www.MegaLab.it

da **stubborn74** » mar ott 02, 2012 10:47 pm

ciao,windows vista 32 bit su un notebook HP.
ho bloccato con windows firewall tutte le connessioni in entrata (tutti i profili,tutte le porte,tutti i domini,tutti i programmi)
ma continua ad esserci una connessione in entrata che riesce ad accedere nonostante il blocco totale,
la sto rilevando attraverso il file pfirewall.log (un log che ti rilascia windows per informarti delle connessioni riuscite)
stavo cercando di risalire al pid tramite il programma sysinternals Procexp,ma non riesco a capire quale programma stabilisce questa connessione in entrata. vorrei bloccarla! qualche amico esperto può farsivivo?

quì c è un estratto del log,guardate sta roba... ma che è???

2012-10-02 23:17:03 DROP TCP 173.194.35.191 151.38.152.75 80 49991 40 FA 1274907777 3678718158 14300 - - - RECEIVE
2012-10-02 23:17:03 DROP TCP 173.194.35.191 151.38.152.75 80 49987 40 FA 1262571660 1828646658 14300 - - - RECEIVE
2012-10-02 23:17:03 DROP TCP 173.194.35.191 151.38.152.75 80 49988 40 FA 1263223240 3091717649 14300 - - - RECEIVE
2012-10-02 23:17:03 DROP TCP 173.194.35.191 151.38.152.75 80 49990 40 FA 1269296654 736425850 14300 - - - RECEIVE
2012-10-02 23:17:03 DROP TCP 74.125.232.98 151.38.152.75 443 49992 101 AP 160790937 12663927 17152 - - - RECEIVE
2012-10-02 23:17:03 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 173.194.35.191 151.38.152.75 80 49991 40 FA 1274907777 3678718158 14300 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 173.194.35.191 151.38.152.75 80 49988 40 FA 1263223240 3091717649 14300 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 173.194.35.191 151.38.152.75 80 49987 40 FA 1262571660 1828646658 14300 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 173.194.35.191 151.38.152.75 80 49990 40 FA 1269296654 736425850 14300 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 173.194.35.191 151.38.152.75 80 49989 40 FA 1267871778 2289378020 17456 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 74.125.232.98 151.38.152.75 443 49992 101 AP 160790937 12663927 17152 - - - RECEIVE
2012-10-02 23:17:04 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE
2012-10-02 23:17:05 DROP TCP 173.194.35.191 151.38.152.75 80 49989 40 FA 1267871778 2289378020 17456 - - - RECEIVE
2012-10-02 23:17:06 DROP TCP 173.194.35.180 151.38.152.75 443 49994 101 AP 1327523570 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:06 DROP TCP 173.194.35.180 151.38.152.75 443 49994 81 AP 1327523631 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:06 DROP TCP 173.194.35.180 151.38.152.75 443 49994 40 FA 1327523672 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:06 DROP TCP 173.194.35.180 151.38.152.75 443 49994 101 AP 1327523570 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.35.191 151.38.152.75 80 49991 40 FA 1274907777 3678718158 14300 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.35.191 151.38.152.75 80 49987 40 FA 1262571660 1828646658 14300 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.35.191 151.38.152.75 80 49988 40 FA 1263223240 3091717649 14300 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.35.191 151.38.152.75 80 49990 40 FA 1269296654 736425850 14300 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 74.125.232.98 151.38.152.75 443 49992 101 AP 160790937 12663927 17152 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.35.180 151.38.152.75 443 49994 101 AP 1327523570 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE
2012-10-02 23:17:07 DROP TCP 173.194.35.191 151.38.152.75 80 49989 40 FA 1267871778 2289378020 17456 - - - RECEIVE
2012-10-02 23:17:08 DROP TCP 173.194.35.180 151.38.152.75 443 49994 101 AP 1327523570 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:10 DROP TCP 173.194.35.180 151.38.152.75 443 49994 101 AP 1327523570 1825270628 17152 - - - RECEIVE
2012-10-02 23:17:10 DROP TCP 173.194.35.191 151.38.152.75 80 49989 40 FA 1267871778 2289378020 17456 - - - RECEIVE
2012-10-02 23:17:11 DROP TCP 173.194.35.47 151.38.152.75 443 49995 101 AP 724580680 204190435 17152 - - - RECEIVE
2012-10-02 23:17:11 DROP TCP 173.194.35.47 151.38.152.75 443 49995 81 AP 724580741 204190435 17152 - - - RECEIVE
2012-10-02 23:17:11 DROP TCP 173.194.35.47 151.38.152.75 443 49995 40 FA 724580782 204190435 17152 - - - RECEIVE
2012-10-02 23:17:12 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE
2012-10-02 23:17:12 ALLOW UDP 0.0.0.0 255.255.255.255 68 67 0 - - - - - - - SEND
2012-10-02 23:17:12 DROP TCP 173.194.35.47 151.38.152.75 443 49995 101 AP 724580680 204190435 17152 - - - RECEIVE
2012-10-02 23:17:14 DROP TCP 173.194.35.47 151.38.152.75 443 49995 101 AP 724580680 204190435 17152 - - - RECEIVE
2012-10-02 23:17:17 DROP TCP 50.22.231.36 151.38.152.75 443 55733 85 FAP 1022594177 1622703293 512 - - - RECEIVE
2012-10-02 23:17:18 DROP TCP 173.194.35.47 151.38.152.75 443 49995 101 AP 724580680 204190435 17152 - - - RECEIVE
2012-10-02 23:17:21 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE
2012-10-02 23:17:31 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE
2012-10-02 23:17:41 DROP TCP 173.194.70.95 151.38.152.75 443 49993 101 AP 4193004261 2008987952 17152 - - - RECEIVE

allego il log delle connessioni pfirewall.log