|
08-23-2004, 08:29 AM
|
#1 (permalink) |
|
Junkie
Location: Louisiana
|
closing a port
ok
a. how do i find what is being used on a port b. how do i close it my firewall picked up a trojan scan on one of my ports nothing is going out but that port is open.. i dont have a trojan i should say... but the port is open and can be scanned.. what do i do?
__________________
It means only one thing, and everything: Cut. Once committed to fight, Cut. Everything else is secondary. Cut. That is your duty, your purpose, your hunger. There is no rule more important, no commitment that overrides that one. Cut. The lines are a portrayal of the dance. Cut from the void, not from bewilderment. Cut the enemy as quickly and directly as possible. Cut with certainty. Cut decisively, resoultely. Cut into his strength. Flow through the gaps in his guard. Cut him. Cut him down utterly. Don't allow him a breath. Crush him. Cut him without mercy to the depth of his spirit. It is the balance to life: death. It is the dance with death. It is the law a war wizard lives by, or he dies. |
|
|
08-23-2004, 08:35 AM
|
#2 (permalink) |
|
Tilted Cat Head
Administrator
Location: Manhattan, NY
|
depends on what port it was. some ports need to be open for certain applications. what port was scanned?
__________________
I don't care if you are black, white, purple, green, Chinese, Japanese, Korean, hippie, cop, bum, admin, user, English, Irish, French, Catholic, Protestant, Jewish, Buddhist, Muslim, indian, cowboy, tall, short, fat, skinny, emo, punk, mod, rocker, straight, gay, lesbian, jock, nerd, geek, Democrat, Republican, Libertarian, Independent, driver, pedestrian, or bicyclist, either you're an asshole or you're not. |
|
|
|
08-23-2004, 09:16 AM
|
#4 (permalink) |
|
Mjollnir Incarnate
Location: Lost in thought
|
If you get a router, it'll close all ports except for a few (and ones you specify). Then a firewall should tell you when a program tries to get in or out.
A cheap router probably costs $20 and a firewall is free. Check out ZoneAlarm or Sygate. Use Sygate if you use p2p. |
|
|
|
08-23-2004, 09:18 AM
|
#5 (permalink) |
|
Professional Loafer
Location: texas
|
NMAP (*nix and windows versions available) will tell you which ports are open on a specific machine.
In windows, "netstat" can also give you good information.
__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane." |
|
|
|
08-23-2004, 02:14 PM
|
#6 (permalink) |
|
Junkie
Location: Louisiana
|
sygate and port 5000 is what is listed on the scan
__________________
It means only one thing, and everything: Cut. Once committed to fight, Cut. Everything else is secondary. Cut. That is your duty, your purpose, your hunger. There is no rule more important, no commitment that overrides that one. Cut. The lines are a portrayal of the dance. Cut from the void, not from bewilderment. Cut the enemy as quickly and directly as possible. Cut with certainty. Cut decisively, resoultely. Cut into his strength. Flow through the gaps in his guard. Cut him. Cut him down utterly. Don't allow him a breath. Crush him. Cut him without mercy to the depth of his spirit. It is the balance to life: death. It is the dance with death. It is the law a war wizard lives by, or he dies. |
|
|
|
08-23-2004, 04:02 PM
|
#7 (permalink) |
|
Tilted
Location: Central OH
|
netstat will tell you what active connections you have (run netstat /a), but to see what processes have which connections you can download a utility called FPort at http://www.foundstone.com/resources/proddesc/fport.htm which will tell you that information.
