Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Scary Message From Zonealarm


  • Please log in to reply
No replies to this topic

#1 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:06:13 PM

Posted 16 July 2006 - 08:41 AM

Last night, I was using my laptop to connect to a public wireless accesspoint (which I do often) when ZoneAlarm Pro gave me a cryptic popup message saying something about netbios being blocked. The same message popped up 5 or 6 more times, each time saying it was blocked.

Looking at the event log on ZoneAlarm, I found this entry:

Description Packet sent from 172.20.4.53 (TCP Port 57384) to 172.20.4.36 (NetBIOS Session) was blocked
Rating High
Date / Time 2006/07/14 23:30:46-4:00 GMT
Type Firewall
Protocol TCP (flags:S)
Program
Source IP 172.20.4.53:57384
Destination IP 172.20.4.36:139
Direction Incoming
Action Taken Blocked
Count 1
Source DNS
Destination DNS COLOSSUS


The explanation from Zonelabs is:

ZoneAlarm Pro prevented a remote computer from connecting to port 139 on your computer. If you are sharing files on a local network, this connection attempt was probably legitimate network traffic. Port 139 is commonly used by networked Windows computers to enable file sharing and other resource sharing. However, if the traffic that generated this alert came from the Internet rather than a local network, this may have been attack on your computer


I'm not sharing files on a local network. Was this an attack?

Edited by Amazing Andrew, 16 July 2006 - 08:43 AM.


BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users