While I'm online browsing through this forum my anti-virus software detects these "SYN Port Scan Attacks" probably 2 or 3 times a day and the when the visual trace goes to work it always ends up being some ISP in Hong Kong.

I know sweet FA about this stuff can anyone explain whats going on and should I be worried about my computers sercurity?

Hi Adam,

Can you post me the logs of your SYN Port Attacks.

Can you also let me know. What software you are using to detect this? is it Black Ice?

Please provide me IP address, ports etc for anything you can give me. I will then get our server guy to investigate. I dont believe the site or server the site is on has been compromised in anyway.

Kind Regards,

Chris

The software is McAfee VirusScan 7.03.6000 with McAfee Firewall and Visual Trace. Where would I find the log files?

Just got another one! This one's from San Fransico. I spotted the save button after the trace was complete so here's the log.

trace.txt

Adam does this only happen when visiting the site? or in general?

Thanks

Looking at your logs they appear unrelated. Due to our site IP being the following:

Pinging fordxr6turbo.com [69.93.21.194] with 32 bytes of data:

Reply from 69.93.21.194: bytes=32 time=200ms TTL=53

Reply from 69.93.21.194: bytes=32 time=199ms TTL=53

Reply from 69.93.21.194: bytes=32 time=225ms TTL=53

Reply from 69.93.21.194: bytes=32 time=201ms TTL=53

Your log files show an ADSL client as the source of your scanning. It could be that this client is port scanning all avaliable ports within the 6*.** range.

I have also noted that the client is on the pacbell network.

68.120.0.0 - 68.127.255.255

Pac Bell Internet Services

208 Bush St. #5000

San Ramon

CA

94104

United States

I am getting our server admin to investigate.

90% of my time on the net would be on this site. But I have seen it happen to my boss when he was doing the internet banking. That's why I put the topic in chit chat because I didn't think it was directly related to this site. I didn't know what these attacks are and what they might be doing or trying to do, so I was just looking for some advice. :uziman:

I run an ISP and we log about 1,000,000,000 attempts per day !!!

This is now considered background noise of the net.

It is caused by worms and trojans either trying to infect other computers, or people trying to find infected PC's so that they can take control.

Well done on having a firewall program and AV software.

Everyone should have it. I prefer a SPI hardware firewall as it gives greater protection.

AdamXR6T,

Welcome to the wonderful world of Internet Security.

Basically you've got some script kiddie(s) playing around with some scanning tools looking for a hapless soul who has jumped online with a defenseless machine for them to bust into. Happens all the time, at least you know that your McAfee Firewall software is actually working for you and helping defend your PC against those kids who don't know any better.

Just a word to everyone - if you don't have anti-virus software and some sort of firewalling in front of you when you get online.... then one of these little :uziman: will get you one day.

'Net security is my other passion outside of the storage business that consumes my work life. Anyway, back into my cubicle I must go....

Thanks guys for this. It is appreciated. It has been confirmed that the scan is not related to the site, or by some trojan running on the server.

Thanks for your help.