high amount of firewall intrusions with broadband

[ricardo.santos]

hi everyone!

about a week ago the area where i lived got covered by adsl/broadband. i requested the service and installed a firewall(zone alarm free)

after one week i had 16594 blocked intrusions
trojan and spyware are starting to affect my pc even tough i have:

zonealarm
avg
microsoft antyspyware
Adaware

are the intrusion numbers normal for a broadband connection?

this is really putting me off of having broadband, any advice on how to fight this plagues is apreciated

Ps: i heard routers are a big help

Ricardo

[CWR03]

Get a cable/DSL router, such as LinkSys, which has a hardware firewall. It has the added benefit of relieving your computer from the duty of driving the DSL modem.

Brushing your teeth regularly is the best way to fight the plague...or is that the plaque?

[tareek]

intrusion is very normal . search engines , various software , various hackers just doing it every second to different ip addresses .

"internet" is an open platform . its our responsibility to protect ourselves .

"Spybot Search & Destroy" is better than AdAware, because, it loads a (FREE)guard utility program in your memory, you'll see a tray icon for it, it protects you from spywares embedded in web pages . SS&D is one of the best ... in my opinion the best anti-spyware (as individual anti-spyware software) (if you're going to download it, then get the one version older than the current one) .

the DSL/Broadband modem comes from the DSL/Broadband provider, usually allots you an IP address, which is an "Internet IP Address" where attacking from outside is possible very easily . some modem have the feature to give you an "Private IP Address", for example, 192.168.1.2 . this Private IP Address is better than an Internet IP Address . those modem which lets you choose or have this feature is actually a modem + router . if your modem doesn't have the feature then get a router, as CWR03 suggested .

Run the below program ...
Start Menu - > All Programs - > Accessories - > Command Prompt

then type "IPCONFIG /ALL" in the command prompt, inside that window / dos box, then press enter, to find/see the IP address, currently alloted by your dsl/broadband modem for your PC's network card . if you know your PC's IP address then goto the first IP address of that sub-network, for example, for the previously mentioned private ip address 192.168.1.2, first IP address in the sub-net is 192.168.1.1 .

open up Internet Explorer(IE) , type in http://192.168.1.1/
and press enter.

modem/router manual should/will also specify somewhere, what this IP address exactly is, or, it will use a software, which you've installed from the CD which came with that modem/router . Use that software to change pasw0rd and settings .

in IE, after you typed & entered http://192.168.1.1/, if you see your modem's brand name or the broadband providers name, that means you're now conected to the modem . if you see a popup to enter name & pasw0rd, then try, "admin" for name, & "1234" as pasw0rd . usually this is the default pasw0rd, but see the modem's manual to find the correct pasw0rd . anyway, don't forget to change that default pasw0rd to a different one, that you can remember, and write it down somewhere, before you start changing any other settings . and never give that pasw0rd to anyone .

some firewall software (not the free version of ZoneAlarm) itself can stop various types of scripts, cookies, referrers, active content, Ads, Anti-Spyware, etc . Those built-in features are very very helpful in stopping attacks and spywares .

if you set your anti-virus(av) guard program to check all files, then any file which gets downloaded during your visit to any site, is scanned/checked by it, if a virus is present, av guard program will detect it, and you'll receive a popup warning of "virus found", always choose to delete it, then close that IE, and, clear your cache files, to clear IE cache ... you may goto ... Start Menu - > Control Panel - > Internet Options - > Click on "Delete Files" button on the "General" tab page, then click OK .

McAfee anti-virus is better than AVG, even the older ones .

[ricardo.santos]

HI

thank you tareek for all the suggestions!
i think i will have to consider buying a router.

can you help me with something(screenshot) that is bugging me for a couple of days

i googled for the services.exe and ive found that if the file serviceend with an "s" its a trojan, so im guessing the one i have is a trojan but its in a different folder of where it should be.

Spybot doesnt detect it

another question: any suggestions on firewals software(preferably free for the time being)?

one again thanks

[CWR03]

You can get a trial version of almost any firewall software, but I'd recommend an active virus scan along with a router instead. Having both a hardware and software firewall can affect your speed if it's not configured just right. You can also get a 30-day free trial of Spysweeper at Webroot.com, which has always found loads of spyware/adware that freeware programs missed.

[tareek]

Download this small utility software, "Process Explorer", from below site, developed by Mark Russinovich . Extremely helpful utility . http://www.sysinternals.com/Utilities/ProcessExplorer.html
create a sub-folder (for example, "SysInternals Process Explorer") inside the C:\Program Files\ , decompress the zip inside that sub-folder . right click, create shorcut, drag/copy that shortcut in your desktop . run it . right click on the "Process" of Process column, Select Columns, Put tick marks on "Command Line" & "Image Path", OK .

services.exe (approximate working set memory size is 4416 KB) (file size 108,032 Bytes for Win XP SP2 v5.1.2600.2180) is an extremely necessary part of the Windows XP Operating System . it runs from "C:\Windows\System32\services.exe" . if you see a second instance of this or a different location other than your windows installation folder, or a different file size then, very likely it is infected .

if system level files are infected then it is better to clean the whole hard drive by connecting it to a second computer where anti-virus guard and scanner software are loaded/installed, and are updated with the latest virus definition/signature file, and if that 2nd computer is not also infected .

[tareek]

Kerio Personal Firewall (Limited Free Edition)
(Kerio Tech. Inc is now acquired by Sunbelt Software) :
http://www.kerio.com/kpf_download.html

FREE for home and personal use . Limited free edition does not provide the content filtering capabilities such as blocking pop-up windows, ads, VB scripts, cookies, etc. and other extra features .

Comparison between full and free ...
http://www.kerio.com/kpf_comparison_version.html

[tareek]

Outpost Free Firewall (from Agnitum) :
http://www.agnitum.com/products/outpostfree/index.php

[rkhanso]

IPCop open source firewall. Runs on a separate PC (low-end) and is really cool. www.ipcop.org (http://www.ipcop.org)

[theReal]

Just like Tareek said: most events reported by ZoneAlarm are "Internet White Noise". There's thousands of port scans, searches, whatever, per second, and they might also ask your IP address for a certain service or open port. As long as your machine doesn't answer to those requests, everything's fine (and ZoneAlarm, when it reports an event, already blocked it, so you didn't answer and therefore anyone searching/portscanning can only assume your IP doesn't exist!)

[buzzqw]

just a note for avg

remove it. I like it but is too weak again trojan/malaware.

After 8 month of avg+ie6+outpost+winxp(sp2+all fix)(and 4mb adsl) i got six trojan. And avg never complained.

now i am using nod32+firefox+netlimiter firewall (seems very light and efficent) and never (afaik :rolleyes: ) got a viri

BHH

[theReal]

Oh yeah, I forgot: Get Firefox and dump IE. Then install the Firefox addon "noScript" - it globally deactivates JScript, but you can easily and quickly enable or temporarily enable scripting for single sites. You always know which sites are allowed to use scripts - the best addon for Firefox ever!

[mod]

Ethernet Router + AVG Free + ZoneAlarm Free + Firefox 1.5 (+ AdBlock) + Microsoft Antispyware Beta and I NEVER got any intrusion. (ADSL 6 mbit)