Some sorta virus attack...... "Xmas port scan attack"

I noticed today that I couldn't load onto other pages other than GFF because it's my homepage. No outside pictures other than from GFF are loaded.

I can get into MSN and play games and such though, it doesn't allow me to surf outside links however.

I checked my wireless router log and found this:

Quote:

Jan 3 04:10:58 Xmas port scan attack from WAN (ip:207.68.178.239) detected.
Jan 3 03:43:03 Xmas port scan attack from WAN (ip:207.68.178.239) detected.
Jan 3 03:37:11 Xmas port scan attack from WAN (ip:65.54.195.185) detected.
Jan 3 03:26:48 Xmas port scan attack from WAN (ip:124.176.77.38) detected.
Jan 3 03:17:43 Xmas port scan attack from WAN (ip:65.54.195.185) detected.
Jan 3 03:12:46 Remote management is disabled.
Jan 3 03:12:46 Block WAN PING is disabled.
Jan 3 03:12:45 DMZ disabled.
Jan 3 03:12:41 DHCP: Client receive ACK from 24.215.0.6, IP=71.19.9.111, Lease time=28800.
Jan 3 03:04:45 Xmas port scan attack from WAN (ip:65.54.195.185) detected.

Note that the date is off since I didn't set the proper time on my router, so ya.

---

I set up MAC address filtering so only the 3 computers at home can get through.... so I don't know what happened.

Currently running some scans to find the problem, if I can.

Can anyone suggest anything? Or if someone has had the same problem, please share how to remedy it.


EDIT: I like how my Norton program found nothing wrong......

EDIT2: I noticed for the last 2 days I've had this, it just started to kick in now....

the beginning

Quote:

Jan 2 06:07:36 SYN-ACK port scan attack from WAN (ip:198.166.231.179) detected.
Jan 2 06:07:35 Xmas port scan attack from WAN (ip:69.233.195.147) detected.
Jan 2 06:07:29 SYN-ACK port scan attack from WAN (ip:198.166.231.179) detected.
Jan 2 06:07:26 SYN-ACK port scan attack from WAN (ip:198.166.231.179) detected.
Jan 2 06:06:53 Xmas port scan attack from WAN (ip:69.149.124.161) detected.
Jan 2 06:06:41 Xmas port scan attack from WAN (ip:142.179.5.255) detected.
Jan 2 06:06:28 SYN-ACK port scan attack from WAN (ip:198.166.231.179) detected.
Jan 2 06:06:21 SYN-ACK port scan attack from WAN (ip:198.166.231.179) detected.
Jan 2 06:06:19 SYN-ACK port scan attack from WAN (ip:198.166.231.179) detected.
Jan 2 06:04:10 Xmas port scan attack from WAN (ip:207.68.178.16) detected.

EDIT3: I'm currently on my laptop at the moment using someone's unsecured wireless (heh). So I tried connecting to my router, it gives a perfect connection, but I still can't load anything.

My two home computers now don't load anything, not even GFF :P, or any other programs that require the net.

I don't know if this is related, but about 2days ago one of my CD drives were opening and closing at random moments.

EDIT4: Ok, I read up more about this, and how it's a port scan attack. Now my questions are:
1. How do I remedy this
2. How do I prevent this from happening again
3. How to port scan attack the other jerk back! lol jk :P.

Jam it back in, in the dark.

To get rid of this pest, download and run TrojanHunter since it includes a port scan in the process. This should identify the virus at the least and delete it as well. Googling it seems to indicate it isn't a huge threat, so it ought to be easy to remove.

As to prevent this, most people here will tell you how much Norton sucks for protection, myself included. I would recommend ditching it for something worth your money, such as AVG or NOD32.

There's nowhere I can't reach.

Quote:

1. How do I remedy this

A properly configured firewall makes a port scan attack no more than an annoyance.

Quote:

2. How do I prevent this from happening again

Try to conceal your real IP as much as possible. Route as much of your network traffic as you can through anonymous proxies, as is done when you use The Onion Router. Expect a severe decrease in net performance, though, since the routes are not optimized will have a number of unnecessary hops in them to make your traffic anonymous.

Since--if you have a proper firewall--port scanning is little more than a nuisance, using an anonymizing onion routing protocol to conceal your true IP address is extreme.

Quote:

3. How to port scan attack the other jerk back! lol jk :P.

With this.

This thing is sticky, and I don't like it. I don't appreciate it.

So I searched my computer for trojans and stuff, and nothing seems to be wrong there.

I have windows' default firewall up, and I've also disabled ping to my router. I have MAC address filtering on my router (dont' know if this helps), and I have disabled wireless.

........ I'm still getting people mooching off my net from multiple IP's, and my net is slowing down like no tommorow. I've gotten so pissed that I just unplugged my router and put the cable directly into my computer so I'm able to send this without taking 1hour for a page to load.

I've fiddled with a bit with my router firewall, but nothing seems to prevent these bastards from attacking me ports.

I contacted my ISP and they told me that I'll have to handle it myself since it's a hardware problem not related to their equipment.

I am a dolphin, do you want me on your body?

All of that isn't going to help if you have the same IP address allocated to you from your ISP. You need to get a new IP address. In some cases, this is as simple as unplugging your DSL/Cable modem for a couple of hours and plugging it back in. In other cases, it might not be so easy and you might have to contact your ISP to get them to hand you a new IP.

You also need to ask yourself how these port-scan happy net-pricks got your IP in the first place. Where do you surf? Do you hang out in any IRC channels or forums that might be considered 'unsavory'? It could also be a small piece of spyware sitting on your machine just phoning home.

Most amazing jew boots