Do i need a router?

[deadman_uk]

Ive been having a lot of attacks that my sygate firewall has blocked (at least i think it has) but ive been running some online port scan tests and many of the tests said i am not protected well and a hacker could gain access to my pc easy.

Here is one of the tests i done..

http://homepage.ntlworld.com/stephan...ortscanlog.htm

I am with NTL Broadband and I am with the 750k package. I have a NTL Home external cable modem 200. My friends who are all in the states and one is from holland all have routers which they say are basically hardware firewalls.

I have some security issues and I need to know do i need a router to fix these issues? Can NTL help me at all?

[Mal]

It won't hurt having a router as a firewall. I've got one for that purpose after my pc was having an allergic reaction last year to any software firewall.

Double the protection, if you can afford it.

Suppose though, that it depends on what your issues are.

EDIT: Sorry, to the site by the way.

[iron25]

As long as you have got sygate set up correctly, then it will be very difficult for anyone or anything to get into your pc without you knowing about it. I have been running sygate for several years now and I always leave it on prompt so I know exactly what is coming in and going out and I have never been hacked. I now have a router, as I share my connection with several computers, and the router runs nat so I don't have to use sygate but I still leave sygate running so I know exactly what is communicating with my internet connection. Spending £30-40 on a router will give you better protection but I can't see the point in spending the money unless you want to also share your connection with other computers.

[Mal]

Originally Posted by iron25

As long as you have got sygate set up correctly, then it will be very difficult for anyone or anything to get into your pc without you knowing about it. I have been running sygate for several years now and I always leave it on prompt so I know exactly what is coming in and going out and I have never been hacked. I now have a router, as I share my connection with several computers, and the router runs nat so I don't have to use sygate but I still leave sygate running so I know exactly what is communicating with my internet connection. Spending £30-40 on a router will give you better protection but I can't see the point in spending the money unless you want to also share your connection with other computers.

The reason that I got a router was because after I upgraded from windows me to xp, there were problems.

I found out that programs that I had blocked outgoing permissions, in fact were still outgoing. Zonealarm refused to work full stop. So I didn't trust them entirely even when I eventually fixed the problem.

If they're having problems with the firewall, getting a router might be a solution, as if you're paranoid, you may never get the trust back.

It's all down to cost.

Deadman_uk, have you tried sygate to see if they can help?

[deadman_uk]

For the last few days i keep getting an alert up from sygate firewall saying something like port scanned or port scan attack found.

take a look at this...



When i run this test http://www.securitymetrics.com/portscan.adp (first test) none of them come up as stealth, all of them are closed, and 4 are open and are at serious risk. All my friends have theres saying stealth. Take a look at mine

http://homepage.ntlworld.com/stephan...ortscanlog.htm

Im not loaded with cash, i have no desire to hook up 2 pcs, i just want to be protected. I have Norton Antvirus 2005, sygate firewall, just installed zone alarm which has made no difference what so ever but thats staying on. I also scanned for spyware and got the latest windows updates.

[Mal]

Two firewalls may cause problems.

Try Gibson's site. That also gives advice.

[iron25]

The fact that the direction is outgoing looks like it's some sort of spyware or trojan that has hijacked a file and is trying to connect to something. Alot of spyware & trojan programs rename system files and then create their own versions with the same name so it looks like it is a normal windows file that is trying to communicate. Do a search in google with the file name, the ip/host address and port to see if there is any sort of spyware or trojans that do what you pc is doing.

I had a similar problem sometime ago with a friends pc where some spyware had hijacked some system files. I ran a virus checker & spyware checker on the machine and nothing was picked up. To fix the problem I had to boot into safe mode, use the dos attrib command to find the file, remove it and also delete the registry entries. It was a bugger to fix but I cleaned it eventually.

Your problem could be that you are already infected with something. Look at task manager to see what is running, it's usually pretty obvious if anything dodgy is running.

If you're not sure, post a screen print of your task manager so we can see what is running.

[deadman_uk]

for the file sharing test..

Your Internet port 139 does not appear to exist!
One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.

Unable to connect with NetBIOS to your computer.
All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

for the other tests, all passed. It seems zone alarm is doing nothing, so ill take that off

[Mal]

Well one of the application hijacking is for lavasoftusa.com which is the adaware se site

Oops, sorry if I'm confusing people.

