<p dir="ltr"><br>
On Nov 1, 2013 11:26 AM, "Rick Troth" <<a href="mailto:rmt@casita.net">rmt@casita.net</a>> wrote:</p>
<p dir="ltr">> Then I happened to notice an unexpected TCP connection. It traced back to TeamViewer (their servers). Not good! I found the TV processes running, killed them, removed the files, and deleted the package. (Less emotion might have left more stuff for forensics, but I do have a backup of some of that.) <br>
></p>
<p dir="ltr">I think you will find this connection is used so that TeamViewer can act as a tunnel broker between two users. This allows one to be able to connect to a remote machine without having to worry about the firewalls in between. You might be interested in the "Creation of a Session and Types of Connections" section of <a href="http://www.teamviewer.com/images/pdf/TeamViewer_SecurityStatement.pdf">http://www.teamviewer.com/images/pdf/TeamViewer_SecurityStatement.pdf</a> .</p>
<p dir="ltr">Convenient for the busy tech support provider as well as the busy bad guy. <br>
</p>