[Facedown98]

Nice test.

Have you made any changes to Windows lately, including but not limited to new software installations?

When exactly did this start?

Anything different you've noticed?

[Advertisements]

No other changes made. Seemed to happen after a power outage. I was play TF2 at the time the power went out. The internet didn't work when I booted up the next morning. I couldn't have made any changes during that period.

[Titan8990]

No other changes made. Seemed to happen after a power outage. I was play TF2 at the time the power went out. The internet didn't work when I booted up the next morning. I couldn't have made any changes during that period.

[Titan8990]

Ehhh, just booted into Windows and it looks like my router is now working there.

Now thats out of the way, is there anything I can do stop these attempts to bypass my firewall other than letting my firewall take care of it?

[Facedown98]

Are the attempts always from the same location? Just to make sure nothing new has happened, post the IP or name which is tapping into your computer.

[Titan8990]

There are many different IPs that are hitting it. Many of them are in the same range for example: 24.64.xxx.xxx. For now I will list the one high risk rated one in my log: 74.128.99.82

[Facedown98]

That IP appears to be a communication company, possibly your ISP.

Are there any that are totally foreign? When I say that, I mean IPs that come out of the blue more-less. I still don't know why they're being detected by ZoneAlarm... What's your security level set to?

[Titan8990]

It is set to high. The ISP that you looked up, I looked up aswell. That is not my ISP. Two high rated one that I caught and stood out were in my orginal post. I no longer have the IP but it showed up as this in the whois database:

Netname: A1DIALUP-NET
Range: 211.99.192.0 - 211.99.199.255
Location: Beijing, China

The blocks were on port 80, the HTTP port.

Edit: Also, these are no longer existant but what was the deal with them?

Netstat from command prompt show two open ports without IE running.

1. local: TCP [computername]:2437 foreign: 72-165-61-141.dia.static.qwest.net:27039
2. local: TCP [computername]:2730 foreign: 72-165-61-141.dia.static.qwest.net:27039

Edited by Titan8990, 12 February 2008 - 07:48 PM.