What are these odd connection attempts?

Printable View

March 4th, 2006, 05:45 PM
Amazon Lights

What are these odd connection attempts?

Sometimes I get strange connection attempts in my firewall IP addresses always looking to access my system or leave it through port 137 mostly but there are a few others but mostly this one. I always click deny and usually just click to make the rule permanent. I was told that these are most likely port scans from an average joe and nothing to worry about but, I was wondering if there was anything I could do to stop them for good like messege the scanner "What do you want from me?".

Here are 2 that popped up while typing this messege before I edited to make them permanent

221.211.255.11 connect out through 137

Someone from ip248-237-59-62.adsl.versatel.nl [62.59.237.248], port 1095 wants to send UDP datagram to port 137 owned by 'SYSTEM' on your computer.
March 4th, 2006, 06:04 PM
nihil

Well, the incoming stuff would probably be internet worms coming from infected machines.

The outgoing stuff is more of a concern. I would suggest that you update your AV, boot into safe mode and run it. That IP is apparently in China!

Then get

1. Ewido
2. Spybot Search & Destroy
3. A-Squared
4. AdAware

Update them and run them in safe mode.

I suspect that the Dutch one is some sort of advertising pop-up.

:)
March 4th, 2006, 06:14 PM
Amazon Lights

Quote:

Originally posted here by nihil
Well, the incoming stuff would probably be internet worms coming from infected machines.

The outgoing stuff is more of a concern. I would suggest that you update your AV, boot into safe mode and run it. That IP is apparently in China!

Then get

1. Ewido
2. Spybot Search & Destroy
3. A-Squared
4. AdAware

Update them and run them in safe mode.

I suspect that the Dutch one is some sort of advertising pop-up.

:)

I have AVG free edition and avast anti virus both of them havent found anything in months. I used to have some trojans before I got a firewall and learned how to use it pretty well. I also have spybot and adaware but I have never heard of ewido and a-squared. I'll get those two and update them then I'll boot to safe mode and use them all. This is what I need to do right?
March 4th, 2006, 06:21 PM
ByTeWrangler

Greeting's

Get an online scan done at either Trendmicro or Microsoft

1. http://housecall.trendmicro.com

2. http://ideas.live.com/

If you have XP disable system restore. DO NOT RUN 2 ANTI-VIRUSES AT THE SAME TIME. Stick to anyone one you like and do you have a firewall ?

Go to your network connetion and see that NetBios is disabled over TCP/IP if it isnt do it now.
March 4th, 2006, 06:24 PM
nihil

Well, did you update them and run them in safe mode? They might not catch something that has already started.

I would also clear your browser cache and check your cookies, BHOs etc (use the "tools" option in Spybot for this)

Ewido and A-Squared are pretty good. Unfortunately you cannot rely on just one product these days. Yes, update them and run them in safe mode.

You might also try an online scanner such as Trend Micro's "Housecall"

The incoming stuff is not much to worry about it is the outgoing ones that worry me.

:)
March 4th, 2006, 06:36 PM
preacherman481

Quote:

I was wondering if there was anything I could do to stop them for good like messege the scanner "What do you want from me?".

You really don't want to do that, or do anything like scanning them in return. It will just let them know they have a "live target." Port scanning is an attempt to find targets. Don't make it easy for them.
March 4th, 2006, 06:47 PM
nihil

Preacherman is right, and, as most of this traffic is from bots and worms your message would not be read anyway :)
March 5th, 2006, 01:35 AM
Amazon Lights

I have win98 and kerio

I did a scan with all of the scanners I can some didnt allow win98 I did them in safe mode and even the one from trendmicro and still didn't find anything. On my computer I just made the rule for the system one trying to connect out to deny it. I'm using kerio 2.1.5. .
March 5th, 2006, 02:49 AM
nihil

Do your logs tell you what programs, etc that are trying to make the outward connection?
March 5th, 2006, 09:01 AM
ByTeWrangler

Greeting's

Is your system all patched up ? Have you disabled NetBios ?

Kerio 2.1.5 is a very old verion and is affected with 6 vulnerablities out of which *3 ARE UNPATCHED*, One of them is a program exicution protection bypass vunerablity. There are no patches of it and the only way you can be more secure is to either upgrade to 4.2.3.912 (http://www.sunbelt-software.com/Kerio.cfm)

Have you disabled any one of your anti-viruses ? Also I have never used kerio but anyway go thoroug the help file or if you know creat 2 new rules

1. Disable all additional protocol except TCP, UDP.
2. Close ports like 137, 139 etc with a specific rule

If you can buy a new firewall then buy the one you like or go through the Firewall and honeypot forum and decide on any one.

Disable activex in your browser if you have IE. Win98 is a very old operation system if i were you i would upgrade. Or if you want use any other browser except IE. If you use firefox i would advise you to get the Noscript plugin

Post a Hijackthis Log we can give you more information after that.
March 6th, 2006, 02:57 PM
Amazon Lights

Quote:

Originally posted here by ByTeWrangler
Greeting's

Is your system all patched up ? Have you disabled NetBios ?

Kerio 2.1.5 is a very old verion and is affected with 6 vulnerablities out of which *3 ARE UNPATCHED*, One of them is a program exicution protection bypass vunerablity. There are no patches of it and the only way you can be more secure is to either upgrade to 4.2.3.912 (http://www.sunbelt-software.com/Kerio.cfm)

Have you disabled any one of your anti-viruses ? Also I have never used kerio but anyway go thoroug the help file or if you know creat 2 new rules

1. Disable all additional protocol except TCP, UDP.
2. Close ports like 137, 139 etc with a specific rule

If you can buy a new firewall then buy the one you like or go through the Firewall and honeypot forum and decide on any one.

Disable activex in your browser if you have IE. Win98 is a very old operation system if i were you i would upgrade. Or if you want use any other browser except IE. If you use firefox i would advise you to get the Noscript plugin

Post a Hijackthis Log we can give you more information after that.

I just downloaded Zonalarm Internet security suite and plan on buying it if I like it. I only use win98 because its the only pc I can afford a p2 350mhz :( still works good though. I also dont use IE but Firefox where can I get the noscript plugin for it? Thanks alot your real helpful.
March 6th, 2006, 04:51 PM
ByTeWrangler

Greeting's

You can get no script plugin here : https://addons.mozilla.org/extension...cation=firefox

Also this is my own personal suggestion I think you should invest the amount you are going to spend on zonealarm on Outpost its much more rock solid and better in my opinion. Also it filters active content.
March 6th, 2006, 09:01 PM
Amazon Lights

thanks

Quote:

Originally posted here by ByTeWrangler
Greeting's

You can get no script plugin here : https://addons.mozilla.org/extension...cation=firefox

Also this is my own personal suggestion I think you should invest the amount you are going to spend on zonealarm on Outpost its much more rock solid and better in my opinion. Also it filters active content.

Thanks I got that plugin. I also have been getting some alerts with ZoneAlarm now for incoming UDP mostly. I click smart defense advisor and check the ip's and they are from all over the world so I report the information to zonealarm. Also in the firewall\zones section I have two adapters one is called "loopback adapter" its 127.0.0.1. I can access the internet without this one is that normal should I delete it? The other is My network and it seems like a more unique ip. The scan also removed 3 adwares that I haven't found with my other scanners.