2 with Kerio PF 2.1.5 and BitDefender 8 Pro, the latter alarmed me of the Nokia PC Suite trying to connect to IP 84.237.14.0.
This is reproducible with 6.5 and 6.6.16, and it is always the same IP.

A WhoIs query (http://sunny.nic.com/cgi-bin/whois) reveiled the following:
inetnum: 84.237.0.0 - 84.237.127.255
netname: RU-SBRAS-20040628
descr: Institute of Computational Technologies of SB RAS (http://www.ict.nsc.ru)
descr: PROVIDER Local Registry
country: RU
org: ORG-IoCT1-RIPE
admin-c: sdb1-RIPE
tech-c: amf13-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: SBRAS-MNT
mnt-routes: SBRAS-MNT
source: RIPE # Filtered

What the heck is Nokia PC Suite trying to send to that server?!

Thanks and kind regards,
ao

[petrib]

In all likelihood Nokia or PC Suite is not trying to do anything like that at all.

Do you have more evidence to that effect?

In other words, things like logs with actual timestamps, process name, DLL name or executable name (process name), protocol being used (ICMP/IGMP/UDP/TCP), local address of device trying to make the connection, the remote address, local port, remote port, connection state, connection result, etc.?

Most of the logged details above would (must or at least should) be supplied by any firewall, including the one that detected the connection attempt (BitDefender).

So far you have provided only the claim by BitDefender (which I'm not familiar with at all) that another app that could be PC Suite is trying to make a connection to an IP address (behind which there doesn't even seem to be any actual machine listening/waiting).

How, exactly, is BitDefender indicating that it is PC Suite that's doing it, and not some other app that has hooked low-level Windows APIs?

PC Suite is used by quite many people, and I'm sure that also many of them are extremely aware about every connection being made from the PC to elsewhere on a very low level.

I certainly haven't ever seen such activity before in conjunction with any version of PC Suite on any PC, nor have other people I've discussed this with.

At this very moment I've a spyware monitor, a virus scanner and two different firewall applications monitoring both incoming and outgoing traffic, and none of them reacts to PC Suite and never has.

I think it is far more likely that you either have some other piece of malicius software running on your PC doing this connection, or that the software you used is reporting things incorrectly.

Anyway, make also sure that you have a PC Suite version supplied by Nokia (please, download the latest version, which is 6.6.18, from http://www.nokia.com/pcsuite and not from anywhere else).

You might also install and run up-to-date versions of apps like Spybot Search & Destrory or other spyware/virus software scanners (possibly also check that you're using the latest version of this BitDefender and whatever updates for its scanning/monitoring database may exist).