Computing.Net > Forums > Security and Virus > Port Scans

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Port Scans

Reply to Message Icon

Name: tim ccs
Date: April 13, 2004 at 16:31:54 Pacific
OS: win xp pro
CPU/Ram: amd ath xp 2600+
Comment:

I Keep getting my ports scanned! sometimes its my isp which has never happened before but today its something else here is my sygate log...
Somebody is scanning your computer.
Your computer's TCP ports:
2745, 1025, 6129, 3127 and 80 have been scanned from 66.73.198.192.
AND THIS ONE NOW!!!!!!!
Denial of Service "Smurf" attack detected.
Description:
A Smurf attack occurs when a hacker spoofs your system's IP address and then broadcasts a ping request to several subnets. The resulting deluge of ping responses ties up your system as well as the various network subnets pinged.

Help
this latest one does not come back with any info to report the attack
Tim



Sponsored Link
Ads by Google

Response Number 1
Name: murve
Date: April 13, 2004 at 20:31:54 Pacific
Reply:

hi tim,
i'll get to the point> get a router.
it will add another layer of protection to your system.
all the best,
murve


0

Response Number 2
Name: murve
Date: April 13, 2004 at 20:39:11 Pacific
Reply:

hi tim,
more info, you may have the my doom worm on your port 3127, and on 6129, you may be intruded by possibly by a website called www.dameware.de
hope this helps,
murve


0

Response Number 3
Name: bbqbeef
Date: April 13, 2004 at 21:01:38 Pacific
Reply:

the ISP scans you to be sure you are not running services that can be dangerous (email server for example).

getting a hardware router/firewall is a great idea.


0

Response Number 4
Name: Rambler
Date: April 14, 2004 at 03:11:18 Pacific
Reply:

Just about everyone on broadband gets port scans. 99% are worms and trojans. It's a well-known myth that ISPs scan you to see if you're running a webserver etc. They don't need to, as their routers can log traffic and filter logs to report on such connections (if they ever do that either). What people are seeing is a scan from an address on their subnet, i.e. where the first three numbers of the IP are the same as theirs. Again, this'll be a worm or trojan, as they will usually start with a scan of addresses on the subnet the infected PC is on.

Expert: someone who reads the manual when no-one's looking


0

Response Number 5
Name: bbqbeef
Date: April 14, 2004 at 15:23:14 Pacific
Reply:

not a myth. RoadRunner says on their home page that they reserve the right to scan any customer looking for whatever. I think the name in my log is customerscan.rr.com


0

Related Posts

See More



Response Number 6
Name: Rambler
Date: April 15, 2004 at 00:25:43 Pacific
Reply:

Some do - most of what people believe are ISP scans are virus/trojan scans from similar addresses, as I said. Most ISPs don't bother because they know that such scans are easily blocked with a firewall.


0

Response Number 7
Name: bbqbeef
Date: April 15, 2004 at 19:31:31 Pacific
Reply:

If some ISPs scan, then it isn't a myth.

customerscan.sec.rr.com scanned me today.
sec stands for security. I am happy to see them do it.

They are looking for people who are infected & unknowingly run mailservers (SMTP) or other problem software. too many people don't have firewalls.


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Port Scans

Port Scanning www.computing.net/answers/security/port-scanning/11426.html

NIS 2007 Not Warning of Port Scan www.computing.net/answers/security/nis-2007-not-warning-of-port-scan/20428.html

port scan attack www.computing.net/answers/security/port-scan-attack/9049.html