Port Scan's Can someone enlighten me ?!?! I have seen these pop up in the past on my PC but i have never know what they are with this type of message : Somebody is scanning your computer. Your computer's UDP ports: 1025, 1028, 4073, and 2 have been scanned from 61.235.154.92.. Cheers
Yeah i always wondered what thats all about, appears on sygate now and again (when the little sygate symbol turns red)
wot ever is scanning ur ports is trying find a route into ur computer through the firewall to access data or take control in some manner. If when these actions are happening ur are not trying to run a particular program that would need to go through ur firewall, i.e. dc++, slsk, etc then chances are its a hacker of some sort trying to get in.
Dead simple. When you are connected to the net (and not running a firewall), various applications can broadcast and connect to other computers through these ports. Some simple examples - 1) Webservers use port 80 2) Computers running windows file shares use a selection of ports between 139-145 You can find out what runs on these ports on this page (in geordie's case, this is the DCOM/ "Distributed Computing" services, bad news ) You can find out who is scanning by typing their IP address (in geordie's case "61.235.154.92") into this page Usually someone port scans a machine to see what particular versions of programs or operating systems you are running. They can work this out by watching the response your computer gives to certain portscans. They can then use this information to hack into your machine or crash it. If you have a firewall you have nothing to worry about, provided it's set up right. If someone begins a prolonged or lengthy portscan on your PC, make sure to visit the WHOIS page above (or at http://www.ripe.net/perl/whois ) and complain to their internet provider (there will be an "abuse e-mail" address in the ISP info, you need to email that telling them whats going on, include a copy of your firewall logs) and they should kick them off the net or warn them to stop it. There are known exploits associated with the DCOM service read this, so the short answer is that someone is trying to scan Geordie's PC to see if it is vulnerable to an exploit, if so his computer can then be hacked and taken over. Be glad you've got that firewall
