Author Topic: Idling TeamViewer_Service connected to unknown PC!  (Read 13263 times)

elseesea

  • Newbie
  • *
  • Posts: 1
Idling TeamViewer_Service connected to unknown PC!
« on: March 03, 2011, 09:56:31 PM »
Situation:
1. TeamViewer is installed on my PC, and TeamViewer has been working fine for a few months.
2. For various reasons, I decided to see what IP connections from what software on my PC was active.
3. After turning on my computer and waiting a few minutes, without using TeamViewer to make any connections, I see that TeamViewer_Service.exe has established a connection to c033.otol.uic.edu:5938. I discovered this information by running "netstat -a -b" from Windows command line. I have nothing to do with uic.edu.
4. After restarting my computer, I notice similar problems, now with a connection instead to server505.teamviewer.com:5938. Now this URL makes more sense than the connection to uic.edu.
5. UPDATE: After waiting for about 30 minutes, again not having invoked TeamViewer since turning on the computer, the teamviewer.com connection was replaced by a connection to d14-69-215-248.try.wideopenwest.com:5938. I don't know who wideopenwest.com is.
6. UPDATE 2: After waiting overnight, the connection was replaced to 208-79-111-232.static.airenetworks.com:5938, and then to 68-179-167-92.bsr-c10-d0.evv.dhcp.sigecom.net:5938 later.

What's the explanation? Is TeamViewer using our systems for something nefarious?
« Last Edit: March 04, 2011, 10:34:48 AM by elseesea »

MrData

  • Guest
Re: Idling TeamViewer_Service connected to unknown PC!
« Reply #1 on: March 09, 2011, 12:11:40 PM »
This is interesting and scary.   I recently installed the TeamViewer host on my laptop.
When I finished I looked at the log file.  The last entry was the last configuration thing I did.   I let the computer sit for a few hours and then came back to look at the log.   It had grown many many more lines.  I found 3 different TeamViewer id numbers (###-###-###) that had apparently tried to get into my system.  Also found a couple of IP addresses. 
I really don't have a lot of confidence in the security of this program.