Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I Am Getting An Alert From My Fire Wall.


  • Please log in to reply
4 replies to this topic

#1 raidencmc

raidencmc

  • Members
  • 170 posts
  • OFFLINE
  •  
  • Local time:04:37 AM

Posted 21 August 2007 - 06:10 PM

I keep getting an alert stating that a certain IP address is trying to access my computer. I had a virus and did a fresh install of windows. This started afterwards. My firewall is blocking it but it still concerns me. I did a search on it and the results just pointed to something in Canada and it did not mean much to me. How can I figure out what this is and if it is a threat.

BC AdBot (Login to Remove)

 


m

#2 mommabear

mommabear

  • Members
  • 492 posts
  • OFFLINE
  •  
  • Local time:05:37 AM

Posted 22 August 2007 - 07:00 AM

Without more information, like what the traffic log says about it, it's hard to answer you. If you just reinstalled windows then you are starting fresh "training" your firewall. What firewall are you using?

But basically, what are you doing when this happens? It could be something as simple as a windows service "doing its thing" in the background. If it happens while online, then the alert could be normal. If you're modem is connected, but you're not actually surfing yet, it could still be normal activity. Did you just click to do something, like a link to another site, click for a download?

The general rule is, if you just clicked to do something and an alert comes up, then it's probably safe. But if in doubt, you can say "no", at least temporarily . Then if you repeat what you just did and the warning comes up again, then it's likely safe to say "yes" and then click "remember this setting" so you won't be bothered with warnings again for that particular thing.

You said your firewall is already blocking it. If you're able to do everything you need to do with it blocked, then set your firewall to always block it ("remember"), and that will get rid of the annoying notices.

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,560 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:37 AM

Posted 22 August 2007 - 07:29 AM

The goal of the firewall is to prevent remote computers from accessing yours and provide an alert of unrequested traffic that was blocked along with the IP address. Even your ISP will send out regular checks to see if your computer is still there.

Firewall alert messages are a response to unrequested traffic from remote computers. These alerts are often classified by the network port they arrive on and allow you to see the activity of what is happening on your firewall. The alerts allow the firewall to notify you in various ways about possible penetration and intrusion attempts on your computer. It is not unusal for a firewall to provide numerous alerts regarding such attempted access. Infected machines scour the net and will randomly scan a block of IP addresses. They search for vulnerable ports and make repeated attempts to access them. Your firewall is doing its job by blocking this kind of traffic and alerting you about these intrusion attempts.

If the alerts become too annoying, you should be able to go into your firewall settings and turn them off (Hide notification messages).
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 raidencmc

raidencmc
  • Topic Starter

  • Members
  • 170 posts
  • OFFLINE
  •  
  • Local time:04:37 AM

Posted 22 August 2007 - 08:11 PM

After the virus I did a clean install. After getting the messages about the blocked IP addres I got concerned. I have heard that after a clean install the virus can still exist in you system. So I ran spybot, nortons AV and super antispyware I still get a message about a trojan that cannot be removed. I ran Notrons again and it was fine but spybot still gave me the message about the trojan. I noticed that when I did the clean install it did not ask me what type of formatting I wanted. But before it began it said I was doing a quick format. That seemed suspicious. If I were to do a quick format could the virus or trojan still exist and if so how can I get rid of it.

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,560 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:37 AM

Posted 22 August 2007 - 10:04 PM

Did Spybot provide the name and location of this Trojan?

Have you tried doing your scans in "SAFE MODE"?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users