Help! advice needed asap.

I have been spending an unusually long time on the computer tonight and about 15 mins ago noticed it started to slow down I shut down a few progs I was running in the background but no joy. I looked in task manager to see if I could spot anything unusual but to be honest most of it is mumbo jumbo to me. Zone alarm looked as if it was working a little bit so I turned my logs on out of curiosity to see if anything was unusual, I usually have the alerts off as the can be a pest. I had a couple of hundred alerts which I thought may be due to my length of time online tonight so I just hit OK to get them off my screen Immidiately I got another alert then they were counting up about 1 every 1-2 seconds. I kinda panicked and disconnected for a couple of minutes the went online again it has now hit me 7 times in the length of time it has taken me to type this. I aint too clued up about all this but I know some of you guys can trace where it might be coming from. What is worrying me is that on one of the alerts I thought id hit info just to see what it said and apparently someone could be routing something through my computer. This worrys me as for all I know it could be feckin al quadi or bleedin peodos, before I know it im in abu ghraib or worse a prison here in Scotland. Here is a link to the zonelabs page.

I now have 12 attempts so it has slowed right down now, the IP's that keep coming up are
88.108.191.108 which appeared dozens of times in my first lot of alerts
88.108.202.223
88.108.192.241 and is highlighted red so i presume its more important?
88.108.23.172
the one ending 241 has popped up again but also says dynamic dsl as 9105.com
88.108.172.17
222.136.104.137
88.108.165.116
63.145.66.46
88.108.189.133
88.108.202.223 again
88.108.192.241 again in orange this time
201.19.161.33 highlighted red
88.108.189.133 again dynamic dsl as9105
88.108.161.247 highlighted red
222.136.104.138
204.16.208.60

they are now starting to hit me as fast as I can type them so ill leave it at that.

Maybey its nothing to worry about and im being paranoid but if someone can give me any advice asap i would be real gratefull and continue cruising round the internet with peace of mind.

Thanks in advance for any info.

Oakley

I dont know if this is right as I have never done it before but I went to a site called ARIN WHOIS that will lookup IP adresses, The majority appear to come from Amsterdam the others just seem to be random places. Can anyone tell me if that amount of firewall blocks are common and im just being paranoid or should I be concerned. and look into it further.

Thanks again.

What operating system do you have? I would suggest that you activate your Windows firewall (>Control Panel>Windows Firewall). It may also be that the problem is originating from your own PC and not from outside AKA Spyware. Personally I like Spybot - Search and Destroy and Microsoft Antispyware (Beta) but I don't know if you'll still be able to get that one. Check out Windows Downloads and find MS Defender... Not sure if it's still free.

I don't know anything about ZoneAlarm - but from what I read in the above links you might want to double check everything in your Trusted Zones and step up the security settings from Medium to high (Although this may make browsing the Internet a bit frustrating...) you'll find the two I just mentioned under Internet Explorer > Tools > Options > Security.

It may also be a good idea to restart your PC. Many Spyware (and possible hackings) only starts when you've been online a looong time. Restarting your PC may "reset" possible Spyware and they won't be active for a little while, which could give you some time to find the problem.

Hope that's of any help.

Originally posted by Oakley
I dont know if this is right as I have never done it before but I went to a site called ARIN WHOIS that will lookup IP adresses, The majority appear to come from Amsterdam the others just seem to be random places. Can anyone tell me if that amount of firewall blocks are common and im just being paranoid or should I be concerned. and look into it further.

Thanks again.

The IP adresses that look like they are coming from Amsertdam are probably European ones, ARIN does not look up European adresses, for that you should use RIPE for the whois queries.

I used a programm called Sam Spade that helps to do a Whois lookup and the results are:

All adresses between 88.108.0.0 and 88.111.255.255 are from Tiscali UK
222.136.104.137 is from China
63.145.66.46 is from the USA
201.19.161.33 is from Brasil
204.16.208.60 is from the USA

Should you be worried?

Maybe not, if you have your firewall working then the attacks stay on the outside.

Just in case, go to Sysinternals' Processes & Threads Utilities page and download Autoruns to see what is loaded on startup and Process Explorer to see what processes are runing.

Next go to the Networking Utilities page and download TCPView to see what programs are using what ports in you computer.

All the above programs are freeware.

Good luck.