Ask Me Help Desk

Ask Me Help Desk (https://www.askmehelpdesk.com/forum.php)
-   Firewalls (https://www.askmehelpdesk.com/forumdisplay.php?f=473)
-   -   ZoneAlarm Security Alerts (Urgent) (https://www.askmehelpdesk.com/showthread.php?t=60338)

  • Feb 5, 2007, 01:56 PM
    Asher
    ZoneAlarm Security Alerts (Urgent)
    Today, I've been receiving various security alerts from ZoneAlarm. I don't know that much about network security, but these are the messages that I just received.

    The firewall has blocked Internet access to your computer (TCP Port 55555) from ip56500def.direct-adsl.nl (86.80.13.239) (TCP Port 10440) (TCP Flags: S].
    The firewall has blocked Internet access to your computer (TCP Port 55555) from 218.80.228.35 (TCP Port 4632) (TCP Flags: S].
    The firewall has blocked Internet access to your computer (TCP Port 55555) from 218.80.228.35 (TCP Port 4734) (TCP Flags: S].
    The firewall has blocked Internet access to your computer (TCP Port 55555) from 190.49.129.130 (TCP Port 63407) (TCP Flags: S].
    The firewall has blocked Internet access to your computer (TCP Port 55555) from 218.80.228.35 (TCP Port 1087) (TCP Flags: S].
    The firewall has blocked Internet access to your computer (TCP Port 55555) from 218.80.228.35 (TCP Port 1105) (TCP Flags: S].
    The firewall has blocked Internet access to your computer (TCP Port 55555) from 218.80.228.35 (TCP Port 1123) (TCP Flags: S].

    For the past 30 minutes, I received about 15 or more of these alerts. I'm on edge right now and I really don't know what to do. I feel like I'm being attacked or something.. is there any way to be less vulnerable? Even if ZoneAlarm blocks them, they'll eventually manage to get in probably..

    I'm using a wireless router too, but I don't think it's because of that.. So please give me some guidance.

    But I don't know if it could be me because I tried refreshing a site that checks my ports.. and every time I refreshed, the number of alerts increases to 1. What the heck is going on with my ZA?

    Blast it.. this is so annoying. Now it's from me to these other IPs and addresses that I don't know of..

    The firewall has blocked Internet access to your computer (TCP Port 22239) from d150-150-132.home.cgocable.net (24.150.150.132) (TCP Port 1087) (TCP Flags: S).
    The firewall has blocked Internet access to your computer (TCP Port 22239) from def92-2-81-57-218-208.fpx.proxad.net (81.57.281.208) (TCP Port 1461) (TCP Flags: S).
    The firewall has blocked Internet access to your computer (TCP Port 22239) from 128.120.169.158 (TCP Port 4358) (TCP Flags: S).
    The firewall has blocked Internet access to your computer (TCP Port 22239) from 70.123.119.121 (TCP Port 1087) (TCP Flags: S).
    The firewall has blocked Internet access to your computer (TCP Port 22239) from c-bcb4e253.013-248-626f6410.cust.bredbandbolaget.se (83.226.180.188) (TCP Port 2049) (TCP Flags: S).
    The firewall has blocked Internet access to your computer (TCP Port 22239) from bb220-255-16-142.singnet.com sg (220.255.16.142) (TCP Port 1198) (TCP Flags: S).

    Just who exactly are these people! I use uTorrent for BT, but it's not on..
  • May 17, 2007, 12:02 PM
    c_starrs
    Zone Alarm is very sensitive to well... everything... these alerts are just telling you the comp is protected, what you can do, is go to Zone Alarm firewall setting, and make sure your ports hidden from the outside, but then, the problem with utorrent, and other torrent downloaders, is that it opens a port and starts fishing around the internet for seeds... if you can stop the alerts that way, you can disable them using ZA's options, telling it only to alert you in high risk situations, and it'll still block all the hackers in the background.

    And for your other question... these "people" are not all people, some are servers for torrent downloads, other are seeders, and some are harmless traffic, Zone Alarm just has a way of scaring the hell out of the average user...
  • May 17, 2007, 12:15 PM
    NeedKarma
    Here's the story behind those: these are probing attempts by anonymous people anywhere in the world. They set a port scanner, set a range of IP addresses to scan, and let it go for a few hours. They return to find a list of possible machines to hack. It all very impersonal so don't feel attacked. Many are also your own ISP probing the connection.

    Best to put it in silent mode. I forget how to do that now since I've been using a hardware firewall for the past 2 years.
  • May 30, 2007, 05:13 AM
    Dchdman
    Most of these are not a real problem and if your on a network with other computer most of these alert will be from theses computer. The real ones to look out for is if they come with a .com or email address. Also any other alert can be auto learn by zonealarm to ignore.

  • All times are GMT -7. The time now is 01:11 PM.