[diggeryo]

I have Windows Vista Ultimate with SP1 and all latest updates installed. Twice today my firewall (AVG Internet Security v8.5 [paid]) has popped up the following warning: "Application 'Photos Screen Saver' is trying to establish TCP connection with remote IP address 96.17.72.146 : 80." I do have my screen saver in Windows Vista set to the "Photos" one that came with Vista, but I don't recall this warning popping up any other time since I initally installed Vista about a month ago. So I am hesitant to allow this communication. Can anyone shed some light as to whether it is ok to allow this?

thanks,
mike.

[Advertisements]

It might be trying to connect to your account.

This is very uncommon and I believe there is nothing that I can bring up that will help.

[DragonMaster Jay]

It might be trying to connect to your account.

This is very uncommon and I believe there is nothing that I can bring up that will help.

[Broni]

Did you download any screensavers from the internet?

[diggeryo]

It might be trying to connect to your account.

This is very uncommon and I believe there is nothing that I can bring up that will help.

I'm not sure what account you're referring to when you say it might be trying to connect to it.

It might be trying to connect to your account.

Did you download any screensavers from the internet?

No, I didn't. The only screensavers on my computer are those that came with Vista.

[Broni]

96.17.72.146 IP belongs to Akamai Technologies, which among other things is known by their download manager.

Download, install, and run Whats Running.
Click on Take snapshot in the left pane.
New pop-up window will open.
Click on Save snapshot, and save the file as snap (.xml extension will be added automatically) to know location.



Zip the file, and attach it to your next reply.

[diggeryo]

Zip the file, and attach it to your next reply.

Thanks for the reply. Attached is the requested file.

Some additional info... I was getting tired of the "Photo Screen Saver" messager from my firewall popping up all the time, so I decided to permanently block it. Now, however, I am getting the same message to the same IP addresses, but the program trying to access the Internet is "Com Surrogate."

I should also point out that my anti-virus and anti-spyware program (AVG v8.5 paid) is completely updated and runs a scan on a daily basis. However, nothing is ever found. I also occasionaly run "Spybot-Search and Destroy" and "Malwarebyte's Anti-Malware," both of which I ran yesterday. None of them found anything on my system.

Attached Files

•  snap.zip   98.64KB   494 downloads

Edited by diggeryo, 07 May 2009 - 11:02 AM.

[Broni]

There are several established connection to akamaitechnologies.com through different IP addresses:
96.17.72.130
69.192.12.20
96.7.108.20
96.17.73.162
I'm not sure though, which process/service/program is doing this.
The only two startups, which could be possibly involved, are:
- 3RVX
- SansaDispatch (this one is totally unnecessary as a startup).

Open Who's running again, click on Startup tab, and uncheck SansaDispatch.
Restart computer, and see, if same problem happens.
If so, disable 3RVX.
Restart computer.

We'll go from there.

[diggeryo]

Thanks for the advice, Broni. I haven't had the issue since this afternoon, so I will wait until it happens again before I try your recommendation. Once I've disabled both of them, if I still get the message, I will repost.

Thanks again.

[Broni]

Very well