zonealarm netbios alert

[Matrix_man]

I'm using Zonealarm 2.6.357 with XP Home. I connect to the internet via a wireless LAN. Recently zonealarm alerts is reporting the following.

"The firewall has blocked Internet access to 192.168.0.174 (NetBIOS Session) from your computer [TCP Flags: S]."

If you got to zonealarm's webpage you get this,
"Your computer has attempted to use NetBIOS port 1034 to connect to another computer, located at address 192.168.0.174"

I checked the IP address here:
http://www-whois.internic.net/cgi/whois and came up with the following;

Server Name: 192.168.0.174
Registrar: PRIMUS TELCO PTY LTD DBA PRIMUSDOMAIN/PLANETDOMAIN
Whois Server: whois.planetdomain.com
Referral URL: http://www.planetdomain.com

Does this mean that my computer was trying to conect to this server, and why would it being doing that? Could I have trojan or some other virus? Thanks for any suggestions you may have.

[bassman]

It wouldn't hurt to run a virus scan, but some "alarms" are quite inoffensive. Yes, it does mean that your computer was trying to connect to another one using NetBIOS protocol, but that can be pretty much anything as your PC trying to find out what sharing services are being ran in it's network (like printer shares, etc...); have you checked if your IP address is within the range of the target IP of that connection? It could have been a connection to your ISP...Anyway, if you're sharing anything in your PC, make sure you have strong passwords. For more info on this issue:
http://cable-dsl.home.att.net/netbios.htm
http://www.nwinternet.com/~pchelp/se...es/sharing.htm

[Yoda]

Hi,

The ip nr. 192.168.0.174 is within the private range of ip adresses and therefore may NOT be used on the internet. This is used for private networks all over the world.

i guess some device/computer on your network has this ip number., or in the worse case someone on the parkinglot near your house or one of your neighbours.

Secure your wireless LAN, using every means you have. There must be a lot af sites on this topic. Search www.google.com

Do some reading on www.practicallynetworked.com on windows networking.

[Matrix_man]

Yoda and Bassman, thanks for your reply, I know my wireless network is not all that secure so I will work on that. It does seem to happen when I first start my computer so it may be like what Bassman said that my, "PC trying to find out what sharing services are being ran in it's network". Thanks....

[omendata]

Could be spyware on your machine.
The address may be spoofed but it sounds like your access point - what is its ip?

Port 1034 is often one of the first ports used by the operating system for outbound connections.