XP accessing 224.0.0.2 - advice please

Can I ask you specialists for some advice about my home PC.

I run XP Pro with all Microsoft patches except for SP2. I have got
only one PC attached to NTL broadband direct via a cable modem. My
PC is regularly scanned for viruses and for adware.

After booting up, my Sygate personal Firewall has recently been
asking me if I wish to allow these following programs to access
224.0.0.2

C:\windows\explorer.exe
C:\windows\system32\spoolerv.exe
C:\windows\system32\services.exe
C:\WINDOWS\System32\csrss.exe

also my antivirus program:
C:\Program Files\AntiVir PE\AVWIN.EXE

When I look up these program names on Google it seems that they are
probably not viruses.

But why do they want to access 224.0.0.2? And should I let them?

I have had some funny behaviour recently on my machine. When I ask
the PC to power down from the only open account, the PC says someone
else is logged on. But the other two accounts on the system are
logged off.

Could I have configured a network by mistake and the other account is
actually a network connection? How could I check if this is
happening.

Could this be linked with me plugging in my Canon Powershot/Ixus
digital camera recently to my USB port? The camera appeared as if it
was an extra drive.

Thank you for any help.

Zarbol




--





posted to
ntl.discussion.broadband.cm
uk.telecom.broadband
comp.security.misc
microsoft.public.windowsxp.security_admin

Zarbol Tsar wrote:
> Can I ask you specialists for some advice about my home PC.
>
> I run XP Pro with all Microsoft patches except for SP2. I have got
> only one PC attached to NTL broadband direct via a cable modem. My
> PC is regularly scanned for viruses and for adware.
>
> After booting up, my Sygate personal Firewall has recently been
> asking me if I wish to allow these following programs to access
> 224.0.0.2
>
> C:\windows\explorer.exe
> C:\windows\system32\spoolerv.exe
> C:\windows\system32\services.exe
> C:\WINDOWS\System32\csrss.exe
>
> also my antivirus program:
> C:\Program Files\AntiVir PE\AVWIN.EXE
>
> When I look up these program names on Google it seems that they are
> probably not viruses.
>
> But why do they want to access 224.0.0.2? And should I let them?

It's to do with IP routing. Block and forget.

Mike Scott wrote:
> Zarbol Tsar wrote:
>> Can I ask you specialists for some advice about my home PC.
>>
>> I run XP Pro with all Microsoft patches except for SP2. I have got
>> only one PC attached to NTL broadband direct via a cable modem. My
>> PC is regularly scanned for viruses and for adware.
>>
>> After booting up, my Sygate personal Firewall has recently been
>> asking me if I wish to allow these following programs to access
>> 224.0.0.2
>>
>> C:\windows\explorer.exe
>> C:\windows\system32\spoolerv.exe
>> C:\windows\system32\services.exe
>> C:\WINDOWS\System32\csrss.exe
>>
>> also my antivirus program:
>> C:\Program Files\AntiVir PE\AVWIN.EXE
>>
>> When I look up these program names on Google it seems that they are
>> probably not viruses.
>>
>> But why do they want to access 224.0.0.2? And should I let them?
>
> It's to do with IP routing. Block and forget.

From grc.com's IDSERVE utility:

Initiating server query ...
Looking up the domain name for IP: 224.0.0.2
The domain name for the IP address is: ALL-ROUTERS.MCAST.NET
Connecting to the server on remote port: 25
[Connected] The remote connection was accepted but the server did not
return a connection greeting.

Ivor

In uk.telecom.broadband Ivor Jones <(E-Mail Removed)> wrote:
> Mike Scott wrote:
>> Zarbol Tsar wrote:
>>> Can I ask you specialists for some advice about my home PC.
>>>
>>> I run XP Pro with all Microsoft patches except for SP2. I have got
>>> only one PC attached to NTL broadband direct via a cable modem. My
>>> PC is regularly scanned for viruses and for adware.
>>>
>>> After booting up, my Sygate personal Firewall has recently been
>>> asking me if I wish to allow these following programs to access
>>> 224.0.0.2
>>>
>>> C:\windows\explorer.exe
>>> C:\windows\system32\spoolerv.exe
>>> C:\windows\system32\services.exe
>>> C:\WINDOWS\System32\csrss.exe
>>>
>>> also my antivirus program:
>>> C:\Program Files\AntiVir PE\AVWIN.EXE
>>>
>>> When I look up these program names on Google it seems that they are
>>> probably not viruses.
>>>
>>> But why do they want to access 224.0.0.2? And should I let them?
>>
>> It's to do with IP routing. Block and forget.

