DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

2820n

  • jamman
  • Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
12 Dec 2011 12:57 #70438 by jamman
2820n was created by jamman
Hi all,

We were getting the following message every 30 minutes or so :
"You have reached the maximum number of permitted Internet sessions.
Please close one or more applications to allow furthur Internet access.
Contact your system administrator for further information."

Restarting the router resolved the issue for a short while, but always returned. Couldnt see anything causing it on the firewall and it wasnt set to have a maximum amount.

I then ran Sophos scan on the server which found nothing, so installed Malwarebytes and ran a scan, again nothing found.

However the issue has now stopped but MWB is blocking dns.exe from contacting the outside world on a regular basis which to me suggests that it is blocking what was causing the message to appear.

The protection logs shows :
10:31:28 Administrator IP-BLOCK 194.85.61.20 (Type: outgoing, Port: 54850, Process: dns.exe)
10:53:28 Administrator IP-BLOCK 77.221.130.250 (Type: outgoing, Port: 54289, Process: dns.exe)
11:02:16 Administrator IP-BLOCK 82.146.43.2 (Type: outgoing, Port: 54217, Process: dns.exe)
11:02:24 Administrator IP-BLOCK 82.146.55.155 (Type: outgoing, Port: 53412, Process: dns.exe)
11:02:24 Administrator IP-BLOCK 82.146.43.2 (Type: outgoing, Port: 53412, Process: dns.exe)
11:02:24 Administrator IP-BLOCK 82.146.55.155 (Type: outgoing, Port: 53412, Process: dns.exe)
11:29:11 Administrator IP-BLOCK 77.221.130.250 (Type: outgoing, Port: 53103, Process: dns.exe)

Any ideas what it is blocking and whether this looks like a DNS hijack ? As I say, since MWB has been running the issue hasnt affected users, and I assume if I disable the MWB protection it will. However MWB isnt actually detecting anything when it scans ?

Ive checked the draytek and it sessions limit is disabled ?

Please Log in or Create an account to join the conversation.

More
12 Dec 2011 17:06 #70444 by pcsupport
Replied by pcsupport on topic Re: 2820n
I'm not to sure what is causing your problem HOWEVER... those IP addresses are all Russian.

Have you ran Hitman Pro on your machine?

www.pc-support.uk.com

Please Log in or Create an account to join the conversation.

Moderators: ChrisSami