Printable View
my firewall is insain, or just im odd
so almost every hour or so, i get a ATTACK ALERT from my firewall(its norten) sayin that i have been attacked and its been blocked, should i worry about this, or is it common, and it isn't always just a person, could it be a automatic computer doin it?
Personally, I think that it is a good thing. Your firewall is blocking incoming traffic, and doing what it is designed to do!
If the alerts are annpying you, there should be a function on your Firewall to stop the pop-up alters from happening, but I cannot say definitavely without knowing what firewall you are using.
Yeah I would be happy to see so many alerts, it's a good sign of your firewall doing exactly what it was meant to do. As SoggyBottom said there should be an option to disable the pop ups if they do tend to get annoying.
thanks, is every attack an attack by a hacker so to say? or just something else¿
Quote:
Originally posted here by theyortiscool
thanks, is every attack an attack by a hacker so to say? or just something else¿
umm, a Hacker, no, a cracker or script kiddie, maybe.
It depends on what kind of attack it says its blocking. if you paste some of the logs in and we can look then maybe we could tell what they are.
usually its not an attack at all or at least not by a person. your fw reports any attempt to connect as an attack even if its legit. does norton tell you the port and protocol? many attempts to connect are internet worms looking for servers to infect. sql iis or other. if you consider these 'attacks' i guess you could say your being attacked. if you can give more info im sure someone will tell you what it is
Dont be worried that your computer is saying its blocking attack, worry when it stops saying that it is blocking attacks. lol
I would say it is definitely an automatic attack, if indeed an attack at all. Either:Quote:
Originally posted here by theyortiscool
my firewall is insain, or just im odd
so almost every hour or so, i get a ATTACK ALERT from my firewall(its norten) sayin that i have been attacked and its been blocked, should i worry about this, or is it common, and it isn't always just a person, could it be a automatic computer doin it?
- You are genuinely being attacked, almost certainly by a worm. Almost certainly by either an IIS worm or SQL Slammer (which is dead now 99% of ISPs block it?)
or
- Your firewall is detecting legitimate traffic as an attack.
The second is fairly likely. Some of these Windoze application firewalls are amazingly paranoid by default and classify any connection as an attack unless it matches some rule for legitimate traffic. This is rediculous. A real IDS would probably not see these as attacks.
For example, a straightforward ping could be seen as an attack by your firewall, but many things legitimately ping client boxes (perhaps to determine latency)
One other thing:
Are you running P2P or have you been recently? If so then ignore *ANY* IDS. P2P vs IDS is a battle IDS cannot win.
Donn't your firewall gives you more details about the dropped flows.
Maybe it's simple scans - then you can't do a lot and pray that the scanner is not handled by a kid.
Maybe it is a real attack - & then you should worry, investigate and take counter measures.
If you don't know where to start I'm sure by publishing your logs (:!: hide your public addys) on AO, some folks will help thanx to their expertise.
yeah, it can tell me what the ip adress is of the person who is attackin me. when i click on more info it tells me that it is a inbound trojan horse. but i scan for virus's and none is detected. i did have THE CLEANER but my 30 day trial ran out. is there any other programs that can clean and delet any trjans that are on my pc.
and i do run the occasual P2P(kazaa)
seeing inbound traffic for a trojan horse is nothing to worry about. (outbound well thats something else) All inbound traffic means is someone is scanning your network segment for a trojan infected computer to play with. just because its "inbound" dosnt mean there's something there for it to reach.
okay cool thanks a lot, i was gettin a bit worryed wit all of this inbound trojan horse stuff, do you have any good sugjestions on how to get trojans off of my computer, i already used the 30 trail of "the cleaner"
Yeah, like the others said, don't worry too much about it, this is a quite common occurence, especially if you have a broadband connection (which are more appealing...).
For example, a quick review of my firewall logs for 3 common trojan ports gives me
# tcpdump -netttr pflog port 21337 or port 27374 or port 12345 | wc -l
132
132 hits and the log is 4 days old... And this is not even counting the MS-SQL/slammer scans and all...
