Port Scans??????????

[Ironhorse]

My computer suddenly shows on my security that someone is scanning(?) certain areas of my computer. My question is, how can I get rid of this?????????? I have anti-virus, up to date, and firewall protection on my computer, also up to date. (Um, whatever you tell me, tell me in simple terms, I'm not real computer literate, LOL) Thanks.

[Nas]

How did you computer 'tell' you this? Did you look into some of the system information, or did something just pop up on your screen?

[Ironhorse]

a little screen from my security log pops up and says "Port scan attack logged". Then I can pull it up and see the time and what it is scanning, and from there I can back trace and see where it is coming from. (gee, all out of the US so far, big surprise). It shows the ISP, etc. Then I can click a icon that says "stop all active response". Then that's it till the next "attack". Shows it as a "minor" thing, but I'm not comfortable with anyone scanning my computer.

[Yosemite_Wolf]

sometimes if you are on certain programmes like chat or IM... the program i.e. yahoo messenger is scanning your isp to know where you are. For example:
on ylp forums when ever you post a msg your post shows your isp addy.

[Ironhorse]

Okay, that would make sense YW. My yahoo is always open when I am on the computer. I'll watch to see if I get these "attacks" when I close yahoo from now on. It always seems to be from the same 2 ISP's.

[Nas]

Punch the IP address into the WHOIS box on this website (http://www.dslreports.com/ip) and it should tell you some information about it.

For instance, when I checked my IP it came back as originating with Ponderosa Cablevision out of O'neals. Which isn't exact - I'm in North Fork, but I do get my service from Ponderosa.

The fact that you're being notified of it means that your firewall is catching it - for now. But port scans can be a bad sign of an impending attack, though there is some debate about that. See the following from Computerworld (http://www.computerworld.com/securitytopics/security/story/0,10801,106849,00.html) :

December 07, 2005 (Computerworld) -- The assumption that network port scans are a precursor to attempted hacks into computers may be misleading, according to research at the University of Maryland's A. James Clark School of Engineering.

An analysis of quantitative attack data gathered by the university over a two-month period shows that port scans precede attacks only around 5% of the time, said Michel Cukier, a professor in the Center for Risk and Reliability at the engineering school. In fact, more than half of all attacks are not preceded by a scan of any kind, he said.

"There's been a lot of discussion in the security community about whether a port scan portends an attack or not," Cukier said. "The goal of the research is to find a link between port scans and an attack."

Port scans are generally believed to be used by attackers to discover open or closed ports and unused network services they can try to exploit. Large increases in scans against particular ports have for long been viewed as a sure signal of impending attacks against that port.

But the evidence gathered from 48 days' worth of data collected from two honey-pot computers used for the study suggest otherwise, Cukier said. Only 28 out of 760 IP addresses tied to attacks against the university's computers launched a port scan prior to the attacks, he said. In contrast, 381 of the IP addresses launched attacks without any previous port scanning activity.

The study did find that 38% of the attacks were preceded by vulnerability scans, which are used by hackers to look for specific vulnerablities on network-attached computers, Cukier said.
The numbers suggest that it's only when port scans are combined with vulnerability scanning activity that there's a reasonably good chance of a follow-up attack, he said.

[Ironhorse]

Thanks Nas. I have Sygate and McAfee and update them from online and also use AdAware and run virus scans every couple of days. I just hadn't had the Port Scan attacks thing pop up before and didn't know what was going on. Now I can work on that. http://oakhurstonline.com/icon/happy.gif