Worm in Intelllij distribution ?

Environment :
IntelliJ 4.5.3 build 2250
OS Windows XP
Norton Antivirus fully updated

During startup up of IntelliJ Norton Antivirus Worm Protection detects and stops idea.exe trying to open ports 6969 and 6970 for TCP traffic.

These ports are known to be used by a number of Trojan Horses.

Scanning my complete system using Norton Antivirus no infected files are detected.

Question :

Is the port opening intentional from IntelliJ and in this case to what purpose or do I have compromised installation of IntelliJ ?

5 comments

Hello Geir,

GO> Question :
GO>
GO> Is the port opening intentional from IntelliJ and in this case to
GO> what purpose or do I have compromised installation of IntelliJ ?
GO>

It ports are using in IDEA core and it a normal :) Just setup your firewall.

Thanks!
--
Alexey Efimov, Java Developer
Tops BI
http://www.topsbi.ru

0

Geir Ovsttun wrote:

Is the port opening intentional from IntelliJ and in this case to
what purpose or do I have compromised installation of IntelliJ ?


Further to what Alexey said, the port opening is part of IntelliJ's
security/licence checking routines.

0

Does this tell I will not be able to install and use it without a connection to the internet?

0

It does not connect to the internet, the license check is just a broadcast
in the local network.

Tom

0

Mark Derricutt wrote:

Geir Ovsttun wrote:

>> Is the port opening intentional from IntelliJ and in this case to
>> what purpose or do I have compromised installation of IntelliJ ?


Further to what Alexey said, the port opening is part of IntelliJ's
security/licence checking routines.


I'm fairly certain that those ports are not for the license checking
routines, but probably for checking that only one instance is using the
system and config folders, so there are no file concurrency problems.

--
Rob Harwood
Software Developer
JetBrains Inc.
http://www.jetbrains.com
"Develop with pleasure!"

0

Please sign in to leave a comment.