Security Question?

Leeg5547

Distinguished
Dec 22, 2010
52
0
18,630
Hi guys,

I recentley had my email hacked and my paypal messed with but nothing else was messed with(my email and paypal had the same username and password) I am thinking it was a flook as the password for my email was also usernames on my games which people could see, I have a belkin N1 wireless router with my pc and ps3 hard wired, 2 iphones and a laptop wireless which all the settings on the router were default only thing I did was put a wpa2 security code in(stupid I know). with avg anti virus installed also. I have now changed all my passwords installed norton 360 5.0 and also changed my router settings,

ip address changed- SSID changed and invisible- wpa2 security code changed- mac address filtering for just the pc i use, my iphones and ps3 plus the missies laptop.

BUT My firewall log in my router settings has had 17 attacks today alone from places like usa brazil italy china tokyo etc etc (ip traced)!

The question is, I am not sure if this is normal or not as i have google searched this and people say it is normal in other forums putting it down to the router ''randomly chatting and making it look like its doing an amazing job''.

http://forums.thedigitalfix.co.uk/forums/showthread.php?t=558512


I need some advice on what to do.... if anything. Thanks guys

Firewall log:
Thu Mar 31 00:09:23 2011
=>Found attack from 58.60.10.10.
Source port is 12200 and destination port is 9415 which use the TCP protocol.
Thu Mar 31 00:40:55 2011
=>Found attack from 69.175.77.157.
Source port is 27718 and destination port is 22 which use the TCP protocol.
Thu Mar 31 01:42:54 2011
=>Found attack from 192.135.21.113.
Source port is 19179 and destination port is 22 which use the TCP protocol.
Thu Mar 31 04:39:42 2011
=>Found attack from 201.143.41.140.
Source port is ICMP and destination port is ICMP which use the ICMP protocol.
Thu Mar 31 05:02:57 2011
=>Found attack from 58.251.60.228.
Source port is 12200 and destination port is 9415 which use the TCP protocol.
Thu Mar 31 06:15:19 2011
=>Found attack from 87.111.157.32.
Source port is 33469 and destination port is 21 which use the TCP protocol.
Thu Mar 31 06:39:04 2011
=>Found attack from 62.215.216.130.
Source port is 45684 and destination port is 5900 which use the TCP protocol.
Thu Mar 31 07:31:17 2011
=>Found attack from 208.165.49.132.
Source port is 56862 and destination port is 443 which use the TCP protocol.
Thu Mar 31 07:58:09 2011
=>Found attack from 202.218.32.230.
Source port is 51824 and destination port is 22 which use the TCP protocol.
Thu Mar 31 09:32:13 2011
=>Found attack from 89.7.221.199.
Source port is 2028 and destination port is 3389 which use the TCP protocol.
Thu Mar 31 10:31:08 2011
=>Found attack from 84.204.56.234.
Source port is 27715 and destination port is 22 which use the TCP protocol.
Thu Mar 31 10:33:42 2011
=>Found attack from 109.104.74.10.
Source port is 35714 and destination port is 22 which use the TCP protocol.
Thu Mar 31 11:27:27 2011
=>Found attack from 82.114.94.182.
Source port is 59677 and destination port is 3389 which use the TCP protocol.
Thu Mar 31 14:34:30 2011
=>Found attack from 85.105.176.203.
Source port is ICMP and destination port is ICMP which use the ICMP protocol.
Thu Mar 31 15:28:47 2011
=>Found attack from 27.54.118.7.
Source port is 48537 and destination port is 5900 which use the TCP protocol.
Thu Mar 31 16:07:20 2011
=>Found attack from 112.216.99.210.
Source port is 19389 and destination port is 110 which use the TCP protocol.
Thu Mar 31 16:33:39 2011
=>Found attack from 78.25.61.233.
Source port is 1861 and destination port is 3389 which use the TCP protocol.
 
they are trying to find an open port. If you don't open a port intentionally, you firewall should keep them out.

ICMP is someone trying to PING your IP.

I get about 20 to 50 checks a week on my firewall.