Computing.Net > Forums > Security and Virus > Internet intruder

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Internet intruder

Reply to Message Icon

Original Message
Name: paterson
Date: June 19, 2005 at 10:16:09 Pacific
Subject: Internet intruder
OS: windows 2000
CPU/Ram: pentium4
Comment:

Hello,
I just reformatted my HD and installed windows 2000 with service pack 4. When I connect to the Internet, it's really slow. I don't know what background program is using the connection although it's a fresh copy of the operating system. Then I install the firewall program ZoneAlarm and I get those internet alerts every half-minute or so:


The firewall has blocked Internet access to your computer (UDP Port 1026) from 205.126.49.30 (UDP Port 20838).

The firewall has blocked Internet access to your computer (TCP Port 135) from 67.71.21.228 (TCP Port 2406) [TCP Flags: S].

The firewall has blocked Internet access to your computer (TCP Port 135) from 67.70.86.153 (TCP Port 4265) [TCP Flags: S].

The firewall has blocked Internet access to your computer (TCP Port 4899) from 218.58.56.186 (TCP Port 20995) [TCP Flags: S].

Where does those intrusion attempts come from? Before the reinstallation of windows 2000, I didn't have that problem. I did install all the windows security update.
Any help would be appreciated.


Report Offensive Message For Removal


Response Number 1
Name: Derek
Date: June 19, 2005 at 17:44:24 Pacific
Reply: (edit)

You can type the IP's in here to find where they come from (eg 205.126.49.30):

ARIN's WHO IS

It's a long time since I used ZA. If you are getting frequent alerts that mean you have to "take action" then I agree it is a problem.

If it is just the "attempts" showing in your ZA log then forget it. It is just ZA doing what it was installed to do. Often they are minor trawls. You get stacks of them.

DerekW


Report Offensive Follow Up For Removal

Response Number 2
Name: Rimfire
Date: June 20, 2005 at 01:49:41 Pacific
Reply: (edit)

AS the IP address varies I would not be concerned. A full on attack would involve hundreds of messages with the same IP.

Just like you did the first time you installed ZA. Place a checkmark in the don't bother me again box.


Report Offensive Follow Up For Removal







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home








Do you own an iPhone?

Yes
No, but soon
No


View Results

Poll Finishes In 6 Days.
Discuss in The Lounge
Poll History




Data Recovery Software