Computer Help forum

General discussion

Firewall question/ am I infected?

by LakesReg / August 14, 2010 8:20 AM PDT

Ok I use Norton and my firewall log will sometimes show the same IP address attempting to contact my computer via a few different ports. My firewall log shows teh attempts blocked. But the same IP makes the same attmpts like every 45-60 minutes for several hours. Then there appears to be no more attempts until like maybe 10 hours later
current offending IP is 137.186.42.154 Ports attempted are 3803, 8080, 80 among a few others
My security does not show it as a "portscan" but just that unused port blocking has blocked....
Scans show no infection. There are also no progroms noted going out to that IP address, nor is there anything in teh internet connection log that woudl support soliciting this.

So is this because my machine is infected and is soliciting these attempts? Or just random attempts having nothing to do with my machine, other than being internet connected?

Discussion is locked
You are posting a reply to: Firewall question/ am I infected?
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Firewall question/ am I infected?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
am I infected?
by andybaber2000 / August 14, 2010 10:40 AM PDT

My guess is no, my reason for saying that is I just tried going to 137.186.42.154 and said no address. also did a search on ask.com and bing.com with nothing found. Personaly I don't care for Norton and don't us it. It was pre-installed on my laptop and I removed it after I got infected and they said I was clean. Installed my spyware program from my desktop, ran a scan and had 28 viruses. After I cleaned them out I uninstalled Norton. Just my opinion. Wink

Collapse -
Sounds Like The Typical Random Port Scanning On The Net
by Grif Thomas Forum moderator / August 14, 2010 10:43 AM PDT

Such blocks will occur when you're connected to the internet and your firewall is operational. As long as your firewall is blocking the attempts, then you should be fine.. If all scans are coming up negative, then it appears like the computer is clean.

A question though... If you're connecting to the internet through a router or modem, most have a firewall or NAT-type firewall. If you enable the router/modem firewall, then you should stop receiving the warnings from your computer's internal firewall. Have you tried such?

Hope this helps.

Grif

Collapse -
So....
by LakesReg / August 14, 2010 12:03 PM PDT

So in essence, the same IP address/Computer can attempt to access my computer every hour for the next 2 days, and as long as the firewall shows blocked, then I'm safe, huh?

Because I get several of these a day from different IP addresses, some in China. Some will attempt every hour maybe 15 out of 24 hours. I have seen on ipillion.com some of these same addresses attacking others. So good bet to say that if the same ones repeat frequently per day and everyday, that it is probably some automated attempt to attack a whole bunch of computers, including mine? And not because there is someting on MY system, but because my IP is part of a range of IPs they are attempting to contact?

Collapse -
Yes, You're Correct
by Grif Thomas Forum moderator / August 14, 2010 12:54 PM PDT
In reply to: So....

A few years back, I had an off-shore port scanner hitting my firewall hundreds of times every day.. Others in my area were getting the same IP address for the scanner. No problems because the scans were blocked.

Hope this helps.

Grif

Collapse -
so chances are...
by LakesReg / August 17, 2010 9:26 AM PDT
In reply to: Yes, You're Correct

pretty good it has nothing to do with my machine "calling out" (Especially since no programs seem to be started when this happens, as in no program calling out)
But really just being on the net

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

CNET FORUMS TOP DISCUSSION

Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?