Hi all, new to the board. Long time reader, first time poster. I have a small problem with my network that I was wondering if anyone could help me solve. Basically, I'm running Zone Alarm Pro 6.0.667.0 (with all the updates included) as well as Kaspersky Anti-Virus Personal. Over the last two days, Kaspersky has blocked a UDP port scan from a certain ip address (24.48.208.xxx) every 20-45-75 minutes (in other words that message appears on my screen). I have the lock on my firewall, but I was wondering if there was someway to block that ip from accessing my computer completely. I surmise the user of this ip is already being blocked somewhat, but it just seems two-to-three-to-five mintues after the message of the UDP port scan being blocked, my network connection slows down and dies until I go to my network connections and repair my local area connection.
I'm not very tech savy, but I'm trying to learn as much as possible. Again, I don't think it's a spyware thing (I've ran spyware sweeper, ad ware, etc,) or a virus (ran Kaspersky) as this slowing down and dying of my connection only happens after the block of the UDP port scan. Is there some way to add an expert rule to Zone Alarm to block that ip? I understand that there is only enough security to help and that even the best stuff can be side-stepped, but any advice would be welcome. If you need more info let me know. I've been googling for most of the night (and into the morning) looking for help. Any advice or pointers would be great. I've picked up plenty of great apps from this part of the forum, esp. C(rap) Cleaner :), so maybe someone could help...
Kaspersky should not be seeing this UDP port scan unless Zonealarm is letting it through. You should configure Zonealarm to block that UDP port.
You should have ZoneAlarm "Internet Zone Security"to "High." This will prevent computers on the Internet from being able to see your computer unless you contact them first.
However, even if your computer rejects all packets from an attacker, said attacker can still flood your Internet connection and create the problem you describe. You should contact your ISP about this. Since this is coming from the same IP address each time, they should be able to take care of it.
Thanks for the advice Hardware, I had my settings to High for Internet Zone and just raised it from Medium to High for trusted. I'll contact my isp today, as like you mentioned it's the same d*mn ip address. I just fear that some hacker is already on his/her machine (from another machine) and trying to get to mine. Just a pest and frustrating, you know? Thanks for the help! :)
If your Internet Zone was already on high, then no UDP port should have been open, unless you previously told ZA to open it. While I still recommend contacting your ISP, it also sounds like you need to fix what you are allowing in through ZA. You can see what programs are allowed through ZA by looking at the "Program Control" tab, but if you are not familiar with the names of all the programs on your computer that use the Internet then the easiest way to do this is probably to uninstall and reinstall ZA. If you go that route, don't let it use existing settings when you do the reinstall.
Oh, and take a look at what's in your Internet and Trusted zones (in the Zones tab). Unless you have a computer network at your home, only your "Loopback adapter" should be in your Trusted zone, and only your computer's network adapter should be listed in the Internet zone.
PS - And make sure you have the latest version of ZA.
Hey, somebody's got to neech the nietzsche; I say keep climb that rope, neech say (well probably sayz) let go of the rope (role) nothing is to be found. :) ah, so be it...still working on the port control...
can you tell me what port it is? some are notorious for trojans, some are generally reserved for something legit.
also, you can get a cheap router for 20-30 bucks that's going to take care of things like that before they get to your computer, i think compusa's selling a pretty good zyxell 334 for like 20 dollars after rebate right now.
Hey all, hate to bump a somewhat old thread, but just wanted to thank everyone for their comments. Basically, I notified my isp, got a router, and everything is back to normal. J(or should it be j)amesn, I think it was port 53 he/she was trying to enter, but the router appears to have solved all problems.
Side note, I've been becoming very interested in computers and the interweb :) lately and I was wondering about converting to the Linux (I believe it's called) OS. I know (think?) that the best way to try and understand things with computers is to just screw around with them and over time learn, but (speaking as a nOObie) if you guys/gals had any texts or programs with Linux too recommend I'd enjoy any recommendations. Call it a hobby or I guess to those of us who are C++ illriterate a challenge, but I guess I'm one of those guys that enjoys knowing "how things work" to the smallest detail. Anyway, I guess all I'm asking is if any of you have a "bible" or "bibles" (or sites) of sorts in regard to networking, security, etc. I know it's a large subject, but what are a few works that you learned the most from...thanks in advance. (side note #2, even if it's a long list, write it out, I'm not the type to read two books or only 100 pages of a list then quit)
Flame anyway, if you want, I have thick skin and hell, you guys already helped me out of one problem already...I have a good sense of humor as well :) . No offense, I mean this in the kindest way possible, but it was odd taking advice from jamesn, he just seems like the court jester around here. Just an agent provocateur par excellance. But he's very straight-forward in here :)
Bill, Hardware, DeverDon, and also like your input as well, if possible. Again, real general to the very specific. I just want to know more.
Can't help you there. I've never even considered converting to Linux. That probably has to do more with my dislike for Unix causing a prejudice against Linux (even though they really aren't the same thing), than anything else.
Don't go thinking linux is perfect. linux is a hobbyist OS with lots of flaky homebrew software and hardware compatibility issues. But if you have a spare PC it is worth trying.
Yeah, there is somewhat of a learning curve to Linux, too. I never really took the time to sit down and learn the nuts & bolts of it, myself.
Try http://www.linuxiso.org/ You can browse some of the different distributions and be sure to visit the forums there. They have a help/newbie section that might help you pick a distribution that will work best for you.
For security, I've never really found an all-inclusive site that covers it all. Try starting with http://www.grc.com/default.htm
Take the "Shields Up" tests to see where your computer ranks in their security tests. They offer explanations and suggestions on covering up your security "leaks".
not sure it's a "bible", but broadbandreports.com is about as good as sites get for wide coverage and discussion of networking and security stuff. if you're running your own isp, it might not be that informative, but for most of us it's a great resource. also, tomsnetworking.com is great, it's run by different people than tomshardware despite being under the same flag.
steve gibson hasn't really been on top of things for a few years now, imho.