port scan attack every time i log on to trainz

[misterchugg]

hi all

for the last week i have been port scan attacked every time i log on to the trainz website here.

is anybody else getting this?

thanks

ron

 

[ct_krogen]

hi all

for the last week i have been port scan attacked every time i log on to the trainz website here.

is anybody else getting this?

thanks

ron

not here........

 

[RRSignal]

hi all

for the last week i have been port scan attacked every time i log on to the trainz website here.

is anybody else getting this?

thanks

ron

What ports are being scanned? UDP, TCP or some other protocol? Fragmented packets or not?

 

[misterchugg]

hi
see the following and let me know what else to do to tell you

thanks
ron

 

[RRSignal]

hi
see the following and let me know what else to do to tell you

thanks
ron

Looks like someone from China is looking for open proxies. And this only happens when you log onto the DLS?

 

[sniper297]

Yeah, http://whatismyipaddress.com/ip/222.192.199.49 comes back to a college in Yangzhou. I suspect you have some type of trojan or other malware you picked up from some other website. Facebook is notorious for that if you click one of them links that asks to access your details;

I always click the back button when I see one of those, some of them even have you granting permission to use your IP address and FB account when it's idle - whatever all these other people are looking at, I don't need to see it bad enough to take them kind of risks. :n:

 

[fran1]

http://forums.malwarebytes.org/index.php?showtopic=9573

Hi Ron,

Seems to be a few people got it whatever it is. I put the IP add in as you gave it and the link is a way to get rid.
You collect problems dont you.
see You Fran.

 

[misterchugg]

hi all

i've never joined facebook or any of the online things bar for dreddman's yahoo site

fran
ran the test and came up empty.
see below

thanks for the help

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5282

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

10/12/2010 8:33:36 AM
mbam-log-2010-12-10 (08-33-36).txt

Scan type: Full scan (C:\|)
Objects scanned: 146853
Time elapsed: 9 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

[RRSignal]

If it's happening every time you log onto the forums, DLS, or some other specific event, I have to suspect malware of some sort. However, do you have more log info, ports and what was happening at the time? I'm also thinking maybe putting up some FW rules as well.

 

[misterchugg]

hi
i done some testing and i think its from a safeguard thing someone told us here on the forum

its called maximum adblock free and is an attachment to firefox

if its not turned on, then so far i haven't got port scans

weird eh?

thanks
ron

 

[RRSignal]

hi
i done some testing and i think its from a safeguard thing someone told us here on the forum

its called maximum adblock free and is an attachment to firefox

if its not turned on, then so far i haven't got port scans

weird eh?

thanks
ron

Kinda makes sense, actually. Ad-blocking proxies have been around a very long time. They can be highly-effective tools at blocking ads, stripping out malicious code, and even IP anonymization. Conversely, they can be one of the most effective methods to snoop on people and gather data; it all depends on the motivations of the persons running the proxy.

That said, I wouldn't use this as an ad-blocking method. Not just because of the risk factor, but because better (and probably faster) methods already exist e.g. AdBlock Plus, a very small but well-designed HOSTS file, etc. which have little or zero risk factor but plenty of benefits.

 

[misterchugg]

thank you

its installed and working

no more port scans when i log on here

thanks again
ron