Continuous firewall intrusion attempts

Comodo Internet Security - CIS Firewall Help - CIS
#1

I have a continuous firewall intrusion every second which CIS is successfully blocking.

It is coming from Source IP 195.14.135.4 and the Destination Port is 7070. Source port is 13190. Application: Windows Operating System.

If I switch off the broadband modem, it stops. As soon as I turn it on, the intrusion attempts begin every second. It’s been like this for at least 24 hours.

#2

I’ve run an online IP trace and the Source IP 195.14.135.4 is in Cyprus. Since I am not in Cyprus it cannot be my ISP attempting to connect to my computer. The intrusion attempts continue and occur every second non-stop.

Does anyone have any idea what is going on? Is it a hacker attacking my computer? Shields UP says I have ‘TruStealth’ and all my ports are invisible yet the intrusion attempts have been unceasing and unrelenting for a couple of days now.

#3

Have you been using torrent or other P2P applications recently?

This behavior is seen after torrent applications are closed and other peers still thing your serving torrents…

#4

Hi,

No I have not been using torrent or other P2P applications recently.

#5

From what I can find, it is used for streaming media using RealPlayer.
References:
http://www17.real.com/firewall/adminfw.html
http://www.pc-library.com/ports/tcp-udp-port/7070/

#6

Well the port is registered to real-audio, been using that and or hosting something like that?

If not it could be a misconfiguration, or you got the IP of someone who did etc, best thing would be to create a block rule that doesn’t log so the counter does not increase either

Create a global rule

Block
Incoming
TCP
Source = 195.14.135.4
Source port = Any
Destination = Any
Destination port = 7070

And move it up to the top. That should kill the noise.

#7

How do you know what protocol to put and destination port? Sorry for asking, just want to learn

#8

Many thanks. I have Real Player installed.

#9

Many thanks. I created this rule and it’s not logging the firewall intrusion attempts now unless of course I check the box “Log as a firewall event if this rule is fired”.

I receive these intrusion attempts non-stop every second even though RealPlayer is not running and no RealPlayer process is running in Windows Task Manager.

#10

Well it’s not just that you have to have Real Player installed, you have to be “hosting” some audio stream for others to need to connect to your system, so I’m not sure if that’s the case here.

Have you run antivirus and scanners like Malwarebytes etc lately? just to be sure…
Also please make sure you have your system up-to-date windows update and take a look at secunia’s PSI

http://www.secunia.com that’s a tool that can scan your system for vulnerable software on it.

#11

Have a look at this movie here:
http://www.warriorsofthe.net/movie.html

#12

Thanks for reply.

I’m not hosting any audio stream for others to connect to my computer.

I just ran Comodo Anti-Virus scan (‘My Computer’ profile) and MalwareBytes full system scan and my system is clean.

#13

Scan it with Hitman Pro 3.5 too!