Hi:

 

I was checking my Kapersky settings on the computer hosting fmserver, and found it is sending TCP info to 2 IP addresses in Ukraine:

176.32.99.193:443 and 176.32.99.56:443

I blocked those addresses and then fmserver.exe connected again to Ukraine through other addresses.

 

Amounts of data are small (largest 9 KB received/1.6 KB sent) all active for many hours.

It is also receiving small amounts of data on connections open for many days through its LAN address (192.168.1.5), using ports 49204 and 49163.

 

As soon as I turned off the server, all traffic vanished except for an inbound under Java Platform SE binary (23.202.103.219:443) which belongs to Akamai

And what seems to be an intermitent ping under the same Java from 127.0.0.1:50003

 

Any ideas of what this is?

 

Extra info:

None of the above mentioned ports appear as open on Kapersky's listing.

Server v 11.0.5.510

I use 360 Works Safetynet back up.

Kapersky Internet Security

Acer Travel Mate 4740-5755 Intel core i3-500M processor, 4GB RAM

Windows 7 Pro.

Java 7:25

Ports open on router for FM server are 5003, 50003 and 50006

8080 for Supercontainer on Tomcat

 

Thanks

Carlos

UPDATE

It was  360 Works Safety net, I disabled the plugin, and the connections stopped, re-enabled it, and they started again.

Wow, I did get scared!

 

Carlos