PC experts: My firewall keeps telling me I'm being scanned... what to do??? - GoFuckYourself.com

pradaboy · 01-17-2005, 02:50 PM

Ok at least every day, once a day I get a message that a certain IP scanned my ports and that the firewall has banned him for 3 mins. After the 3 mins. I get the message that the block has been lifted and that I should watch if anything suspicious happens.

These scans occur everyday... what can I do to prevent this or take counter measures???

StuartD · 01-17-2005, 02:53 PM

that's normal... and nothing to worry about for the most part. There are constantly servers out there doing surveys (checking for servers, surfers, networks, etc) that do scans, there's DNS's checking stuff... there's.... any number of things. So yes, you'll always have those alerts coming in.

Also, there are virus' out there that look for vulnerable computers... and your firewall just blocked it (if it is)... so don't worry about it. Chances are it's an automated thing and not some person out there who's out to get you.

pradaboy · 01-17-2005, 03:11 PM

Quote:

Originally Posted by NichePay - StuartD

that's normal... and nothing to worry about for the most part. There are constantly servers out there doing surveys (checking for servers, surfers, networks, etc) that do scans, there's DNS's checking stuff... there's.... any number of things. So yes, you'll always have those alerts coming in.

Also, there are virus' out there that look for vulnerable computers... and your firewall just blocked it (if it is)... so don't worry about it. Chances are it's an automated thing and not some person out there who's out to get you.

Thanks Stuart, it got me worried coz this did not happen before and I thought someone was out to hack me. If my firewall tells me the IP could I trace it somehow?

mardigras · 01-17-2005, 03:16 PM

Quote:

Originally Posted by pradaboy

Thanks Stuart, it got me worried coz this did not happen before and I thought someone was out to hack me. If my firewall tells me the IP could I trace it somehow?

The fact that your firewall is telling you about it means that the scan was unsuccessful. Be careful using "traceback" type tools that may be in your firewall program, they can confirm your existence when previously the person scanning had no clue your computer was there.

StuartD · 01-17-2005, 03:18 PM

Quote:

Originally Posted by mardigras

The fact that your firewall is telling you about it means that the scan was unsuccessful. Be careful using "traceback" type tools that may be in your firewall program, they can confirm your existence when previously the person scanning had no clue your computer was there.

This is true.

pradaboy · 01-17-2005, 03:25 PM

Quote:

Originally Posted by mardigras

The fact that your firewall is telling you about it means that the scan was unsuccessful. Be careful using "traceback" type tools that may be in your firewall program, they can confirm your existence when previously the person scanning had no clue your computer was there.

I have no traceback option in my firewall, but I am interested to know who or what's behind the scanning IP

sumphatpimp · 01-17-2005, 03:30 PM

go here, insert the ip then hit search

mardigras · 01-17-2005, 03:46 PM

If you're using ZoneAlarm, here's a tool that offers extended analysis of your logs and has lookup and backtrace features

http://visualize.phenominet.com/visu...visualzone.htm

pradaboy · 01-17-2005, 04:02 PM

Quote:

Originally Posted by mardigras

If you're using ZoneAlarm, here's a tool that offers extended analysis of your logs and has lookup and backtrace features

http://visualize.phenominet.com/visu...visualzone.htm

no actually I use Bullguard (BullGuard.com), it's not very wellknown but it is an excellent piece of sotware... at least better than any Norton or McAfee package

KMR Stitch · 01-17-2005, 04:07 PM

I love it when Norton says ICMP PING/SCAN Or hack attemped has come from ip address 127.0.0.1

I am like WTF.. Shut up stupid firewall :-x

Basic_man · 01-17-2005, 04:09 PM

Maybe you can blacklist the IP.. ! :D

Dalai lama · 01-17-2005, 04:10 PM

nothing to be worried about

GeorgeK · 01-17-2005, 04:12 PM

Assuming you're on a cable modem or DSL, it is best to get a hardware-based router, and then place that between your computer and the internet. You'd be able to also share the connection. Assuming the router is setup properly, those scans would be of the router, and not your PC. A router can be had for under $50 these days.

You can do a quick scan of your PC from the internet via "Shields Up" at:

http://www.grc.com/

On my router, all ports are closed, so the scan shows no vulnerabilities.

mardigras · 01-17-2005, 04:32 PM

Quote:

Originally Posted by pradaboy

no actually I use Bullguard (BullGuard.com), it's not very wellknown but it is an excellent piece of sotware... at least better than any Norton or McAfee package

I learned how to format and reinstall courtesy of Norton

pradaboy · 01-17-2005, 04:33 PM

Quote:

Originally Posted by GeorgeK

Assuming you're on a cable modem or DSL, it is best to get a hardware-based router, and then place that between your computer and the internet. You'd be able to also share the connection. Assuming the router is setup properly, those scans would be of the router, and not your PC. A router can be had for under $50 these days.

