OT: What Does This Mean?

[Atrocities]

A computer at IP Address 216.40.247.45 has attempted an unsolicited connection to TCP port *REMOVED* on your computer.
TCP port *REMOVED* is commonly used by the "J-LAN-P" service or program.

*REMOVED* by me for purpose of this post.

[Intimidator]

I would say, that somebody has access to your computer........ But hey...... what do I know about computers

[Atrocities]

This ticks me off, I cannot leave to do a GD thing without someone accessing my COMPUTER!. Take today for instance, I am gone doing RL BS CRAP, and I come home to find my Firewall Freaking out. I HATE hackers!

[Ruatha]

I'd say that someone TRIED to access your computer but failed miserably and I wouldn't worry about it.

It happens all the time and your firewall seems to be doing what it's supposed to do.
So save the worries for all the other stuff that needs worrying.

[ August 02, 2004, 23:07: Message edited by: Ruatha ]

[Thermodyne]

It's an old port scanner. Here are the specifics.


Name: Phineas Phucker
Aliases: Orifice.srv.b,
Ports: 2801
Files: Pphucker.zip - 408,280 bytes Phineas.com - 93,250 bytes Phucker.exe - 352,768 bytes
Created: Dec 1998
Requires: N/A
Actions: Remote Access
Versions: N/A
Registers: HLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunS ervices
Notes: Works on Windows.
Country: N/A
Program: N/A


You all need to start using firewalls, and then close everything that does not have to be open. Software firewalls are better than nothing, but not much.

[Ruatha]

I rarely use my hardware firewall, right now it stands in the closet, the software firewall has kept me safe for over a year now. I'm quite satisfied with it.

Broadband constant connection since 1998 and never had any intrusion, trojan or virus.
(I've had the "Form A" virus, but that was 1994 I think and it came on a floppy, and it was pretty harmless.)

[ August 02, 2004, 23:39: Message edited by: Ruatha ]

[Katchoo]

I usually just ignore Messages like that from my Firewall. The only time your eyebrows should be going up is if you get several Messages in a row involving the same outside IP, or, if looking through your Firewall log (which is good to do every now and then) you see a pattern of attempts by the same IP at the same time of day every day. Stuff like that usually means someone (or some software) is persistantly trying to get into your System. When that occurs, do a search of what ISP that IP comes from, and send that ISP an e-mail detailing what's happening.

I had someone from Pairs port scanning my System repeatedly for 2 or 3 hours strait on a couple of different days, so I tracked down the ISP and sent them an e-mail. I got a quick response back, but unfortunately the ISP apparently didn't have anyone there that could read english, so I didn't get much futher with them. But the port scanning stopped shortly after

If your firewall is 'popping up' Messages like a pop-up whenever an intrusion is detected, you can disable the pop-ops. Norton does that unless you disable it (which I did).

[Gandalf Parker]

All machines on the net will get probed. Some are automatic scripts, some are installed programs (trojans/viruses) from someone elses machine and they might not know its doing it, some might be accidental.

If a random roaming probe finds something "interesting" then you might get a return visit which continually tries different things and different ports. Thats something worth reporting.

Alot of what I do is forensics of systems that are broken into. Anymore its getting hard to find any to work on. Even honeypots dont work anymore.

[Instar]

Its the aliens. Really, I'm sure of it.

[Fyron]

That is because you are one of them!

*masses armada to destroy looming Insatian fleet*