i kepe getting these backdoor/subseven trojan intruson attemp warnings in my nortot firewall i block each IP as they come in. am i wasting my time doing this? will they always try to get to me on anther IP? or will there come a point where i will have blocked all their IP addresses

Why not just set NIS so it can do its job, and not notify you. Very seldom can you can anything about the intrusion notification.

"or will there come a point where i will have blocked all their IP addresses[?]" Don't worry about that. Don't block by IP unless you have too. Instead make a rule. It should say something like this: Block all incoming traffic on ports 1-65,535 via UDP and ICMP. And another for blocking all incoming traffic on all TCP ports except(!) ports 80 (HTTP), 443 (HTTPS), 25 (SMTP), and whatever else you tend to use.

Or do it the quite way, with a router with built-in inbound firewall. That way they never get to your system and slow it down looking at all the port requests.

Just remember, that no port can be opened from the outside of the Operating System, but only from the inside, and by a program that is authorized to use it, that is if you're security firewall is set correctly. And , NO ports should open at all. Run a port scan at www.grc.com To receive http traffic, port 80 does not need to be open, as the the open part applies to outgoing, not incoming.