You can do a quick scan of your PC from the internet via "Shields Up" at:

http://www.grc.com/

On my router, all ports are closed, so the scan shows no vulnerabilities.

Thanks for the url, I'm gonna scan right away

pradaboy · 01-17-2005, 04:35 PM

Quote:

Originally Posted by mardigras

I learned how to format and reinstall courtesy of Norton

haha I know exactly what you mean! Amazing how crappy software compensated by a big marketing budget make you the market leader.

Oh hell what am I talking about... just look at the OS I'm running

pradaboy · 01-17-2005, 04:47 PM

Quote:

Originally Posted by GeorgeK

Assuming you're on a cable modem or DSL, it is best to get a hardware-based router, and then place that between your computer and the internet. You'd be able to also share the connection. Assuming the router is setup properly, those scans would be of the router, and not your PC. A router can be had for under $50 these days.

You can do a quick scan of your PC from the internet via "Shields Up" at:

http://www.grc.com/

On my router, all ports are closed, so the scan shows no vulnerabilities.

great I'm all covered, thanks for the link again!

01-17-2005, 02:50 PM	#1
pradaboy sell me your banners Industry Role: Join Date: Dec 2003 Location: on the tubes Posts: 12,931	PC experts: My firewall keeps telling me I'm being scanned... what to do??? Ok at least every day, once a day I get a message that a certain IP scanned my ports and that the firewall has banned him for 3 mins. After the 3 mins. I get the message that the block has been lifted and that I should watch if anything suspicious happens. These scans occur everyday... what can I do to prevent this or take counter measures??? __________________ Media Buyer - Sell me your traffic! FREE to register domains... Better than 99% of the crap sold here!

01-17-2005, 02:53 PM	#2
StuartD Sofa King Band Join Date: Jul 2002 Location: Outside the box Posts: 29,903	that's normal... and nothing to worry about for the most part. There are constantly servers out there doing surveys (checking for servers, surfers, networks, etc) that do scans, there's DNS's checking stuff... there's.... any number of things. So yes, you'll always have those alerts coming in. Also, there are virus' out there that look for vulnerable computers... and your firewall just blocked it (if it is)... so don't worry about it. Chances are it's an automated thing and not some person out there who's out to get you. __________________ This is me on facebook This is me on twitter

01-17-2005, 03:46 PM	#8
mardigras Bon temps! Join Date: Feb 2003 Location: down yonder Posts: 14,194	If you're using ZoneAlarm, here's a tool that offers extended analysis of your logs and has lookup and backtrace features http://visualize.phenominet.com/visu...visualzone.htm __________________ .

01-17-2005, 04:09 PM	#11
Basic_man Programming King Pin Industry Role: Join Date: Oct 2003 Location: Montreal Posts: 27,360	Maybe you can blacklist the IP.. ! :D __________________ UUGallery Builder - automated photo/video gallery plugin for Wordpress! Stop looking! Checkout Naked Hosting, online since 1999 !

01-17-2005, 04:10 PM	#12
Dalai lama Strength and Honor Join Date: Jul 2004 Location: Europe Posts: 16,540	nothing to be worried about __________________ A program you can trust. Gallerybooster Run multiply TGPs of 1 script

01-17-2005, 03:30 PM	#7
sumphatpimp Confirmed User Join Date: Aug 2002 Posts: 5,235	go here, insert the ip then hit search

01-17-2005, 04:07 PM	#10
KMR Stitch I am cool Join Date: Jul 2003 Posts: 14,494	I love it when Norton says ICMP PING/SCAN Or hack attemped has come from ip address 127.0.0.1 I am like WTF.. Shut up stupid firewall :-x

01-17-2005, 04:12 PM	#13
GeorgeK Confirmed User Join Date: Dec 2003 Location: Toronto, Canada Posts: 423	Assuming you're on a cable modem or DSL, it is best to get a hardware-based router, and then place that between your computer and the internet. You'd be able to also share the connection. Assuming the router is setup properly, those scans would be of the router, and not your PC. A router can be had for under $50 these days. You can do a quick scan of your PC from the internet via "Shields Up" at: http://www.grc.com/ On my router, all ports are closed, so the scan shows no vulnerabilities. __________________ I buy good domain names. Send lists to George (at) LOFFS.com