Laptop being attack...
 

  You don't need to be an 'investor' to invest in Singletrack: 6 days left: 95% of target - Find out more

[Closed] Laptop being attacked through TCP ports

17 Posts
9 Users
0 Reactions
40 Views
Posts: 7812
Full Member
Topic starter
 

I have a week old laptop that picked up a dodgy exe file when I was trying to get rid of some pop up thing - clicked on the wrong place with new touch pad.

MacaFee has quarantined the file that was pretending to be a mediaplayer but ever since I have been getting endless pings against TCP ports that the firewall is blocking. They are coming from a very small n number of IP addresses according to the log.500+ in the Last couple of days

Macafee gave me a virus ref that doesn't even appear in a Google search.

Dear Stw computer geniuses wtf do I do now?


 
Posted : 25/07/2015 2:52 pm
Posts: 28
Free Member
 

Wipe the PC and start again would be my recommendation.


 
Posted : 25/07/2015 3:15 pm
Posts: 0
Free Member
 

Incoming pings? How are you supposed to prevent an incoming ping request? Other than letting NAT deal with it?

How is your laptop connecting to the internet? Are you doing anything fancy regarding DMZ or port forwarding?


 
Posted : 25/07/2015 3:27 pm
Posts: 7812
Full Member
Topic starter
 

But will that cure it? I didn't get any discs etc in the package so presumably I need to rebuild from a partition on the machine (although struggling to find any instructions for that) which I guess may itself have been corrupted,although perhaps less likely.


 
Posted : 25/07/2015 3:32 pm
Posts: 7812
Full Member
Topic starter
 

Daniel I don't know that's why I am asking but it seems to be pinging the ports in a pattern and the volume of pings is very high 10+ a minute then again after 20 minutes from a small number of IP addresses.


 
Posted : 25/07/2015 3:34 pm
Posts: 969
Full Member
 

Do you have a static ip on your router ? Might be looking for a certain IP - ask ISP how to change your IP ?


 
Posted : 25/07/2015 3:35 pm
Posts: 0
Free Member
 

Make recovery disks and start again.

e: yeah how is your laptop getting ping'd? It shouldn't be reachable. Click start then in the search box type cmd. In the box that pops up type ipconfig to check your laptop's IP address


 
Posted : 25/07/2015 3:38 pm
Posts: 7812
Full Member
Topic starter
 

Is ping a technical term?

Basically Macafee is telling me it blocked an IP address that attempted to open port 5090 or whatever the number was and than the next entry might be 5095 a few seconds later etc...

If that's not pinging in the sender you guys mean then Apols


 
Posted : 25/07/2015 3:42 pm
Posts: 0
Free Member
 

On new laptops there's usually a partition that you can use to restore it to factory settings, certainly my 3 year old Dell has one (and it's been useful on a couple of occasions!)


 
Posted : 25/07/2015 4:43 pm
Posts: 0
Free Member
 

Sounds like every thing is working as it should. log into the wireless router and see it dhcp time out, the switch it off for that period of time...


 
Posted : 25/07/2015 4:43 pm
Posts: 77347
Free Member
 

For a week old laptop, I'd be doing a factory reset. (I think they call it a "refresh" in Windows 8 parlance.) Could be there's something nasty still on there, I wouldn't trust McAfee to fully remove an infection as far as I could kick it.

You'll always get drive-by attacks on the Internet just by nature of it being the Internet, the router should stop them though. From the sounds of things, there may well be something trying to 'call home' on your laptop.


 
Posted : 25/07/2015 4:45 pm
Posts: 7812
Full Member
Topic starter
 

Thanks all. I am just doing the factory reset before the nuclear rebuild option.

So with Macafee having not convinced me of its strengths and still being in free trial mode what other av/ security package? We have kaspersky on the other pc and I have never doubted that.


 
Posted : 25/07/2015 6:08 pm
Posts: 77347
Free Member
 

Just uninstall McAfee, Windows Defender should kick in automatically. Job jobbed.


 
Posted : 25/07/2015 6:11 pm
Posts: 7812
Full Member
Topic starter
 

Thanks. So I guess that means Defender's not rubbish anymore then? I thought it was only originally a token effort and not a viable stand alone product but I guess times have changed.


 
Posted : 25/07/2015 6:19 pm
Posts: 77347
Free Member
 

Depends on your expectations. It's a competent anti-virus product. It's not a "total Internet security" offering, but then they're usually of questionable use anyway.


 
Posted : 25/07/2015 6:23 pm
Posts: 7812
Full Member
Topic starter
 

Quick follow up. Factory reset looking like it's maybe done the job.

Thank you all amongst all the squabbling and piffle talking (mea culpa) there really are some good people round these parts. 😀


 
Posted : 25/07/2015 10:18 pm
Posts: 77347
Free Member
 

Lies!


 
Posted : 25/07/2015 11:42 pm
Posts: 0
Free Member
 

Windows Defender in 8.1 is a decent enough anti-virus and firewall, and isn't a massive bloated hog like most AV products like McAfee, Norton and even I've found freebies like AVG and Avast were crippling my computer.

Windows Defender in older versions of windows was just anti spyware and they offered a separate AV product for download, but that's gone and it's all built into Windows 8.1 now (and I would assume will also be in 10).

At home you typically have a NAT router and this will act as a firewall both because of the nature of NAT and any decent router will have a built in firewall also. If the router offers it, make sure flood protection / denial of service / port scan features are turned on. Also some ISPs offer a firewall at their end you can turn on in your account settings (PlusNet do this).

Though in your case it sounds like a virus / malware app started up and opened a router port for a botnet to use. Hopefully you didn't do any financial transactions online while it was doing this. Often they install key loggers and catch your passwords to banking sites etc.

Anyway, also worth turning off UPNP in the router as this allows any computer on your network to open a port on the router without your knowledge. It's supposed to make it easier for when you need it, but it's a danger with viruses and malware.


 
Posted : 26/07/2015 10:08 am

6 DAYS LEFT
We are currently at 95% of our target!