Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

Constant stream of UDP packets from same four addresses...

microsoft.public.windows.vista.security






Speedup My PC
Reply
  #1 (permalink)  
Old 04-21-2008
The Traveller
 

Posts: n/a
Constant stream of UDP packets from same four addresses...
I need some help with the following...

My router has been blocking a steady stream of UDP packets from the
same four IP addresses. This has been going on for several days now.

Here is an extract from the router's log. This same sequence repeats
itself "ad infinitum" ;-)

[INFO] Sun Apr 20 15:25:11 2008 Blocked incoming UDP packet from
207.118.109.219:50197 to 76.xxx.xxx.xxx:38043
[INFO] Sun Apr 20 15:25:05 2008 Blocked incoming UDP packet from
75.167.206.47:29547 to 76.xxx.xxx.xxx:38043
[INFO] Sun Apr 20 15:24:53 2008 Blocked incoming UDP packet from
71.54.69.146:14853 to 76.xxx.xxx.xxx:38043
[INFO] Sun Apr 20 15:24:51 2008 Blocked incoming UDP packet from
189.47.157.200:60611 to 76.xxx.xxx.xxx:38043

Just in case, I rebooted the router and the computer... same results.
I also checked SANS to see if there was any new activity and none was
noted in relation to these ports.

Comments?

______________________

The Traveller
Carlsbad, California
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 04-21-2008
Carey Frisch [MVP]
 

Posts: n/a
Re: Constant stream of UDP packets from same four addresses...
Consider installing a good antivirus program, such as Windows OneCare.
You can try it absolutely FREE for 90 days.
http://onecare.live.com/standard/en-us/default.htm

--
Carey Frisch
Microsoft MVP
Windows Desktop Experience -
Windows System & Performance

---------------------------------------------------------------

"The Traveller" wrote:

I need some help with the following...

My router has been blocking a steady stream of UDP packets from the
same four IP addresses. This has been going on for several days now.

Here is an extract from the router's log. This same sequence repeats
itself "ad infinitum" ;-)

[INFO] Sun Apr 20 15:25:11 2008 Blocked incoming UDP packet from
207.118.109.219:50197 to 76.xxx.xxx.xxx:38043
[INFO] Sun Apr 20 15:25:05 2008 Blocked incoming UDP packet from
75.167.206.47:29547 to 76.xxx.xxx.xxx:38043
[INFO] Sun Apr 20 15:24:53 2008 Blocked incoming UDP packet from
71.54.69.146:14853 to 76.xxx.xxx.xxx:38043
[INFO] Sun Apr 20 15:24:51 2008 Blocked incoming UDP packet from
189.47.157.200:60611 to 76.xxx.xxx.xxx:38043

Just in case, I rebooted the router and the computer... same results.
I also checked SANS to see if there was any new activity and none was
noted in relation to these ports.

Comments?

______________________

The Traveller
Carlsbad, California
Reply With Quote
  #3 (permalink)  
Old 04-21-2008
The Traveller
 

Posts: n/a
Re: Constant stream of UDP packets from same four addresses...
On Sun, 20 Apr 2008 21:18:09 -0500, "Carey Frisch [MVP]"
<cnfrisch@nospamgamil.com> wrote:

>Consider installing a good antivirus program, such as Windows OneCare.
>You can try it absolutely FREE for 90 days.
>http://onecare.live.com/standard/en-us/default.htm


Hmm... thanks, but I fail to see the relevance?

I am using AVG Security Suite 8.x on this computer, Norton 360 on my
wife's system, and the router has its own firewall. Remember that
those UDP packets are INBOUND and that they are being stopped by the
router. No unusual OUTBOUND traffic is being monitored (I even used
WIRESHARK to monitor all traffic).

______________________

The Traveller
Carlsbad, California
Reply With Quote
  #4 (permalink)  
Old 04-21-2008
Mick Murphy
 

Posts: n/a
Re: Constant stream of UDP packets from same four addresses...
You "might" have something on your computer that is trying to download more
garbage to infect your computer.

Try scanning with Spybot S & D, and then leave Spywareblaster running in the
background.

http://www.safer-networking.org/en/index.html

For Spyware removal, use the above link to “Spybot Search & Destroy 1.5.2”
Download it, install it, update it, immunize your system and scan your
System with it.

http://www.javacoolsoftware.com/

For a non-scanning, but running in the background, Program to STOP Spyware
being downloaded to your Computer, use SpywareBlaster 4, available at the
above link.


Mick Murphy - Qld - Australia


"The Traveller" wrote:

> On Sun, 20 Apr 2008 21:18:09 -0500, "Carey Frisch [MVP]"
> <cnfrisch@nospamgamil.com> wrote:
>
> >Consider installing a good antivirus program, such as Windows OneCare.
> >You can try it absolutely FREE for 90 days.
> >http://onecare.live.com/standard/en-us/default.htm

>
> Hmm... thanks, but I fail to see the relevance?
>
> I am using AVG Security Suite 8.x on this computer, Norton 360 on my
> wife's system, and the router has its own firewall. Remember that
> those UDP packets are INBOUND and that they are being stopped by the
> router. No unusual OUTBOUND traffic is being monitored (I even used
> WIRESHARK to monitor all traffic).
>
> ______________________
>
> The Traveller
> Carlsbad, California
>

Reply With Quote
  #5 (permalink)  
Old 04-22-2008
The Traveller
 

Posts: n/a
Re: Constant stream of UDP packets from same four addresses...
On Mon, 21 Apr 2008 12:43:01 -0700, Mick Murphy
<MickMurphy@discussions.microsoft.com> wrote:

>You "might" have something on your computer that is trying to download more
>garbage to infect your computer.
>
>Try scanning with Spybot S & D, and then leave Spywareblaster running in the
>background.


Nope... scanned using emergency CD to no avail. Used AVG's emergency
disk and Ad-Aware. WIRESHARK shows no outgoing activity. I will run
SPYBOT S&D and report back.

However, 3/5 UPD sources have stopped pinging me.

To my surprise, ISPs "do" respond to problems.

I traced each of the five offenders. Some were in Brazil and in Europe
while the others were in the USA. I then sent polite E-mail messages
to the security administrators for each ISP. The first to respond was
COMCAST (pre-canned message). However, it did not stop there.
COMCAST took action. I can see in my log when another IP from COMCAST
probed my system (TCP & UDP), then killed the offending IP address.
(i.e. multiple probes, then the offending IP disappeared).

Next was the ISP from Brazil. Very similar logs... they probe my
system then kill the IP. The same occurred for another one in Europe.

Now only two remain and one of the ISPs responded that the
administrator was out until Wednesday (sic)

There is hope ;-)

______________________

The Traveller
Carlsbad, California
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows stalked by rogue packets? Steve Security News 0 03-01-2008 11:10
UDP Packets & Wireless. SGA Windows Vista Ultimate 1 02-15-2008 14:28
Mystery Packets, Protocol 139, (Tue, Nov 20th) Steve Security News 0 11-20-2007 17:40
Deformed TCP Options - Got Packets?, (Fri, Mar 2nd) Steve Security News 0 03-02-2007 10:34
GetPrinterDataEx packets ferozf microsoft.public.windows.vista.networking sharing 0 12-22-2006 14:00




All times are GMT +1. The time now is 03:39.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120