Ammo
okay, cool. and yes i do have broadband, the reason this came up was because it wouln't let be play monoply online wit others (lol i know im a geek) so i was just wonderin if i dissable it, if i will be fine
im asking everyone who replyed earlyer, if i turn off the firewall for a while, will it affact my comptuer
Tis true that some hackers can take control of your pc over a web connection , i would be happy that norton is blocking this traffic as a backdoor sub7 trojan can be a nasty piece of stuff to get inside your computer ,you can configure norton firewall to block certain ip address ranges , if these attacks keep coming from the same apparent network ip address ranges. simply click settings for personal firewall and go to configure and add the ip address you wish to block there.
From what I've seen from my corporate firewall at work: generally 99% of everything in the logs are either someone running a network scanner over a range of addresses or it's a virus propagating (or trying to) over the internet.
You want to see warnings....if you stop seeing them, then you should be scared. If you're paranoid ( which isn't a bad thing), download "active ports" and you can see what ports are open & what process is holding them open. It's a great util, and I have it running on all our servers at work, just in case I ever need it.
Also, research what ports it's trying to hit. This is very helpful. You'll find alot of them are viruses running all over the net.
Hope this helps.
For the most part, the "attacks" probably aren't serious, but don't take chances. Keep the firewall up. In the last 3 hours, my firewall has detected a large number of "attacks." but it classifies them according to severity. Most of the "attacks" are just port probes (UDP, HTTP, and TCP). None of them raised any serious flags, and were simply blocked and ignored. But I definitely take comfort in the fact that it blocks them, because there are simply too many undisciplined kids out there getting a copy of some trojan and becoming k3w7 h4X0rZ.
If you pull up your firewall settings, you should be able to allow certain IP addies. Add the IP of the host where you would like to game to this list as trusted. On my HW firwall I can even go further and put a time on the IP address when I can connect to the server. This would be best. If you are really paranoid, allow the game server as trusted while you play, then delete it off the trusted list when you are done. As far as blocked connections, I have even seen my ISP blocked, their servers send out a ping once in while to check the network status. Nothing bad about it, but my firewall dropped them anyway!!! As far as how to get rid of worms, most antivirus software can help you there as long as you keep it updated!
Those might be comming from kazaa
does ur atack come every hour once or on the
exact time when u download some stuff from kazaa
because in most cases it is kazaa so check on that first
i was getting alot fu```ing alerts on zonealarm
after few days my computer crashed... i found lots of exploits and other stuff in my \windows directory
i installed new xp into my box
i thought that it was a network problem but after another few days it crashed again :D
funny
very
i suppose that the problem was p2p program like kazaa imesh and other like that
after another reinstallation i don't get any curious alerts :D
for conclusion: get rid of all your p2p progs, update your winz, download nukenabber zonealarm and other stuff, be paranoid :) it helps
It's always amazing when you first turn on a firewall isn't it? People are like OMG!!!
There are many useful programs out there and some antiviral users are like Windows and Nix users, they are loyal to specific camps. I have McAfee installed and set to update my scanner files every night. Normally they only release a new file every week but you may miss the emergency releases if you wait a week. That has burned my in the past. www.mcaffe.com or www.nai.com I have also used Norton and it's very good as well. In fact they are always coming out on top of one another in lab tests. There are also good free ones but I like McAfee, I know it inside out and know how to tweak it. Downside is, you will have to pay for a subscription to keep the virus signatures up to date.Quote:
did have THE CLEANER but my 30 day trial ran out. is there any other programs that can clean and delet any trjans that are on my pc.
It's ok to let it pass Monopoly; after all - if you can't play on-line games then you are missing out on some real fun. Just be careful and do not shut the firewall off. Let it prompt you for access or if you trust the game server give it access and you won't be prompted when you connect. I turn my firewall off sometime to trouble shoot, you are ok for a little while, just have some scanner that scans files when they are accessed. Oh and you noted you use Kazaa, that's cool but make sure you have all the Paranoid tools on when you use it.Quote:
it wouln't let be play monoply online wit others (lol i know im a geek) so i was just wonderin if i dissable it, if i will be fine
Peace.