Originally posted by Wes14
this kinda humorous thing happened, went to disable norton so i could go on AH (with less Fps impact) right before i went to disable it
guess what?
Norton pops up about an attack on my pc..and then the "Attacking" pc sends the same thing over and over again and gets blocked
Attacking Pc's IP:81.177.23.211,80 (as identified by norton)
so lets also add a vote based in this story
disable antivirus/firewall and let the attacking pc put what it wants on yours
or keep it on and suffer performance loss
I have been on the net since the DARPA days. I have never run a personal firewall or anti-virus program. I have never gotten a virus or a spyware program on my computer.
If you leave all the security MS provides for Windows at is defaults, then you are inviting trouble. If you do not do the security updates from MS, then you are inviting trouble.
Anti-virus programs only work as well as the last update to them. They are really no better than the operating system is as it pertains to keeping a virus off your computer. If you get a virus, it is through your own actions you got it. While there are worms and DOS programs out there which exposed issues in the operating system, those blatant ones have been closed up.
And there is nothing that will drive me right over the edge than someone running a software firewall which is improperly configured. If you set that stupid firewall to block all ports and then go one moronic step further and have it actually report any scan of any port, then you should be banned from using a computer.
Network software cannot connect to a TCP port which has NO LISTENERS on the port, or where there is no UDP protocol attached to a port.. It is quite impossible as that is how network software establishes connections.
Now, to see what the active ports are, so you can block the ones that need to be blocked, go to Start->Run->Command, then type "netstat -an" and press
. Make sure nothing is running when you do this.
In the right column, anything showing the state of "LISTENING" should be blocked. The port is shown under the second column combined with the IP address of the LISTENER. Example: "10.0.0.1:139". This means 139 is a port needing to be blocked.
Then look at the UDP ports futher down and block them. You might as well turn off any reporting, as it will be pretty useless. Why? Lets look at port 139. That is a NETBIOS port. If you are on cable, and someone on your node turns on thier computer, and they are on the same IP subnet, your NETBIOS port is going to be hit. It is a perfectly legitimate hit initiated by Windows during boot up.
Speaking of NETBIOS, make sure you set your workgroup to something other than "WORKGROUP". Make it something unique. It is an easy security precaution to take and one that is often overlooked. If you have other computers on your LAN, then make sure to change all of them to the same workgroup. Leaving the default worgroup name and enabling file sharing is a quick way to get nailed by some script kiddy.
I really hate the way software firewalls have been presented to users. All the documentation and marketing garbage is designed to make you paranoid. And in doing so, 99% of people who use them have no idea how to use them properly.
Take the above example. This guy is supposedly getting a connection attempt to port 80. Duh. Port 80 is your browser. Guess what? Your browser will ignore than connection attempt. No need to block that port.
Taking it a step further. If your browser is not open, then nothing would have happened. The connection would not even have shown up at all. The 'attack' as it is described, continues as the stupid firewall is actually allowing the connection to be made then terminating it. So the remote guy is trying to figure out if this is a WEB server or not. All you have done is expose your computer to more attacks by blocking a port which did not need to be blocked.