> From grc.com's IDSERVE utility:

> Initiating server query ...
> Looking up the domain name for IP: 224.0.0.2
> The domain name for the IP address is: ALL-ROUTERS.MCAST.NET
> Connecting to the server on remote port: 25
> [Connected] The remote connection was accepted but the server did not
> return a connection greeting.

Which won't give any useful information as addresses in the 224.0.0.0/24
are used for multicasting.

see http://www.cotse.com/CIE/RFC/1700/5.htm

In the original posters situation it is safe to either allow or block it
according to their own preference.

Steve

Ivor Jones wrote:

>
> From grc.com's IDSERVE utility:
>
> Initiating server query ...
> Looking up the domain name for IP: 224.0.0.2
> The domain name for the IP address is: ALL-ROUTERS.MCAST.NET
> Connecting to the server on remote port: 25
> [Connected] The remote connection was accepted but the server did not
> return a connection greeting.
>
> Ivor

LOL. It's a multicast address, idiot.

The guy who said "It's to do with IP routing. Block and forget." was
correct.

ANY address starting with 224 is not an address for a specific machine -
it's a multicast address. In this case, the multicast address that all
routers that respond to router discovery multicasts will listen for and
respond to.

His windows box is running router discovery. 224.0.0.2 is the "all
routers on this subnet" multicast address.

All IANA assigned multicast addresses can be found here:
http://www.iana.org/assignments/multicast-addresses

T. Sean Weintz wrote:
> Ivor Jones wrote:
>
>>
>> From grc.com's IDSERVE utility:
>>
>> Initiating server query ...
>> Looking up the domain name for IP: 224.0.0.2
>> The domain name for the IP address is: ALL-ROUTERS.MCAST.NET
>> Connecting to the server on remote port: 25
>> [Connected] The remote connection was accepted but the server did
>> not return a connection greeting.
>>
>> Ivor
>
> LOL. It's a multicast address, idiot.

Was there any need for that..? I have never heard of multicast until today
so I had no idea what it was. Please don't be offensive.

Ivor

On 18 Nov 2004, T. Sean Weintz wrote:

> The guy who said "It's to do with IP routing. Block and forget."
> was correct.
>
> ANY address starting with 224 is not an address for a specific
> machine - it's a multicast address. In this case, the multicast
> address that all routers that respond to router discovery
> multicasts will listen for and respond to.
>
> His windows box is running router discovery. 224.0.0.2 is the
> "all routers on this subnet" multicast address.

I am using a standalone PC (with no LAN) connected to a cable modem.

If I am running this "router discovery" then is it something I should
turn off?


>
> All IANA assigned multicast addresses can be found here:
> http://www.iana.org/assignments/multicast-addresses
>

In uk.telecom.broadband Zarbol Tsar <(E-Mail Removed)> wrote:
> On 18 Nov 2004, T. Sean Weintz wrote:

>> The guy who said "It's to do with IP routing. Block and forget."
>> was correct.
>>
>> ANY address starting with 224 is not an address for a specific
>> machine - it's a multicast address. In this case, the multicast
>> address that all routers that respond to router discovery
>> multicasts will listen for and respond to.
>>
>> His windows box is running router discovery. 224.0.0.2 is the
>> "all routers on this subnet" multicast address.

> I am using a standalone PC (with no LAN) connected to a cable modem.

> If I am running this "router discovery" then is it something I should
> turn off?

No, you don't need to worry about it in any way. It's just one of those
mickysoft things.

Steve

"Ivor Jones" <(E-Mail Removed)> wrote in
news:cnj8ma$rgc$(E-Mail Removed):

> Was there any need for that..? I have never heard of multicast until
> today so I had no idea what it was. Please don't be offensive.

Sounded more like a light hearted jest than an offensive hurl. Idiot ;0)

--
Colin
*Drop DEAD from the email address to reply*

cw wrote:
> "Ivor Jones" <(E-Mail Removed)> wrote in
> news:cnj8ma$rgc$(E-Mail Removed):
>
>> Was there any need for that..? I have never heard of multicast
>> until today so I had no idea what it was. Please don't be
>> offensive.
>
> Sounded more like a light hearted jest than an offensive hurl.
> Idiot ;0)

Calling someone an idiot just because they've never heard of something is
offensive.

Please don't do it, at least not to me.

<Plonk>

Ivor