[deadman_uk]

I know i have nothing bad in task manager but ill show you anyway


how do i know if my system files have been hijacked?

[deadman_uk]

Do a search in google with the file name, the ip/host address and port to see if there is any sort of spyware or trojans that do what you pc is doing.

I traced one ip ( 213.118.92.167 ) and it it said this....
% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

inetnum: 213.118.64.0 - 213.118.159.255
netname: TELENET
descr: Telenet Operaties N.V.
country: BE
admin-c: PS396-RIPE
tech-c: PS396-RIPE
status: ASSIGNED PA
mnt-by: TELENET-DBM
mnt-lower: TELENET-DBM
changed: tech@telenet-ops.be 20020418
source: RIPE

route: 213.118.0.0/15
descr: TELENET
origin: AS6848
mnt-by: TELENET-OPS-MNT
changed: tech@telenet-ops.be 20010523
source: RIPE

role: Technical Internet
address: Telenet Operaties N.V.
address: Liersesteenweg 4
address: B-2800 Mechelen
address: Belgium
e-mail: tech@telenet-ops.be
trouble: IMPORTANT: To report intrusion attempts, hacking,
trouble: IMPORTANT: spamming, or other unaccepted behavior
trouble: IMPORTANT: by a Telenet/Pandora customer, please
trouble: IMPORTANT: send a message to abuse@pandora.be
trouble: IMPORTANT: Voor het rapporteren van inbraakpogingen,
trouble: IMPORTANT: hacking, spamming, of ander onaanvaardbaar
trouble: IMPORTANT: gedrag van een Telenet/Pandora klant, gelieve
trouble: IMPORTANT: een bericht te zenden naar abuse@pandora.be
admin-c: TI346-ORG
tech-c: TI346-ORG
nic-hdl: PS396-RIPE
mnt-by: TELENET-DBM
changed: tech@telenet-ops.be 20000630
source: RIPE

[iron25]

There does not appear to be any dodgy running on your system and that trace could be anyone.

What I would do is go into the application list in sygate and either remove all or set the access for every single application to ask. That way it will always pop up when anything is trying to communicate. This way you can see exactly where the program is and what data it is trying to send.

[deadman_uk]

thanks iron, ill do that

[deadman_uk]

Im still failing this test!!!

I still really need help, why am i getting 4 bad things on this test (http://www.securitymetrics.com/portscan.adp) and why are none of them stealth... all my friends have stealth!

http://homepage.ntlworld.com/stepha...portscanlog.htm

Here are the 4 things that are open

SSH - Secure Shell (SSH) uses encryption to secure information sent over a network. While it typically improves security there are numerous problems with older versions of SSH which may allow brute force attacks.

DNS - Domain Name Services are used to tell other computers what your IP address is. There are several exploits associated with this service.

HTTP - World Wide Web services allow you to publish web pages to the Internet. There are hundreds of severe security vulnerabilities associated with this service. Keep your WWW server software updated.

HTTP Proxy - HTTP Proxy provides a way for a hacker to pretend to be your computer. Others who may have been hacked may see your computer address and want you to justify why you hacked them.

It listed possible fixes and for the SSH port 22, it said update to the latest SSH which i did, i downloaded SSH Secure Shell Client and installed but it still comes up as danger.

For the DNS port 53, it said rt click network icon & select properties\rt click local area network icon & select properties\select TCP for your nic & click properties\click advanced button\click DNS tab\remove check next to Register this connection's address with DNS" - then disable DNS Client Service.

I did that but it still comes up as danager and the port is still open!

any idea how to fix these error things? im really worried, i dont want to get hacked (if i am)

[melevittfl]

I still really need help, why am i getting 4 bad things on this test (http://www.securitymetrics.com/portscan.adp) and why are none of them stealth... all my friends have stealth!

OK, first, calm down.

All web traffic on NTL goes through an NTL proxy server. The securitymetrics.com portscan is incorrectly testing the NTL proxy server, not your PC. Try a different scanner like https://grc.com/x/ne.dll?bh0bkyd2

Now, that being said, I wouldn't worry to much about "stealth" vs. "Closed". In both cases, your computer is not accepting connections on that port and there is nothing anyone can do to your computer if its not listening.

Some people will say "stealth" is better because people won't be able to tell that a PC is even there, but they're wrong. So, don't worry too much about it eaither way.