[Dshield] Is this normal?

Mercy Mercymail at mindspring.com
Sun Jun 23 00:17:48 GMT 2002

I've heard the same things too, Antti.  About MS programs 'calling home' so
they can see who's using pirated software.  Never knew if it was true or
not, still not sure, but i believe it's likely. (knowing MS after all and
all the things they try to do).

I saw on Tech TV about how MS wants to make a way so that if you're running
a MS OS, you can only use MS software products.

I'd definetly switch to linux then. (Still would like to switch to linux,
but that means i'd have to give up so many programs i use that aren't made
for lin.)

Sorry for rambling,

----- Original Message -----
From: "Antti Tolamo" <usenet at linux.tola.org>
To: <list at dshield.org>
Sent: Saturday, June 22, 2002 5:25 PM
Subject: Re: [Dshield] Is this normal?

> At 01:22 22.6.2002 -0400, you wrote:
> >Sorry all, but i really am still learning about all of this stuff.
> >
> >I just got home and checked my zone alarm alerts... and this was in it:
> >
> >The firewall has blocked Internet access to
> ><http://www.microsoft.com>www.microsoft.com ( (ICMP Time
> >Exceeded) from your computer.
> >
> >Occurred: 4 times between 6/21/02 5:27:16 PM and 6/21/02 5:28:02 PM
> >
> >I'm assuming that a microsoft program tried to look for updates?  Why did
> >it happen so many times?
> >
> >Stupidly yours,
> >Mercy
> Well, I don't know what actually happens there with you.
> But I've noticed that something goes periodically to microsoft.com
> from my Windows 2000.  I have  linux server that works as a firewall
> and shares internet connection forward to my local network.
> And by looking for a while traffic that goes past by my linux server,
> I noticed some very minor traffic went to domain microsoft.com. While I
> at the front of the linux computer and nothing was running
> at the Windows 2000 end.
> It's for a while I noticed this, so I can're  exactly remember what
> protocol(ICMP, TCP, UDP)
> was used and what actually happened with traffic. But back then I figured
> that it must be  microsoft's own
> feature.  I didn't install any automatic update (not to my knowledge that
> is) or similar where
> I would have had reason to be in contact with microsoft.com
> Nor did I
> use any Microsoft services like hotmail, or msn.com. So there would have
> been absolutely
> know reason to contact there.
> Microsoft is known to spook information about other microsoft products. If
> I recall right,
> Excell, Word etc. at Office packet sended their serials automatically over
> network to Microsoft at some stage.
> I guess to track the pirated Microsoft products.
> Windows is anyway closed source code, which means lot of people don't know
> what it  exactly does
> until they notice something funny. There propably is lot of what Microsoft
> doesnt' tell about
> way Windows works and what features it has. As a company, Microsoft of
> course has
> intrest to know how much and where it's products are used.
> And I still  really don't really know what the idea contacting
> microsoft.com automatically
> was. Keeping tabs of how many Windows 2000 users there is?
> - Antti not a paranoid person, just a realist.
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:

More information about the list mailing list