Why does this keep appearing?

Question

An IP keeps getting blocked from my firewall. Two of them actually. They are 195.10.34.40 and 89.149.169.67

The thing that it keeps blocking is called a "SYN ACK"

What is this and what does it mean?

Answer 1

You are being attacked by hackers. Permanently ban them in your firewall. Also update your AntiVirus and do a full service scan. Some free malware protectors are:

I prefer Avast, but AVG is just as great.

AVG AntiVirus
http://free.grisoft.com/doc/1

Avast Home Antivirus
http://www.avast.com/eng/avast_4_home.ht...

You may also want some other tools to run and use as well

SpywareBlaster
http://www.javacoolsoftware.com/spywareb...

Spybot S&D
http://www.safer-networking.org/en/downl...

AVG AntiSpyware
http://free.grisoft.com/doc/20/lng/us/tp...

Adaware (Lavasoft)
http://www.lavasoftusa.com/products/ad-a...

AVG AntiVirus
http://free.grisoft.com/doc/1


If you are currently having a problem:

◙ Download and install AVG. Use it first and see if it finds any viruses or trojans.

☞ http://free.grisoft.com/doc/1
☞ http://www.grisoft.com/doc/products-avg-...

◙ After running AVG go here and run this virus scanner online. There is no need to install it on your computer.

☞ http://housecall.trendmicro.com/.........

◙ Microsoft's New Live Safety Center. Download this scanner to check and remove spyware, viruses, get rid of obsolete files and junk off your computer, and improve your PCs performance.

☞ http://safety.live.com/site/en-us/defaul...

◙ The Microsoft Windows Malicious Software Removal Tool checks computers running Windows XP, Windows 2000, and Windows Server 2003 for infections by specific, prevalent malicious software—including Blaster, Sasser, and Mydoom—and helps remove any infection found. When the detection and removal process is complete, the tool displays a report describing the outcome, including which, if any, malicious software was detected and removed. You can run this tool online FREE.

☞ http://www.microsoft.com/security/malwar...

◙ Before downloading email attachments in Gmail and Yahoo Mail click on the link that says, "Scan With Norton Antivirus".

◙ Before downloading any software from the internet type it into http://groups.google.com/ to see if that title is known for spyware or viruses. Google Groups has over 1 billion posts spanning 25 years to help you. Even after checking it there ALWAYS scan it before opening it. You just can't be too careful. -- Smart Computing Magazine

◙ A lot of the download sites like http://www.download.com/ and http://www.tucows.com/ scan software before releasing it to the public. But just for safety sake you should still scan it yourself.

◙ Here is a really great article on browser hijacking. This will show you how to get rid of it. There is a tutorial and software to get rid of part of it. You'll need to make some changes to your computer's registry to get rid of the rest of it. Click on the chatroom link on their main page if you need help.

☞ http://www.spywareinfo.com/articles/hija...

◙ Here is Yahoo!'s Internet Security section.

☞ http://security.yahoo.com/

◙ Below is Mcafee's Site Adviser. Type in a URL in the form here and you will find out if the site you want to go to is known for phising (getting your personal info under false pretenses), viruses, spyware, and many other things. You can use the tool on their site or download an program to do that.

☞ http://www.siteadvisor.com/

◙ Get more information at these PC Magazine Web sites.

☞ http://www.pcmag.com/
☞ http://www.smartcomputing.com/

◙ Top 100 Computer & Software Magazines.

☞ http://netvalley.com/top100mag.html........

★★ TOOLS FOR SPECIFIC VIRUSES & TIPS ★★

◙ Sometimes you'll get a particularly nasty virus that cannot be removed with conventional tools. For times like these you can (quite often not always) download a removal tool for that specific virus. Below are some sites you should look at.

☞ http://www.grisoft.com/doc/utilities/ing...
☞ http://securityresponse.symantec.com/avc...
☞ http://www.bitdefender.com/site/download...

◙ Below is a tool called "Stinger" that Mcafee put together with all 54 of it's tools in it.

☞ http://vil.nai.com/vil/stinger/.........

◙ GLOBAL VIRUS ALERT -- The latest virus outbreak alerts from F-Secure, Trend Micro, Panda, and Sophos. Each anti-virus fighter is reporting the state of the Virus Battles on its front, which reflects a unique customer and geographic profile.

☞ http://www.trimmail.com/news/tools/#glob...

◙ Add free viarus alerts to your web site.

☞ http://www.trendmicro.com/syndication/vi...

For Trojans try these ( free to try),
http://www.ewido.net/en/
Or
http://www.misec.net/trojanhunter/.........
Or
http://www.agnitum.com/products/tauscan/...


