Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have McAffee virusscan on my work computer, and every time I start up, I get 2 log entries like this:

Blocked by port blocking rule
C:\Program Files\Skype\Phone\Skype.exe
Anti-virus Standard Protection:Prevent IRC communication

The difference between the two, is that at the end there are 2 different IP addresses (which I don't recognise as belongs to us) with port :6667 on one and :6669 on the other.

Although this is logged, Skype seems to work as expected; including talking, chatting and
screen sharing (new feature in Skype 4.1).

Anyone knows anything about what this is?

EDIT:
I also have a Skype certified plugin in Skype called Cucku Backup. I did not find anything in the documentation that Cucku is trying to access these ports through Skype, but it could be...?

EDIT2:
I did a search on the IP addresses in question on www.webyield.net, and resulted in the following:

IP 71.251.72.173 (this one used port :6667):
Host name: pool-71-251-72-173.tampfl.fios.verizon.net

IP 79.87.54.165 (this one used port :6669):
Host name: 165.54.87-79.rev.gaoland.net

share|improve this question

3 Answers 3

up vote 2 down vote accepted

The setting for this in VSE is found at: VirusScan Console -> Access Protection Properties -> AntiVirus Standard Protection -> Prevent IRC Communication. Since your using a work computer your sysadmin probably has this set on the McAfee ePO server and will revert if you change it. This is a default McAfee ePO policy setting.

I don't think anything evil is going on here. Skype.exe tried to use a port that is blocked by McAfee VSE by default. If you have the setting changed then VSE will still probably report the port access attempt to the same log file, but will say: Would be blocked by Access Protection rule (rule is currently not enforced)

My guess is that Skype.exe probably just tried another port?

share|improve this answer

The standard IRC server port is 6667. IRC servers are commonly used by virus botnets. Use the netstat command to determine what process is running on that port. You'll need to start cmd.exe as administrator, then:

netstat -bn

For example on my Vista system which is secured to the intertrons, but running Windows filesharing and vnc):

PS C:\Windows\System32> netstat -bn

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    10.10.10.110:445       10.10.10.105:49156     ESTABLISHED

 Can not obtain ownership information

x: Windows Sockets initialization failed: 5
  TCP    10.10.10.110:5900      10.10.10.105:61594     ESTABLISHED
 [WinVNC.exe]
  TCP    10.10.10.110:49316     10.10.10.1:4444        CLOSE_WAIT
  BITS
 [svchost.exe]
  TCP    10.10.10.110:49361     10.10.10.1:4444        CLOSE_WAIT
  BITS
 [svchost.exe]
  TCP    10.10.10.110:55488     10.10.10.40:445        ESTABLISHED

 Can not obtain ownership information
share|improve this answer
    
I tried that just now, but none of them included anything on port :666x –  awe Sep 9 '09 at 7:00
    
It might be that McAfee blocked it on an early state so it is never logged in netstat? –  awe Sep 9 '09 at 7:02
    
Yes, it could be that the process was blocked by the firewall. Skype itself doesn't open port 6667 or 6669 on my OS X system when it starts. I don't have skype installed on Windows so I can't check there. –  jtimberman Sep 9 '09 at 7:06
1  
Technically, the standard IRC server port is 194. –  grawity Sep 23 '09 at 13:17
    
Botnet IRC servers are usually left open on some random port anyway. Blocking the usual IRC ports will add no real security, only the inability to connect to most IRC servers with most IRC clients and even then it could be easily bypassed. –  Don Jan 21 '10 at 9:24

McAfee blocks the standard IRC ports by default to help protect from malware that communicates through IRC. It doesn't look like Skype is being malicious. It is likely that the IPs that are tyring to be connected to are either some user in your contact list or a Skype super-node that your machine is trying to connect through on port 666x. You could easily add skype.exe to the Allowed list through the McAfee console and see if that changes performance for you, however, since you say that skype doesn't seem to be affected, you can probably do okay without white-listing it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.