I run XP Sp2 with the latest updates, webroot, AVG antivirus all with latest update. My problems started while i had Outpost Firewall Professional installed. I will get connected, surf a while (sometimes for up to 4 hours, at other times for a half hour) when suddenly I get disconnected. As soon as I reconnect Outpost gives me alerts that portscans are being done. This will carry on for hours. 95% of these scans is within the same IP address range 155.239 - - (the same as mine). I complained about this to my Service Provider with little effect. Since i complained the situation has worsened. Where i only got disconnected once(before the scans started) I now get disconnected even while the scans are in progress.
I have formatted my hard drive several times, reinstalled my OS etc. disabled unneccesary services (hardening) changed to Zone alarm firewall for more control, but the problem is stil there. With zone alarm I noticed that:
- immediately after connection intrusions are blocked;
- most of the intrusions are from the same IP address range as stated above;
- 95% are rated as medium, concerns the TCP protocol
- I get the occasional UDP and ICMP Echo Request(ping)
- High Risks of packets send (NETBIOS Session)
- Just about every 4 digit port (e.g. 1814) are used by the preps
- Some entries shows the program being used as Generic Host Process for Win32 Services
I still get disconnected. When this happens I immediately inspect the log files but cant pick up anything unusual.
Once, before i got disconnected a window suddenly popped up informing me that an incomming call wants access (or something to that effects) there was a progress bar for a few seconds and i had the option to accept or decline. Before i could react I got disconnected and the window dissapeared.
Since then I got disconnected again while I was working, but the mentioned window did not show up.
Can anyone please advice me what to do or what is happening here. This is driving me crazy and is costing me a lot of money.