I was running as Power User in W2K and was preparing to shut down for the day when i noticed a lot of activity on my communications meter. Even though all my browsers were closed, there was a lot of data leaving my computer. I ran netstat, here is a tiny sample of the first netstat run:

Proto Local Address Foreign Address State
TCP local:2302 175.211.228.122:http SYN_SENT
TCP local:2303 32.214.3.193:http SYN_SENT
TCP local:2305 103.44.69.54:http SYN_SENT
TCP local:2306 215.156.109.25:http SYN_SENT
TCP local:2307 42.125.64.68:http SYN_SENT
TCP local:2308 22.49.241.145:http SYN_SENT
TCP local:2309 4.118.141.182:http SYN_SENT
TCP local:2310 103.94.248.146:http SYN_SENT
TCP local:2311 148.63.65.31:http SYN_SENT
TCP local:2312 126.111.60.135:http SYN_SENT
TCP local:2313 19.17.233.166:http SYN_SENT
TCP local:2314 139.169.124.80:http SYN_SENT
etc etc etc

Some of these foreign addresses are Department of Defense, NASA, and Ford Motor Company. What the heck???

I shut down, rebooted into W2K as Admin, and right away it started again, netstat showing more consecutive ports being SYN_SENT to weird foreign addresses.

I ran PestPatrol and HouseCall online AV, nothing detected.

I found the following definition: "SYN-SENT - represents waiting for a matching connection request after having sent a connection request."

What's happening here? Is my computer trying to talk to NASA or The Defense Department?


Thanks,

jm