Could you guys please explain to me (in layman's terms!) what a proxy server is? I have AOL and the majority of inbound events logged by my McAfee firewall come from nstot.proxy.aol.com. I have researched it, but don't really understand what the heck it has to do with me, or why I'm involved in this proxy set-up! (I'm just a home PC user)

Up until recently, it hasn't really been a problem, but the last couple days I've discovered numerous events like these: "A computer at ACA23E40.ipt.aol has sent an invalid packet to your computer" and "a computer at c-67-184-33-22.hsd1.il.comcast.net has sent an invalid packet" (that was an ICMP Ping which traces back to AOL) And just now, when I logged on, that proxy address "apparently attemped to scan your system by sending a large amount of various UDP packets". I've never noticed this packet thing going on before. (I don't get what a packet is, and why are they sending them to me?!)

I've also discovered a couple Trojans recently "attempting an unsolicited connection" from that proxy address, and in fact one was quarantined the other day. (which has never happened before). And don't know if it's related, but there's been a marked increase in a Socks program (traced back to China) attempting to access TCP Port 1080. But apparently my firewall seems to be doing its' job?

Should I be worried? The only difference I can see in my computer's operation is that I get "hung up" and end up having to log off 'cuz I'm "stuck", which seems to correspond with when those packets are coming through. (but I have dial up so I'm used to that sort of thing!)

Sorry this is so long or if I'm not explaining things correctly, but ''inquiring minds want to know" and this is all foreign to me!

Thanks for enlightening me!

A proxy server is just a way of accessing the internet through a different IP address, other than your "true" or "real" IP address. For example, you could live in the UK where your IP would range from about 80. something to 86. something.

Using a proxy you could connect to the internet through an American IP address and have a different range.

Your problem sounds unusual. It could be a setting in your firewall or just a bad firewall which is giving you all this hassle. You might want to try a different firewall to rule that out. For example, bad firewalls are things like ZoneAlarm.

I don't have AOL so I don't know what nstot is or why AOL would be scanning your ports. I did find this:

microsoft.public.security: Re: AOL Servers Probing ???

Which doesn't give answers but just shows other people having the same problem. If it really bothers you, phone AOL and ask them why they are scanning your ports and what nstot really is.

However, I don't think you should be worried. The trojan was probably a false alarm, assuming it did actually originate from aol.com. It would be bizarre for an ISP to be maliciously attacking or harming its own users.

My guess is nstot is trying to collect data on AOL users? Not sure.

My tip is to either set your firewall to be less strict or set it to not show alerts at "infiltrations."

Also make sure Windows Firewall is turned off and you only have one firewall running.

Thanks for the info -- your tip about setting the firewall to be less strict was probably the key, 'cuz I had recently set it to "stealth", thinking that would help. (apparently not, huh?!)

Just FYI, when I go to "What Is My IP Address.com" this is what I get (although the last two groups of numbers change from time to time):

Proxy Server Detected!
Proxy Server IP address: 205.188.116.65Proxy Server Details: HTTP/1.1 (Velocity/3.1.1.5 [uScMs f p eN:t cCMp s ]), HTTP/1.1 spider-dtc-td04.proxy.aol.com[CDBC7064] (Prism/1.2.1), HTTP/1.1 cache-dtc-ab01.proxy.aol.com[CDBC7441] (Traffic-Server/6.1.5 [uScM])

IP205.188.116.134 rDNS TRUE WIMIA Test TRUE TOR TestFALSE Loc Test FALSE Header Test TRUE DNSBL Test FALSE

(all Greek to me!)

As for the Trojans, the "Source IP" is 205.188.143.145 (look familiar?) and the "Host Name" is that nstot proxy aol address. There's been a Psyber Stream Server Trojan (UDP Port 1170), Voo Doo Doll (UDP 1245), Rasmin (UDP 1045), and Xtreme (UDP 1090) all scanning my computer, but the firewall blocked them.

And does Windows 2000 even have a firewall? I've read conflicting articles, but in any case, it doesn't sound like something I should be messing with!

Anyway, thanks again for the insight -- it's so nice to have y'all to come to!

Is it only you that uses the computer or do other people have access to it? That is strange. Someone has set it up to connect via proxy. People usually do this at work or school to access more "adult" sites that are usually blocked on the local IP. By using a proxy they are bypassing the restrictions which only apply to the actual local IP address. Potentially its also an infringement of company laws and protocol.

Anyway in order to change it back to the connection it should be (which is usually faster - have you noticed the internet go slower)?

On Firefox:

Tools > Options > Advanced > Network > Settings and choose Direct Connection To The Internet.

On Internet Explorer:

Tools > Internet Options > Connections > LAN Settings (near the bottom) and choose Automatically Detect Settings.

Now, it could be that those settings are already in place in both browsers but I doubt it. This is extremely strange behaviour but maybe that's how dialup is done these days?

If the settings listed above are already in place then that means your connection is working as normal, or as AOL intends it to. I should add I'm not familiar with AOL but it just seems strange. If the settings on your browser are set to Automatic then don't panic.

You might also need to go to Network Connections and set your IP address and DNS servers to Automatic. PS Line breaks aren't showing up in my posts! I had to use /br/br tags...

Ok, first things first -- I'm the only user of this home-based PC. As you suggested, I changed my IE LAN option (it was unchecked); the Network Connections were already set at Automatic, and I put my firewall back to Trusting (outbound only -- the default setting) vs Stealth, but nothing changed -- I still have an AOL proxy address, and there's been an interesting increase in a UDP Port Scan from that nstot address that "attempted to scan your system by sending a large amount of various UDP packets"? (like 7 times in 1 second!)

Since I'm a puzzle-solver; new to, and intrigued by, this whole aspect of "computer-ing", I did some exploring, and it does seem to be an AOL thing. Although I feel silly providing links to you, I found these sites that seem to delve into the AOL proxy subject, but I still don't get it. Maybe they'll help you (a non-AOL user) explain it to me. ('cuz aren't you curious, too?)

This came from a site for webmasters on how to handle AOL proxies?

http://webmaster.info.aol.com/proxyinfo.html

This site (although a couple years old) I think explains it best, but like I said, I still don't quite "get it"! (the Reston, VA data center they refer to is where my address traces back to.)

http://forum.statcounter.com/vb/archive/index.php/t-19835.html

And this one makes me think twice about having AOL as my ISP!

http://anti-aol.livejournal.com/68433.html


P.S. Don't know what's up with the page break thing -- am I supposed to click on something/format something/set something?