How well protected are you?

[ThePreacher]

I failed all over the place. Port 22, 54, 80, 443. God what should I do?

[trinity7]

I am running Windows 98. I have McAfee Virus protection, McAfee Cleaner, McAfee firewall, and Zone Alarm Pro. I have a hard disk pass word and one user name for windows.

I use AOL as my ISP and then I tried Anonymizer.com.

I reformatted the hard drive and reinstalled everything fresh and he still got in.

He did initially have physical access to my computer but now he doesn't.

I tried to configure everything properly.

This guy hacks into my computer no matter what I do.

What can I do to keep him out?

[trinity7]

I am running Windows 98. I have McAfee Virus protection, McAfee Cleaner, McAfee firewall, and Zone Alarm Pro. I have a hard disk pass word and one user name for windows.

I use AOL as my ISP and then I tried Anonymizer.com.

I reformatted the hard drive and reinstalled everything fresh and he still got in.

He did initially have physical access to my computer but now he doesn't.

I tried to configure everything properly.

This guy hacks into my computer no matter what I do.

What can I do to keep him out?

[!mitationRust]

I have always used NMAP from a remote loacation to do my security test. Its the only tool I really trust.

[Tim_axe]

trinity7 - You should probably ask this question in Newbie Security Questions -> http://www.antionline.com/newthread....ead&forumid=56 - I even linked it to start a new thread. Anways, after your clean format, you needed to get all of the updates with Windows Update and you will at the least be much better off, or make it a little harder. To prevent him from hacking your PC, just get a firewall (like Tiny, or any others mentioned) and block his computer from connecting to yours, and block ports that ShieldsUp! says you have open. And using a proxy won't really help you against hack attacks or viruses, since they are made for a different reason...


Personally I don't have too much use for a website that scans for ports that I have open (special case: running a web server - see sig), but I do not question their good (since they are great) for people who are learning about computer security. It makes learning much more personal when you see that you are open. I know which ports I have open, since my router is setup to redirect/forward those ports to my server on my LAN, so stuff like nessus is much better since there are ports that I *must* have open, since nessus not only finds out what is open, but can be configued to attack those ports and tell you what vulnerabilities you need to deal with. Sort of a level up once you've decided that you understand ports and the programs that use them well enough that you know that you want to have one or two open.

ThePreacher - You don't happen to be running your own HTTP/HTTPS and SSH and DNS server on your machine do you? If not..., it could be the way your ISP (or work place, if at work) is setup... If it is your ISP, either they are very limited in IP addresses (Having their own servers & end user IP the same one), or something... I don't know for sure if it is good (or bad) to have all of that under a single IP address setup the way I described it, so I sort of hope they did that on purpose, or there are some advantage to it... Then again, it could be a proxy they run (and you use), or just something they deal with at their router(s)...

[TheTempest]

odd,

this may sound stupid, but...

i ran shields up, and every port, except 113 (which was closed) came back as stealthed???

I'm a bit confused, because i'm behind a router (only game ports are open) and zonealarm (only IE and games are allowed)...

it says i failed because i responed to a ping? How do i correct that, i was under the impression that ZA would block pings.

Thanks

[ThePreacher]

Originally posted here by Tim_axe
ThePreacher - You don't happen to be running your own HTTP/HTTPS and SSH and DNS server on your machine do you? If not..., it could be the way your ISP (or work place, if at work) is setup... If it is your ISP, either they are very limited in IP addresses (Having their own servers & end user IP the same one), or something... I don't know for sure if it is good (or bad) to have all of that under a single IP address setup the way I described it, so I sort of hope they did that on purpose, or there are some advantage to it... Then again, it could be a proxy they run (and you use), or just something they deal with at their router(s)... [/B]

Im sorry my sarcastic side takes over at times. Yes I do indeed run all the services you listed. These were the only ports open on my computer thanks to shorewall.

[pak]

TheTempest> Your router was probably responding to those probes and not ZA. You will need to see in your routers doc if you can connect to the routers interface and enable SPI or port forwarding (for TCP 113 not ICMP) to show 'stealth'.

[JagFire19]

Hmmm....this is wierd! With and without my firewall I have recieved the same response:

Your system has achieved a perfect "TruStealth" rating. Not a single packet — solicited or otherwise — was received from your system as a result of our security probing tests. Your system ignored and refused to reply to repeated Pings (ICMP Echo Requests). From the standpoint of the passing probes of any hacker, this machine does not exist on the Internet. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system wisely remained silent in every way. Very nice.
GRC Port Authority Report created on UTC: 2004-01-02 at 02:26:25

Results from scan of ports: 0-1055

0 Ports Open
0 Ports Closed
1056 Ports Stealth
---------------------
1056 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: PASSED - ALL tested ports were STEALTH,
- NO unsolicited packets were received,
- NO Ping reply (ICMP Echo) was received.

I think maybe my router has another firewall that can only be turned off when the router is shut down. I'm not sure about this though because one should be able to administer the settings of any firewall from the OS. Any ideas?!

[pak]

Find the LAN side IP address of the gateway and make it a url like http://192.168.1.1
Then from your browser you should be able to configure it. Your routers documentaion will say what it supports.