Printable View
I have Norton firewall installed on my machine and for the past three days I have been under constant attack every five minutes from someone using the soket de trois trojan.
The IP address changes but seems to emanate from a city in South Carolina, I have tried to find ISP by IP but was unable to match up.
This is getting old now and I was wondering if someone could help me to stop this happening.
Thanks for any help!
Greetings:
The only reason that it's "getting old now", is because you keep looking at your logs. Set it up so you're not being actively notified on attempts, and just ignore your firewall, knowing that it's doing what it's supposed to do.
Any computer connected to the internet these days will be hammered non-stop by some worm or another. Don't waste your time trying to "deal" with them.
Thankyou
It's not sockets de troie! The rise in probes on port 5000 are contributed to the appearance of 2 new worms. These are Bobax and Kibuv. See my thread here.
I'm running win 98, my firewall is detecting and blocking these attacks, I'm assuming that they are not getting through........
hmm..yeah port 5000 has reportedly been taking a hit on a lot of computers,I assumed it was either someone checking for the trojan or some kind of worm..thnx SirDice
How exactly are you going about trying to find the ISP?
Port 5000 eh? I'll have to check that port on my firewall, any idea's on what this port's purpose is?
The port used for "Universal Plug and Play" in Windows XP.
Cheers:
Not being hit on any of my machine's, but then again none of mine are XP. What firewall are you using? And you said your runnig Win98 (which I have on one of my boxes) and your getting probed. If your saying your firewall is blocking access to the port and is stopping the attack, you have nothing to worry about. You will always be probed for various port's all the time, some more than other's though.
To the Duck:
This site can help find someones ISP through IP, just type in the ip in the box and click submit, it should also come up with an email address for the isp.
http://network-tools.com/default.asp?
there is also the ARIN Whois database to look up who owns an IP
http://www.arin.net/whois/index.html
ARIN also gives you contact info for ISP Whois to drill down within the larger ISPs to find out which client owns/uses that IP addy.
ARIN and tracert in the command prompt works like a charm. For a more in dept look at the whole process just look at my tutorial, not the best tutorial, but it will get the info accross