Sign in to follow this  

Recommended Posts

I keep getting an attack detected every 5 minutes or so and I am pretty sure the address of 192.168.7.1 is my router. I will post the log below this and I am wondering what I can do to get this to stop. I am only getting these attacks on my laptop with Vista and not my desktop with XP. I have ran both adAware AE full scan, my anti-virus, and spybot S&D and none of them found anything. I appreciate any help anyone can give me.

 

3:34:59 PM Intruder unblocked

3:29:59 PM Intruder address: 192.168.7.1, host blocked for 5 minutes Blocked by IDS

3:29:59 PM Detected 49345, 50881, 52417, 53953, 50405, 48869, 47333, 51941, 38609, 48852 port(s) scanning from 192.168.7.1 SCAN

3:22:41 PM Intruder unblocked

3:17:41 PM Intruder address: 192.168.7.1, host blocked for 5 minutes Blocked by IDS

3:17:41 PM Detected 50925, 52461, 49389, 21754, 23290, 20218, 44751, 47823, 59612, 58076 port(s) scanning from 192.168.7.1 SCAN

 

This log has been repeating with different detected numbers in it over and over again since 1 AM my time.

Thanks again

Share this post


Link to post
Share on other sites

Hi

 

192.168 does sound like a NAT address from a router. Which model of router do you have?

 

How do you access the Internet from the Vista laptop? E.g. do you go direct via your router or do you use the XP desktop as a proxy or shared internet connection system?

 

Have you also tried running an Antivirus / Antispyware program on the XP desktop system?

Share this post


Link to post
Share on other sites
Hi

 

192.168 does sound like a NAT address from a router. Which model of router do you have?

 

How do you access the Internet from the Vista laptop? E.g. do you go direct via your router or do you use the XP desktop as a proxy or shared internet connection system?

 

Have you also tried running an Antivirus / Antispyware program on the XP desktop system?

 

I use a Linksys router that was originally installed on my desktop and I pick it up wirelessly for my laptop and desktop now. I have not tried to run anything on the desktop, do you think it might be something on there trying to get onto the laptop? I will run everything tonight to make sure it isn't something on there. I have this firewall on both so I would hope that it would pick it up no matter where it can in at, but I will definately try that out, thank you.

Share this post


Link to post
Share on other sites

Hi

 

Yes, the messages are incoming port scans being blocked so it suggests something outside of the laptop rather than something already on the laptop.

 

Definitely worth running an Antivrius scan etc on XP system.

 

Does the XP system also connect via a wireless connection to the router?

 

If the XP system comes up clean on an Antivirus scan then maybe something is trying to gain access though the wireless router. Do you know if you have setup this up to be hidden from general view?

Share this post


Link to post
Share on other sites
Hi

 

Yes, the messages are incoming port scans being blocked so it suggests something outside of the laptop rather than something already on the laptop.

 

Definitely worth running an Antivrius scan etc on XP system.

 

Does the XP system also connect via a wireless connection to the router?

 

If the XP system comes up clean on an Antivirus scan then maybe something is trying to gain access though the wireless router. Do you know if you have setup this up to be hidden from general view?

 

I don't think that I have it blocked from general view so I will look into that. My XP system is set up on the wireless system. Stupid house only has a phone jack in one bedroom and the kitchen. I will try all of this, thank you.

Share this post


Link to post
Share on other sites

Well it appears that the attacks have stopped. After running everything on my XP system and finding a few minor things, that might have been worse than I realize I haven't gotten a pop up about an attack in 24 hours. Thanks again guys for the help.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this