Did you click on "Learn more about this message" for additional information?
If your firewall or security software provides an alert
which indicates it has blocked access to a port
or detected an intrusion attempt that does not necessarily mean your system has been compromised. These alert messages are typically a response to unrequested traffic from remote computers
(an external host) to access a port on your computer.
It is not unusual
for firewalls, IP blocking software (i.e. PeerBlock) and some anti-virus programs to provide numerous alerts regarding probing and intrustion attempts to access your computer. Botnets
and Zombie computers
scour the net, randomly scanning a block of IP addresses
, searching for vulnerable ports
- commonly probed ports
and make repeated attempts to access them. However, not all unrequested traffic is malevolent. Even your ISP will send out regular checks to see if your computer is still there, so you may need to investigate an attempted intrusion.
Alerts are often classified by the network port they arrive on, and they allow the firewall to notify you in various ways about possible penetration and intrusion attempts on your computer. Even if the port is open, the alert message indicates that your firewall has blocked the attempt to access it.
Hackers use "port scanning
", a popular reconnaissance technique, to search for vulnerable computers with open ports using IP addresses or a group of random IP address ranges so they can break in and install malicious programs. Your security software is doing its job by blocking this kind of traffic and alerting you
about these intrusion attempts. For more information about Port Scanning, please refer to Port Scanning Basic Techniques
If your computer is sending out large amounts of data, that can indicate that your system may have a Trojan. Usually when a computer is infected with malware there most likely will be other obvious indications (signs of infection
) that something is wrong. Is your computer exhibiting such signs?