|
|
|
|
09-04-2004, 03:55 PM
|
#8 (permalink) |
|
Junkie
Location: Louisiana
|
2004/09/04 17:52:51 12.181.67.11:3183 (ip-12-181-67-11.dsl0-blvrtx.gvtc.com) 12.183.196.200:5000 Bubbel Trojan / Back Door Setup / Sockets de Troie Trojan
A computer at ip-12-181-67-11.dsl0-blvrtx.gvtc.com has attempted an unsolicited connection to TCP port 5000 on your machine. TCP port 5000 is commonly used by the Bubbel Trojan / Back Door Setup / Sockets de Troie Trojan service or program. The Source computer has scanned your machine for this trojan, but this has been blocked by our security filters. OrgName: AT&T WorldNet Services OrgID: ATTW Address: 400 Interpace Parkway City: Parsippany StateProv: NJ PostalCode: 07054 Country: US NetRange: 12.0.0.0 - 12.255.255.255 CIDR: 12.0.0.0/8 NetName: ATT NetHandle: NET-12-0-0-0-1 Parent: NetType: Direct Allocation NameServer: DBRU.BR.NS.ELS-GMS.ATT.NET NameServer: DMTU.MT.NS.ELS-GMS.ATT.NET NameServer: CBRU.BR.NS.ELS-GMS.ATT.NET NameServer: CMTU.MT.NS.ELS-GMS.ATT.NET Comment: For abuse issues contact abuse@att.net RegDate: 1983-08-23 Updated: 2002-08-23 TechHandle: DK71-ARIN TechName: Kostick, Deirdre TechPhone: +1-919-319-8249 TechEmail: help@ip.att.net OrgAbuseHandle: ATTAB-ARIN OrgAbuseName: ATT Abuse OrgAbusePhone: +1-919-319-8130 OrgAbuseEmail: abuse@att.net OrgTechHandle: ICC-ARIN OrgTechName: IP Customer Care OrgTechPhone: +1-888-613-6330 OrgTechEmail: qhoang@att.com OrgTechHandle: IPSWI-ARIN OrgTechName: IP SWIP OrgTechPhone: +1-888-613-6330 OrgTechEmail: help@ip.att.net ARIN WHOIS database, last updated 2004-09-03 19:10 Enter ? for additional hints on searching ARIN's WHOIS database. egistrant: Guadalupe Valley Telephone Coop (GVTC-DOM) 36101 FM 3159 New Braunfels, TX 78132 US Domain Name: GVTC.COM Administrative Contact: Buckelew, John (JBZ872) webmaster@GVTC.COM Guadalupe Valley Telephone Co-op 36101 FM 3159 New Braunfels, TX 78132 US 830.885.4411 fax: 830-885-2400 Technical Contact: Eikel, Jon (NVLEKNPWBI) netops@GVTC.COM Guadalupe Valley Network Operations 36101 FM 3159 NEW BRAUNFELS, TX 78132-5903 US 830-885-4411 x318 fax: 830-885-4953 Record expires on 12-Apr-2010. Record created on 11-Apr-1996. Database last updated on 4-Sep-2004 19:50:55 EDT. Domain servers in listed order: AUTH1.GVTC.COM 216.177.160.39 AUTH2.GVTC.COM 216.177.160.40 that is what is hitting my port 5000 i dont have a trojan as far as i know of.. but still im confused why this tard is hitting me. that is the info i got traceing the ip that hit me any clue what i should do? probally a proxie but dont know
__________________
It means only one thing, and everything: Cut. Once committed to fight, Cut. Everything else is secondary. Cut. That is your duty, your purpose, your hunger. There is no rule more important, no commitment that overrides that one. Cut. The lines are a portrayal of the dance. Cut from the void, not from bewilderment. Cut the enemy as quickly and directly as possible. Cut with certainty. Cut decisively, resoultely. Cut into his strength. Flow through the gaps in his guard. Cut him. Cut him down utterly. Don't allow him a breath. Crush him. Cut him without mercy to the depth of his spirit. It is the balance to life: death. It is the dance with death. It is the law a war wizard lives by, or he dies. |
|
|
|
09-09-2004, 11:26 AM
|
#9 (permalink) |
|
Tilted
|
Just being connected to the internet you will see activity like this. I would doubt if anyone is trying to hit your system specifically. Most likely it is a stupid script kiddie scanning a range of IP addresses to see what is out there. That is why a firewall/router is a requirement for anyone attached to the internet .. at least in my opinion. As long as you have an updated anti-virus, run spyware detection, and have a firewall you should be ok.
|
|
|
| Tags |
| closing, port |
|
|
