OT: Help with a small issue

Renegade 13 · #1 July 29th, 2008, 06:33 AM

Ever since I installed Avast! Antivirus after removing Norton, I've been receiving alerts at irregular intervals while connected to the internet. By irregular I mean as often as every 10 minutes to as far apart as a couple of days. I've included a screenshot of the warning message attached to this post. It's worth noting that the IP address the attack is supposedly coming from is different each time.

If anyone could shed some light on this, it'd be awesome, thanks!

Suicide Junkie · #2 July 29th, 2008, 09:19 AM

Well, the internet *is* about that dirty from what I recall.

Xrati · #3 July 29th, 2008, 11:38 AM

Do you have a firewall installed other then windows firewall? What version of norton did you have? And did you check the registry for left-over tidbits from norton?

Fyron · #4 July 29th, 2008, 02:31 PM

Sounds like you do not have a router. You should get one, so that these sorts of random attacks are sent into oblivion and never reach the PC itself. Defense in depth is the only sane way to go.

Atrocities · #5 July 29th, 2008, 10:29 PM

Hey thats my IP!

Xrati · #6 July 29th, 2008, 11:44 PM

It figures!!!

Renegade 13 · #7 July 30th, 2008, 04:34 PM

Quote:

Xrati said:
Do you have a firewall installed other then windows firewall? What version of norton did you have? And did you check the registry for left-over tidbits from norton?

I don't think this is a firewall issue per se, it seems to be an external attack trying to penetrate a specific vulnerability.

Quote:

Sounds like you do not have a router. You should get one...

Correct, I don't have a router, nor will I be getting one.

I was hoping someone could point me at what the vulnerability is that someone's trying to exploit, and while the router suggestion is a good one, I doubt I'm going to be spending the money on a router just for the annoyance of these continual blocked attacks. I'd rather try to implement a software fix or patch whatever the problem is. If anyone has anything to offer on that front, I'd be most appreciative!

Fyron · #8 July 30th, 2008, 05:01 PM

If you want to know about the specifics of a DCOM exploit, Google can turn up info. If there is a pending fix, you'd find it in Windows Update (or at worst, on microsoft.com if it hasn't been pushed out on WU), which should be run on a regular basis. Just relying on manually patching specific exploits whenever Avast randomly detects them is an insufficient security protocol.

This is a firewall issue. The purpose of a firewall is to block unsolicited connections, in or out (such as random worm probes). You should install a full-fledged firewall to block such worms before Avast's shield can even see them (XP's firewall is useless). If you have a firewall and such probes are getting past it and detected by Avast, you need to either fix the settings or get a better one. I hear Komodo makes a good free one. This article should be of use:

http://arstechnica.com/guides/tweaks...sx-windows.ars

You really should invest in a router, though. No amount of software can possibly replace a SPI firewall/router box (even just a wimpy NAT router helps) in terms of random probe protection. Dropping all unsolicited incoming connections before they can even reach the PC is the best protection; on-system AV and firewalls are the last line of defense. You can probably pick up a cheap used router for ~$20.