uh oh, did i get hacked?

[bandXtrb]

Okay, I am a pretty clueless noob about this, so please bear with me... I have two computers, router, dsl connection.

[*]Main computer (192.168.0.2) is Win2k pro, has Zonealarm has all MS updates, and Norton AV with up to date virus definitions.
[*]Other computer (IP assigned at startup) is Win2k pro, has Zonealarm; didn't get around to installing updates.

On my main computer, Zonealarm says: The firewall has blocked Internet access to your computer (ICMP Unreachable) from 128.172.64.48. Occurred: 4 times between 5/7/2002 2:47:12 AM and 5/7/2002 2:47:18 AM



BUT.. on my other computer it says:

The firewall has blocked access to your computer (TCP port 1214) from 192.168.0.2 (TCP Port XXXX) [TCP Flags: S]

There are 121 of these alerts, from 3:11AM to 10:52 AM. The number "XXXX" goes from port 1831 all the way up to 3333. Looks like I got port scanned?


Had kazaa open all night on main computer, maybe this had something to do with it?

 

[crab]

192.168.0.2 is on your own home network

 

[Zim Hosein]

From what you posted, I would say that you were scanned, but ZA blocked any access

 

[bandXtrb]

<< 129.168.0.2 is on your own home network >>

Yeah, so why would it scan me?

 

[chickendinner]

<< << 129.168.0.2 is on your own home network >>

Yeah, so why would it scan me? >>


To see if you have a trojan.

 

[bandXtrb]

<< To see if you have a trojan. >>



Yes, but 192.168.0.2 is my main computer. How could it scan the other computer, unless someone somehow has access to it?

 

[crab]

<<

<< To see if you have a trojan. >>



Yes, but 192.168.0.2 is my main computer. How could it scan the other computer, unless someone somehow has access to it? >>



My guess is that it's just checking up...

 

[dakata24]

under advanced in zonealarm, did you add your computers under the local zone properties?

if not, on each computer, add the other on their.. that problem should go away.. unless you have local security set to high, in that case, you'll get the same warning.

edit: not sure why it's not doing the same on the 1st computer with 192.168.0.2 .

 

[bandXtrb]

Nope, I did not add other computers. I've received occasional alerts from the other computers in the past, but never so many in such a short time. I will try adding the computers, though.

My friend suggested that someone may have been port scanning and faking the address of my other PC, or "spoofing."

 

[Instagib]

<< From what you posted, I would say that you were scanned, but ZA blocked any access >>

 

[chickendinner]

<< My friend suggested that someone may have been port scanning and faking the address of my other PC, or "spoofing." >>



Well thats how you hack.

 

[dakata24]

in any case.. download Swat-It Trojan Scanner

it's freeware. make sure to update the signature file b/c they just came out with a new one about a week ago. doesnt scanned compressed files, or does it do background scanning, but it's free so you cant beat that..

 

[her209]

What kind of NAT router do you have? Do you have any ports forwarded to any of your computers?

 

[911paramedic]

Are you running IIS?