Printable View
My firewall log shows a lot of attempts by different people to Tracert my pc.The source and the destination ports are both 6346.This means that there's some trojan in my pc and the dumb lamer is using some canned client program.My dumb anti trojan software doesn't detect it.. Is there some way i can just stop all activities in a particular port (6346!) ?? or is there some really good and free antitrojan software ????
How about using a firewall? Sygate, Kerio, and Zone Alarm are all free and can keep them from accessing your PC.
It's a Gnutella file sharing port. So someone could just have their client configured wrong.
Here's a list of port assignments: http://www.iana.org/assignments/port-numbers
And if you don't know what the process is that is listed just do a google on it to find out what it is.
I use a firewall called Omniguard... the problem with it is that when i use it i can't use any instant messengers or p2p ... Reminds me of what Peter Norton said about internet security
" Security is inversely proportional to convenience "
See obviously, a firewall can help you turn off a specified service or close a port for you. But to close it manually there are a number of way's. For instance, if you are running an FTP server which run's on Port 21 and you wanna close it, simply turn off the server. That will shutdown that port. Same with http (80), etc etc. Hope I was of some help.
hmmm .. so..how do i find out the server running on this particular port anyway ?? ..
The port in question is 6346? What I would do is google a port list (or a few) and check them out. See what service's/application's/etc are running on that port and then report back with that information.
EDIT: I came up with this:
port 6346: gnutella-svc
I'ma research it out for ya (try to as well, google is our friend) and see what it exactly is. It sound's oddly familiar and I feel dumb right now, it sound's like something I should know. Anyway's, report back with finding's if any.
If you want to find out if there is an app/service with that port open run netport ( http://softgears.com/netport.html ) and see what it maps to. Most likley it's not attaching to any open port on your system and you are just being scanned. May just be someone looking for open gnutella-svc boxes.Quote:
Originally posted here by Alterk0de
hmmm .. so..how do i find out the server running on this particular port anyway ?? ..
I dunno, usually when you are probed it's for something a little more common than that type of service/port. It could be something a little more legit and targeted. Like I said, research it and find out way's to shut it off if it's not needed (which I don't think it is).
Hey Hey
Quote:
My firewall log shows a lot of attempts by different people to Tracert my pc.The source and the destination ports are both 6346.This means that there's some trojan in my pc and the dumb lamer is using some canned client program.My dumb anti trojan software doesn't detect it.. Is there some way i can just stop all activities in a particular port (6346!) ?? or is there some really good and free antitrojan software ????
So are you running the software or not? I'm guessing yes if you have a firewall log. I'd suggest you check out other firewall software. Tracert.. Trace Route is a method of determining the number of hops between two points and the path the packet takes. This is done using ICMP, so you shouldn't be seeing any ports on these attempts... You also said these are attempts, this doesn't mean any connection occurred... It's not even proof that that port is open on your PC... just that someone checked to see if it was. The odds are you don't have a trojan... and most AV software these days will pick up trojans, so grab a copy of AVG Free... or if you must have a trojan Cleaner.. check out The Cleaner by MooSoft.Quote:
I use a firewall called Omniguard... the problem with it is that when i use it i can't use any instant messengers or p2p ... Reminds me of what Peter Norton said about internet security
" Security is inversely proportional to convenience "
As as closing ports.... like everyone has said find out the application that is opening the port and kill it if you don't need it.. Ports don't just open, there's always a piece of software beind it... Irongeek mentioned netport... I prefer fport.. it's a very handy console app to have around. Download Here
Peace,
HT
you can use Fport available on www.foundstone.com its a port mapping utility i keep it in system32 so that i can use it as soon as i see a suspicious connection :p
Are you using gnutella?
It appears the original poster is using Windows? Just to add some Linux information here (for others who would like to know,) in RH9, this can be done by accessing the services file in the /etc directory.
cat /etc/services
vi /etc/services
Placing a semi-colon at the beginning of the line prevents that service from starting. You can then KILL the process or simply reboot.
- aftiel