Printable View
My firewall keeps alerting me that the same IP address is trying to connect to my computer on a variety of different port numbers. I renewed my dynamic IP address several times and the person keeps finding me. What should I do? Somebody please help.
Several times a minute I get these messages.
"ZoneAlarm blocked traffic to port 3675 on your machine from port 61873 on a remote computer whose IP address is 80.138.209.79."
Have you been giving your IP out to people you dont know because that could be bad.
Interesting. You could file a complaint with the provider. Sam Spade is good for this kind of thing. And if you are ever wondering what the attacker is going after you can check the IANA's Port list
http://www.samspade.org/t/lookat?a=80.138.209.79
BTW, are you by any chance running kazaa, eDonkey or other P2P software?
I tracert the IP and it leads to a ISP in Vienna. Have used KAzaa but it is not running on my comupter.
p508AD14F.dip.t-dialin.net is the account that ip is pointing to. get fport from foundstone.com and run it. look to see what's keep that local port open or if its opened at all. if something that you dont recognise is listening on that port you should run theCleaner which can be gotten from moosoft.com. it wouldn't hurt to do this anyway and keep your virus definitions up to date
does any one know wot 35072 is used for...my router log's are Full of it....oh well...
I think it's just a vuln. scan from rooters.
- Noia
Are you completely sure you're running *NOTHING* that could be making any connections there? That includes spyware and adware?
Bear in mind that this high port number is not a well-known port, no attacker would reasonably attack that port number unless they had either planted a trojan there, or were scanning a lot of ports (which presumably would show up on your log)
Bear in mind that this person doesn't necesssarily know your IP; they may just be scanning the same range repeatedly and hitting whatever IP you're using that day.
Is it TCP or UDP? Is that port actually open? If so, what program is holding it open?
This site might also give you a little help in finding what part of the world and city he or she lives in
http://visualroute.visualware.com/ that should help a little bit
Do all of the above mentioned, and d/l a packet sniffer and log the packets and see exactly what it is that is transpiring. For someone to continually find your dynamic ip is extremely unlikely. Were that true then pretty guaranteed your have been trojaned. If not then as mentioned you are possibly seeing the ill effects of having run a p2p app.
if i trojaned someones box i would have to be pretty stupid to keep tring to reach it if after the first couple of times i failed because a fw was blocking the connection. your saying this happens repeatedly several times a min. no matter what ip your provider supplies you with. this is obviously some mindless automated device. is your fw configured to allow all outgoing packets or just selected ones?
try removing all the rules you've created in ZA and set it to ask you for permission for each connection attempt both incoming and outgoing. see if something on your machine is making repeated requests to that ip addy
im a newb but perhaps you have something on your system that reports your ip to his
I may be wrong and correct me if I am.
first-- update your anti virus and firewall
Second-- If you have pestpatrol which comes with zonealarm for free update it and run it, you might be get the problem fixed.
I am agreed with Tedob 1 solution.
It could be a trojan alerting this "person" each time your computer logs on. You may want to check your system for a trojan, and consider a IDS of some sort. The computer is going through a service in Berlin and then on into the Netherlands when I reach it. The packets drop when they reach the IP, but that's where I have it coming from.
lol dats the meaning of dynamic IP its doesnt change yur IP so its not dat hard to find you...
try to reinstall your LAN or DSL CABLE WAT EVER YUR USING so it can give u another dynamic IP
peace
Actually Dynamic means its changeable. A static IP is an IP that always is the same. Its like routers . A static router can only use the routes you tell it to while a dynamic router can learn routes, take the shortest route, least clogged route ect.. OSPF type routing.
not to be hitting on the obvious, or offending anyone, but keep in mind that after you install kazaa, it wants to start automatically, and will run automatically, unless you tell it not to. Even if you are not downloading anything. Best bet, restart the computer, and get online, and don't do anything. just sit there. get in comand prompt and type NETSTAT and see if he pops up. keep checking. Then do whatever you normally do.. AIM, ICQ, IRC, whatever, and do it 1 step at a time untill you figure out at what point you get noticed.....