Multiple access attemps to other pcs on home wireless network

daz3dpanda · Feb 22, 2009

Hello,

Today my laptop has made over 45 attempts each separated approximately 20-30 seconds to access another laptop in my home wireless network ports ranging from 51806-51956. The report I obtained from zone alarm firewall, Rating: High, Protocol (flags: S) 2/22/2009. I clicked more info on the attempt and zone alarm redirected me to one of their sites that mentions this attempt has blocked access to port 139 which happens to be a common port for windows network file sharing.

Please let me hear your opinions on this matter, I am not sure whether this is actually a legitimate attempt since it was continuous for nearly 1h20m 6:50p-7:30p.

Thank you!

MrNeeds · Feb 23, 2009

did you try and access other computers on your network during that time or was it zone alarm notifying you of access to other computers which you werent attempting to access?
if its the first one, then lighten the restrictions on that port number, if its the second one, then youve been the victim of a hacker attack.

daz3dpanda · Feb 23, 2009

The second one, I have not been trying to access my other laptop. If this is the case of a hacker attack, how may I prevent the next intrusion?

edit: I thought vista normally attempts to access other computers in a home network, I have in the past set up file sharing on that particular computer before.

MrNeeds · Feb 23, 2009

daz3dpanda said:
The second one, I have not been trying to access my other laptop. If this is the case of a hacker attack, how may I prevent the next intrusion?

Zone alarm is doing a good job at the moment, you could restrict access to your network by disabling file sharing, but your computer will be the main focus of attack, a good firewall is all you need, windows does a good job but i have one built into my router, with uPnP enabled on my network, it only allows access to outbound traffic i specify, so looks like you need to ask yourself, do i need a new router?

daz3dpanda · Feb 23, 2009

You're probably right, my router is a bit outdated. But my router too has a firewall, windows firewall is enabled, I do not have any ports forwarded and I too have enabled uPnP. Assuming this, since the hacker has already broken into my pc, there is no possible way of preventing him from re-entering would there be?

MrNeeds · Feb 23, 2009

theres a possibility he/she may have access under an open port that is used in your "exceptions list", most commonly the file sharing port

and the html port, but it looks like he/she is randomly trying to access on a high port scale, these are blacklisted ports and are not commonly used, very strange indeed

daz3dpanda · Feb 23, 2009

Oh I see, alright. I have completely disabled all file sharing and discovery, is there a way (commands) I can use to detect when hackers or unwanted remote computers? Also because the attacks had been separated by varying 20-30 second spaces, does that also add to your conclusion that this was a hacker attack?

MrNeeds · Feb 23, 2009

daz3dpanda said:
Oh I see, alright. I have completely disabled all file sharing and discovery, is there a way (commands) I can use to detect when hackers or unwanted remote computers? Also because the attacks had been separated by varying 20-30 second spaces, does that also add to your conclusion that this was a hacker attack?

its similar to how hackers operate, they find an open port on your IP address using the command prompt, specifically pinging your connection, but with a port prefix, you can test this theory out by pinging your router ip gateway, simply type "command" into the start menu search box and right click command prompt and run as administrator, type in the command prompt "ping 192.xxx.xxx.xxx" with your ip gateway as the rest of the numbers, if you get a response then you have full acess to your router, adding a specific port to the end simply looks directly at the router, rather than trying to find a door, the door is the port. should look like the attachment below, the fact that im getting a response from my router tells me that my firewall is working with outgoing traffic with response i requested, however, you need to find out your routers ip address from the settings and ping your router from the outside in, on somebody elses computer not on your network.

daz3dpanda · Feb 23, 2009

Oh I see, thank you for that information. I think I understand what you are saying. Does vista have an operation for the user to check what remote computers are currently directly connected?

I think all this talk about hacker attacks has made me paranoid and feeling exposed.

MrNeeds · Feb 23, 2009

yes, just right click your network icon in the taskbar, click on network and sharing center, on the left of that window will be an option saying view computers and devices, this will come up with all the computers and devices with uPnP compatability on your network, however, if you want to find out if someone is trying to maliciously attack your computer, ive only ever used one thing that can do that, premium firewall programs like mcafee firewall or norton firewall.
forget the blue squiggle in the picture, it contains a swear word and i cannot use it on this forum.

Tarka Dal · Feb 25, 2009

Hope you two don't mind me butting in...

But this might just work for you...

Outpost Firewall PRO - Personal Firewall

Not in any way affiliated with the above co.

daz3dpanda · Feb 25, 2009

anyone is welcome to join, I'd like to hear all opinions, never heard of that program though, thanks for the referral :]

Multiple access attemps to other pcs on home wireless network

New Member

My Computer

PC Geek

My Computer

New Member

My Computer

PC Geek

My Computer

New Member

My Computer

PC Geek

My Computer

New Member

My Computer

PC Geek

Attachments

My Computer

New Member

My Computer

PC Geek

Attachments

My Computer

I know nothing!

My Computer

New Member

My Computer