• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

repeated portscan issue with hn.kd.ny.adsl

For the last month, I have be getting attempted portscans from following address:  hn.kd.ny.adsl.  Fortunately the firewall is doing its job, but unfortunately everytime this address attempts to hit my computer I get a pop up and everything on my computer comes to a stop or slows way down for 30-60 seconds.  Because it is not a numerical IP address, I am not been able to enter it in the addresses for the firewall to auto block as I have with many other addresses to solve the problem.  I have checked this address and it appears to originate out of China and there are many complaints on the internet with this address also scanning many other computers.  Sometimes this address will hit me several times while I am on the computer.  What can I do so I don't have to deal with the pop ups and slow downs every times the portscan attempts occurring from this particular address and yet the Norton firewall is still doing its job?

Replies

Kudos0

Re: repeated portscan issue with hn.kd.ny.adsl

The portscan attempts are increasing in frequency and having an increasing affect on the connection.  Any help to neutralize the effect of the attempts would be helpful.  Thanks.

Kudos1 Stats

Re: repeated portscan issue with hn.kd.ny.adsl

Sorry that no one has responded yet, mostly this is due to the holidays.  I'm not quite sure why there's a slowdown if the portscans are being blocked, but I can tell you how to disable the alerts.

1. In the Norton Firewall application, select the "Advanced Settings" tab

2. In the bottom section, "Vulnerability Protection", hit the "Configure" button

3. In the search box at the lower right, type "portscan"

4. Uncheck the "Notify" box (note: DO NOT uncheck the "Enabled" box since that would stop blocking the scans).

I hope that helps.

-- Lee

Kudos1 Stats

Re: repeated portscan issue with hn.kd.ny.adsl

"Fortunately the firewall is doing its job, but unfortunately everytime this address attempts to hit my computer I get a pop up and everything on my computer comes to a stop or slows way down for 30-60 seconds."

What's slowing your computer is not the port scan.  It's the notification.  Turn it off. 

To confirm your level of security re. ports, head to www.grc.com and run ShieldsUp.

Kudos0

Re: repeated portscan issue with hn.kd.ny.adsl

I am also getting this message.  If we turn off the alerts, how will we know if the scan is unable to be stopped at a later date?  Also, as long as it is blocked, my computer is not in danger, is it?

Thanks

Kudos0

Re: repeated portscan issue with hn.kd.ny.adsl

Go to System Preferences->Security->Firewall. Click the lock, then "Adanced..." Enable stealth mode. To scanners you are now, not only not home, but your home isn't there either.

Kudos0

Re: repeated portscan issue with hn.kd.ny.adsl

Out of curiousity, do you have Norton Internet Security or Norton AntiVirus?

Norton AntiVirus has Vulnerability Protection which detects the portscans. However Norton Internet Security has a full firewall. I can't tell if the blocked attempts are coming from the Norton Firewall or Vulnerability Protection.

As noted above, the slowdown is likely coming from displaying the alerts. Try disabling the alerts for Portscan. This will still detect the portscans, but not report them to you.

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: repeated portscan issue with hn.kd.ny.adsl

This person also hacked into my email, and I was able to secure the IP address of ‎115.52.174.238 hope this helps.

Kudos0

Re: repeated portscan issue with hn.kd.ny.adsl


dontmesswithmeh wrote:

This person also hacked into my email, and I was able to secure the IP address of ‎115.52.174.238 hope this helps.


This would likely mean that you were duped into providing your email address to a fake or untrustworthy site, i.e. a phishing attack. As a minimum, you need to change your account password. Use account aliases that can be deleted.

IP address: 115.52.174.238
Host name: hn.kd.ny.adsl
115.52.174.238 is from China(CN) in region Southern and Eastern Asia

[edit: Please do not post identifying information per the  Participation Guidelines and Terms of Service.]

This thread is closed from further comment. Please visit the forum to start a new thread.