[Dshield] CONIN$

David Sentelle David.Sentelle at cnbcbank.com
Fri Dec 26 16:58:53 GMT 2003


Today I noticed a very odd request on one of my PCs.  It is a PC that
just collects syslogs.  No software has been added/removed or even
reconfigured for at least 6 months, excluding windows update, and the
machine is not exposed to the internet.

Zone Alarm on this PC requested a network connection for 'conin$',
connecting to the internal DNS server on the proper DNS port 53.  The
last time Zone Alarm even added anything to its logfile was over a month
ago until today.

My googling told me this is how some programs get keyboard input, but
why would this show up in Zone Alarm?!  Much less making a DNS
request?!

Any ideas folks?





More information about the list mailing list