And always scan once a week with these free and trusted scanners as well if you go to gaming sites and porn and etc.
http://housecall.trendmicro.com/.........
http://www.webroot.com/land/freescan.php...
http://www.kaspersky.com/virusscanner......
http://www.pandasoftware.com/products/ac...
http://www3.ca.com/securityadvisor/virus...
http://www.bitdefender.com/

First, you need anti-virus software - download, install and update AVG anti-virus (it's free for personal use) - you can find it here - http://www.malwaresolutions.com/tools_an...

Then remove your System Restore points (viruses love to hide in the System Restore files), but be aware that if you do remove your existing Restore Points you will not be able to "roll back" your computer to a previous configuration. To find out how to disable System Restore see this page - http://www.malwaresolutions.com/disablin...

Just to be sure you don't have other malware on your computer I recommend that you download SpyBot Search & Destroy and Adware - both are free spyware/adware detection and removal software. They can be found here http://www.malwaresolutions.com/tools_sp...

Next, start the computer in Safe Mode - (as the comptuer is starting up, keep tapping the F8 key on your keyboard until you see a special start-up menu) - more on how to start in Safe Mode here - http://www.malwaresolutions.com/how_to_s...

Using AVG - run a full system virus scan while in Safe Mode

After the viruses have been detected and removed, run SpyBot and AdAware (full system scans) then restart the comptuer, enable System Restore again and enjoy a virus-free computing experience.

If the problems are still there, try using MSCONFIG to help figure out how to manually disable the Trojan from starting up - see more about MSCONFIG here - http://www.malwaresolutions.com/how_to_u...

Check out this page for more information on what viruses are - http://www.malwaresolutions.com/what_is_... and this page for how to remove them - http://www.malwaresolutions.com/how_to_r...

For those of you who don't have AVG Anti-Virus yet, go here - http://www.malwaresolutions.com/tools_an...

One other thing you can do is to help prevent malware from getting on your machine is to use a more secure web browser (not Internet Explorer, get rid of AOL) such as Mozilla FireFox - http://www.malwaresolutions.com/tools_br...

To help protect against malware you should install a firewall, Zone Alarm works perfectly well and is free - you can find Zone Alarm and other free firewalls here - http://www.malwaresolutions.com/tools_fi...

Also, don't forget to keep Windows up-to-date - using Microsoft Windows Update!

After following these instructions go to:http://www.geekstogo.com/forum/must-read... they will help you for free, no credit card or personal information needed, and they will analyze Hijack This logs for you, to make sure that your computer is safe. HijackThis helps If persistent spyware is bogging down your computer, you might need HijackThis. The tiny program examines vulnerable or suspect parts of your system, such as browser helper objects and certain types of Registry keys. Pressing the Scan button generates a log of dozens of items, most of which are just customizations. Don't check off an item and hit the Fix checked button unless you're sure it's malware. Clicking Info on selected item tells you why the entry was flagged as suspicious, but not whether it's actually malware. To find that out, search the Web for that item's name or go straight to a forum, such as SpywareInfo or Computer Cops. Saving the log creates a text document you can post to these forums.

The latest version adds powerful tools to the Config window. The process manager and hosts file editor help you excise virulent infections. The unique ADS Spy tool scans for alternate data streams, which some browser hijackers use to hide from spyware removers. The program still installs into whatever directory in which you unzip the file, which can make it hard to locate. HijackThis is a serious tool for any user who needs to root out a serious infestation, but wield it with caution. So, go to the site I gave you above, and they'll help you step by step.

Free registry cleaners:
CCleaner does not specialise in cleaning the registry, it's mostly used to speed up your computer by cleaning up your recycle bin, temp files/internet files, browsing history, application errors, log files and so on.. which frees up some space in your harddisk


I've tried these 10 free cleaners
http://www.regsofts.com/freeware/freereg...
I would recommend the following(click on the webpage and follow):

Free Windows Registry Repair(first one) - rather effective, the first scan i did after about a year showed over 500 problems with the registry, fixed them all

RegSeeker(2nd one) - fixed another 300 problems after using the previous one.

and like the two of them said, Eusing Free Registry Cleaner and Abexo Free Registry Cleaner(30 day trial)

Just run them all that'll fix most problems! But dont expect 100% fixes because programs might recreate registry entries when used and so a second scan might still show the same few errors. (ignore such errors)



those are all freeware, hope i'm of some help

Good Luck!

Answer 2

From wikipedia: "A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system.

When a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this:

The client requests a connection by sending a SYN (synchronize) message to the server.
The server acknowledges this request by sending SYN-ACK back to the client.
The client responds with an ACK, and the connection is established.
This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol."

The IPs are being blocked, so no problem.

Answer 3

I believe SYN_ACK is a networking threat. I'm not sure, but I believe it to be a backdoor. Well, if your firewall keeps on blocking them, do a full virus scan and see if that works.

Answer 4

Websites you blocked.