Drider_it

ok

a. how do i find what is being used on a port

b. how do i close it

my firewall picked up a trojan scan on one of my ports nothing is going out but that port is open.. i dont have a trojan i should say... but the port is open and can be scanned..

what do i do?

__________________
It means only one thing, and everything: Cut. Once committed to fight, Cut. Everything else is secondary. Cut. That is your duty, your purpose, your hunger. There is no rule more important, no commitment that overrides that one. Cut. The lines are a portrayal of the dance. Cut from the void, not from bewilderment. Cut the enemy as quickly and directly as possible. Cut with certainty. Cut decisively, resoultely. Cut into his strength. Flow through the gaps in his guard. Cut him. Cut him down utterly. Don't allow him a breath. Crush him. Cut him without mercy to the depth of his spirit. It is the balance to life: death. It is the dance with death. It is the law a war wizard lives by, or he dies.

Cynthetiq

depends on what port it was. some ports need to be open for certain applications. what port was scanned?

__________________
I don't care if you are black, white, purple, green, Chinese, Japanese, Korean, hippie, cop, bum, admin, user, English, Irish, French, Catholic, Protestant, Jewish, Buddhist, Muslim, indian, cowboy, tall, short, fat, skinny, emo, punk, mod, rocker, straight, gay, lesbian, jock, nerd, geek, Democrat, Republican, Libertarian, Independent, driver, pedestrian, or bicyclist, either you're an asshole or you're not.

God of Thunder

What port?

What firewall are you using?

Hardware or software firewall?

We need this information before we can provide an answer.

__________________
I reject your reality, and substitute my own

-- Adam Savage

Slavakion

If you get a router, it'll close all ports except for a few (and ones you specify). Then a firewall should tell you when a program tries to get in or out.

A cheap router probably costs $20 and a firewall is free. Check out ZoneAlarm or Sygate. Use Sygate if you use p2p.

bendsley

NMAP (*nix and windows versions available) will tell you which ports are open on a specific machine.

In windows, "netstat" can also give you good information.

__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."

Drider_it

sygate and port 5000 is what is listed on the scan

__________________
It means only one thing, and everything: Cut. Once committed to fight, Cut. Everything else is secondary. Cut. That is your duty, your purpose, your hunger. There is no rule more important, no commitment that overrides that one. Cut. The lines are a portrayal of the dance. Cut from the void, not from bewilderment. Cut the enemy as quickly and directly as possible. Cut with certainty. Cut decisively, resoultely. Cut into his strength. Flow through the gaps in his guard. Cut him. Cut him down utterly. Don't allow him a breath. Crush him. Cut him without mercy to the depth of his spirit. It is the balance to life: death. It is the dance with death. It is the law a war wizard lives by, or he dies.

neekap

netstat will tell you what active connections you have (run netstat /a), but to see what processes have which connections you can download a utility called FPort at http://www.foundstone.com/resources/proddesc/fport.htm which will tell you that information.

Drider_it

2004/09/04 17:52:51 12.181.67.11:3183 (ip-12-181-67-11.dsl0-blvrtx.gvtc.com) 12.183.196.200:5000 Bubbel Trojan / Back Door Setup / Sockets de Troie Trojan

A computer at ip-12-181-67-11.dsl0-blvrtx.gvtc.com has attempted an unsolicited connection to TCP port 5000 on your machine.
TCP port 5000 is commonly used by the Bubbel Trojan / Back Door Setup / Sockets de Troie Trojan service or program. The Source computer has scanned your machine for this trojan, but this has been blocked by our security filters.


OrgName: AT&T WorldNet Services
OrgID: ATTW
Address: 400 Interpace Parkway
City: Parsippany
StateProv: NJ
PostalCode: 07054
Country: US

NetRange: 12.0.0.0 - 12.255.255.255
CIDR: 12.0.0.0/8
NetName: ATT
NetHandle: NET-12-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: DBRU.BR.NS.ELS-GMS.ATT.NET
NameServer: DMTU.MT.NS.ELS-GMS.ATT.NET
NameServer: CBRU.BR.NS.ELS-GMS.ATT.NET
NameServer: CMTU.MT.NS.ELS-GMS.ATT.NET
Comment: For abuse issues contact abuse@att.net
RegDate: 1983-08-23
Updated: 2002-08-23

TechHandle: DK71-ARIN
TechName: Kostick, Deirdre
TechPhone: +1-919-319-8249
TechEmail: help@ip.att.net

OrgAbuseHandle: ATTAB-ARIN
OrgAbuseName: ATT Abuse
OrgAbusePhone: +1-919-319-8130
OrgAbuseEmail: abuse@att.net

OrgTechHandle: ICC-ARIN
OrgTechName: IP Customer Care
OrgTechPhone: +1-888-613-6330
OrgTechEmail: qhoang@att.com

OrgTechHandle: IPSWI-ARIN
OrgTechName: IP SWIP
OrgTechPhone: +1-888-613-6330
OrgTechEmail: help@ip.att.net

ARIN WHOIS database, last updated 2004-09-03 19:10
Enter ? for additional hints on searching ARIN's WHOIS database.

egistrant:
Guadalupe Valley Telephone Coop (GVTC-DOM)
36101 FM 3159
New Braunfels, TX 78132
US

Domain Name: GVTC.COM

Administrative Contact:
Buckelew, John (JBZ872) webmaster@GVTC.COM
Guadalupe Valley Telephone Co-op
36101 FM 3159
New Braunfels, TX 78132
US
830.885.4411 fax: 830-885-2400

Technical Contact:
Eikel, Jon (NVLEKNPWBI) netops@GVTC.COM
Guadalupe Valley Network Operations
36101 FM 3159
NEW BRAUNFELS, TX 78132-5903
US
830-885-4411 x318 fax: 830-885-4953

Record expires on 12-Apr-2010.
Record created on 11-Apr-1996.
Database last updated on 4-Sep-2004 19:50:55 EDT.

Domain servers in listed order:

AUTH1.GVTC.COM 216.177.160.39
AUTH2.GVTC.COM 216.177.160.40

that is what is hitting my port 5000 i dont have a trojan as far as i know of.. but still im confused why this tard is hitting me. that is the info i got traceing the ip that hit me

any clue what i should do? probally a proxie but dont know

__________________
It means only one thing, and everything: Cut. Once committed to fight, Cut. Everything else is secondary. Cut. That is your duty, your purpose, your hunger. There is no rule more important, no commitment that overrides that one. Cut. The lines are a portrayal of the dance. Cut from the void, not from bewilderment. Cut the enemy as quickly and directly as possible. Cut with certainty. Cut decisively, resoultely. Cut into his strength. Flow through the gaps in his guard. Cut him. Cut him down utterly. Don't allow him a breath. Crush him. Cut him without mercy to the depth of his spirit. It is the balance to life: death. It is the dance with death. It is the law a war wizard lives by, or he dies.

zynyxx

Just being connected to the internet you will see activity like this. I would doubt if anyone is trying to hit your system specifically. Most likely it is a stupid script kiddie scanning a range of IP addresses to see what is out there. That is why a firewall/router is a requirement for anyone attached to the internet .. at least in my opinion. As long as you have an updated anti-virus, run spyware detection, and have a firewall you should be ok.