TeamViewer Forum
General Category => Teamviewer for Windows => Topic started by: elseesea on March 03, 2011, 09:56:31 PM
-
Situation:
1. TeamViewer is installed on my PC, and TeamViewer has been working fine for a few months.
2. For various reasons, I decided to see what IP connections from what software on my PC was active.
3. After turning on my computer and waiting a few minutes, without using TeamViewer to make any connections, I see that TeamViewer_Service.exe has established a connection to c033.otol.uic.edu:5938. I discovered this information by running "netstat -a -b" from Windows command line. I have nothing to do with uic.edu.
4. After restarting my computer, I notice similar problems, now with a connection instead to server505.teamviewer.com:5938. Now this URL makes more sense than the connection to uic.edu.
5. UPDATE: After waiting for about 30 minutes, again not having invoked TeamViewer since turning on the computer, the teamviewer.com connection was replaced by a connection to d14-69-215-248.try.wideopenwest.com:5938. I don't know who wideopenwest.com is.
6. UPDATE 2: After waiting overnight, the connection was replaced to 208-79-111-232.static.airenetworks.com:5938, and then to 68-179-167-92.bsr-c10-d0.evv.dhcp.sigecom.net:5938 later.
What's the explanation? Is TeamViewer using our systems for something nefarious?
-
This is interesting and scary. I recently installed the TeamViewer host on my laptop.
When I finished I looked at the log file. The last entry was the last configuration thing I did. I let the computer sit for a few hours and then came back to look at the log. It had grown many many more lines. I found 3 different TeamViewer id numbers (###-###-###) that had apparently tried to get into my system. Also found a couple of IP addresses.
I really don't have a lot of confidence in the security of this program.