Re: unused ports, firewall, and trojanhorse

From: Robert Moir (maranbat@bitey.force9.co.uk)
Date: 07/28/02


From: "Robert Moir" <maranbat@bitey.force9.co.uk>
Date: Sun, 28 Jul 2002 21:21:05 +0100


"rasuli" <sikivu77@yahoo.com> wrote in message
news:27a001c2366f$2c74b130$2ae2c90a@phx.gbl...
> i use Norton Firewall. i have been alerted that someone
> is trying to get into my computer through an unused port.
> There are several hundred attempts a day.

Do you have a (small) sample you could post here? Just reply with a few
representative lines from the firewall logs, to this post, and you'll get a
few people looking at them for you I guess.

> This has been
> going on for months. Will this person eventually get
> through?

Well if its an organised attack its curious and worrying they'd keep trying
to hack a ordinary workstation... have you been boasting in the local bars
about having a map to untold wealth on your computer? Seriously, it might be
helpful to think about why someone would keep trying...

As for eventually getting through.. well a firewall either detects and stops
a probe or it does not. It's not like constant use wears a hole in it.

> is there something i can do to stop this?

Impossible to say without more information. If you are certain that this is
a directed attack, from one person (or an organised group working together)
then have you considered complaining to their ISP? Asking yours for advice?

> Would
> the Norton System Works provide any added protection, if i
> could use it? I have Microsoft Millenium Edition (ME).

I'm sure the adverts would have you believe that it would help but like i
say, a firewall either stops a probe or it does not. If your firewall is
catching this stuff then another firewall would not do a better job of
stopping it. This is something that either works or doesn't work, and it
sounds like your current setup works.

--
--
Robert Moir, Microsoft Windows 2000/NT MVP
To search the MS Knowledge base use the link below:
http://support.microsoft.com/support/search/c.asp?PSL=1
My Homepage - http://www.robertmoir.co.uk
** Emailed questions will not be answered **


Relevant Pages

  • Re: internet explorer / connection problems
    ... speaking with QWest (isp), D-Link, and Actiontec ... and the connection was verified. ... Disabling the XP firewall and the Norton ... UNINSTALL the Norton firewall and see if this helps. ...
    (microsoft.public.windowsxp.general)
  • Re: internet explorer / connection problems
    ... > recently experienced similar problems with pages not loading etc. ... > and the connection was verified. ... Disabling the XP firewall and the Norton ... UNINSTALL the Norton firewall and see if this helps. ...
    (microsoft.public.windowsxp.general)
  • Re: My 2@ Worth on Firewalls
    ... >>>computer until Nortons Firewall was installed with their factory ... > hackers were using my computer, a number of testing methods were used ... >> computer" until you installed Norton Firewall. ... >> before installing Norton, how did you know whether or not anyone had ...
    (comp.security.firewalls)
  • Re: 2 quickies re: fire walls and quick launch
    ... >> No2 first. ... Did you try R-click drag and select "move here". ... It will tell you how to enable or>> disable the firewall. ... My>>> new computer, an HP, came with Norton firewall but I'm not going to>>> activate it but isn't>>> there also one inherent to XP? ...
    (microsoft.public.windowsxp.newusers)
  • Re: Norton Firewall Protection
    ... > Antivirus program to include Norton Firewall Protection. ... connection is active at the moment or not. ... after you have Norton Firewall Protection installed and configured. ...
    (microsoft.public.windowsxp.security_admin)