Printable View
I need to know how you close a port. I know its open because i got it scanned and so on.....I want it shut. Even after re-formatting it is still open. Is this normal? Also i have reinstalled my firewall and it has been blocking a certin someone every ten mins. I have the ip address and the port # . What can i do with this info? I want them to know I know they are the buggers that have been skrewing up my system. :confused:
Well what OS are you running? What firewall are you using? port number? Start with these and I'll try to help.
Quote:
Originally posted here by mellissa
I need to know how you close a port. I know its open because i got it scanned and so on.....I want it shut. Even after re-formatting it is still open. Is this normal? Also i have reinstalled my firewall and it has been blocking a certin someone every ten mins. I have the ip address and the port # . What can i do with this info? I want them to know I know they are the buggers that have been skrewing up my system. :confused:
Hey. Which port are you talking about? If your firewall is working like it's supposed to all your ports should be "stealthed," that is, they won't show up at all. That is, unless you're running some kind of server on your computer. Who did the scan? Did you scan your own computer or did you have a friend do it, or one of the free scans on the internet? As far as finding out who the person is, I think the best you might be able to do is get "Sam Spade" or use some other tool to do a "Whois" look up on the IP address. Hopefully it will give you the person's service provider and you can complain to them. You can download Sam Spade off the internet. Just put "Sam Spade" in a search engine and you can find their site.
To close a certain port you have to know what service is running on it and then close the service. Ex: If port 6667 (irc) is open then to close it you simply exit mIRC or what ever client your using. With some firewalls, like agnitium, you can specify how long you want to block a certain IP or even the whole subnet from your computer.
Remote_Access_
If you are running Win2K/XP, there is always the net send command to let them know you know... ie net send <their ip addy> <message>
or something along those lines, I don't use 2k/XP, just remember watching the command on TechTV last night, and it was kinda cool. They have to have port 139 open on their computer for it to work though.....
Don't worry about it too much as of yet...most 'scans' that occur are just general internet 'noise', especially if it is directed at your HTTP port (80). If it happens every ten minutes, I'd guess that it's your ISP checking your connection status (this is especially true of dial-up connections).
But your firewall(if configured properly) should probably stealth your connection on all ports...I'd be more concerned about that. You might want to go to http://grc.com/default.htm and use his ShieldsUp features to test your security.
Ouroboros
edit your conf files to not allow this svc and kill, restart your inetd. (if that is the related one)
Tell us more.
If you want to verify your ports are stealth or not visit www.pcflank.com run there standard test
the stealth and advanced tests to make sure your firewall is blocking everything.
Chawley
Some people have NetBEUI enabled by default in their dail up connection or network settings in win 98 for example.
Disabling that would be a start.
good point Focmaester. That's always good to check.
You guys are good. Without knowing anything about that comp, OS,security measures and everything else, you guys are telling how to close ports......hmmmmm.
Who's been handing out the ESP pills again? j/k
;)
This is a very interesting thread to me...I just installed a firewall (Zone Alarm) last night, and have noticed that a LOT of the stuff it's blocking is people trying to connect to port 6346. It's not letting anyone in, so I'm not too concerned, but I have been going to a WHOIS site and checking the IP addresses. So far it's just "internet noise" as far as I can tell, but it has been a real eye-opener for me as to what is going on behind the scenes.
You mean these ESP pills aren't good? Damn I bought a whole bunch. :)
Lissa,
It's Matt. to close an open port you have to close the program that's holding the port open. The bad part can be FINDING what programs are holding what ports open...I believe there's a program call TCPView Pro than can do this. I think you can download a trail version of it :)
I have try'd all the scans again today it is now saying it is all in stealth mode!!!!!!!
Yesterday it wasn't...hhhmm. Yesterday when i re-loaded all that i had into my comp it was all in order.Windows 98 all ready to go, i had it divided into 6 drives to save what I in the event of this happening again. I have a 20 gig hard drive with maximum space left (over 80%)
It is gone!!!!!!!!!!!!!!!!!!!!!!!!!!! It now reads that I have a 4.5 gig, all of the extra drives are gone to!!!!!!!!!D, E and F ARE GONE .My hard drive is Gone! Ihave already try'd the reboot disk and so many things I cant get any of it back! Can I even get it back? Some body has my ISp # I' bet and they are getting off on skrewing me around. All that work is gone WHAT DO I DO? Any body have a clue?cause I don't .
OS iswin 98 , I am using norton firewall and anti virus, I have ad-aware on the ball and Swat-it! Where's my hard drive?
If all else fails, try the magical cure, DUCT TAPE.....That stuff works like you wouldn't believe. Hey, if it works on a leaky faucet or a rusted out car door, or a broken chair, you never know right?
I'll just slap it all over my tower and whammo.....no more problems :P
Update
The little kiddie that Trojaned Mellissa has taken to portscanning her now. I traced him down to a Polish ISP. Mellissa's haing her IP rotated tomorrow so this kiddie will not be a problem much longer :)
:3pow: Script Kiddies