[harrogate22]

Hi There,

I'm rather worried that my laptop has been "got-at". The Belkin router has an LED which flashes constantly indicating traffic (I presume); it's the one associated with the channel to which the laptop is connected, and it flickers away all the time. I'm getting paranoid wondering to whom it may be chatting.

I've noticed that coincident with this activity is a file (PFIREWALL.LOG) which is constantly being updated, and its contents are of the following form:

2008-01-03 05:38:03 OPEN UDP 192.168.2.2 24.87.165.142 56168 60313 - - - - - - - - -
2008-01-03 05:38:03 OPEN UDP 192.168.2.2 84.211.9.251 56168 9213 - - - - - - - - -
2008-01-03 05:38:05 OPEN UDP 192.168.2.2 125.27.73.45 56168 8345 - - - - - - - - -
2008-01-03 05:38:08 OPEN UDP 192.168.2.2 121.23.89.192 56168 11381 - - - - - - - - -
2008-01-03 05:38:08 OPEN UDP 192.168.2.2 140.135.254.9 56168 15352 - - - - - - - - -
2008-01-03 05:38:08 OPEN UDP 192.168.2.2 71.123.210.223 56168 26749 - - - - - - - - -
2008-01-03 05:38:10 OPEN UDP 192.168.2.2 99.244.77.88 56168 24869 - - - - - - - - -
2008-01-03 05:38:11 OPEN UDP 192.168.2.2 58.209.158.39 56168 10849 - - - - - - - - -
2008-01-03 05:38:11 OPEN UDP 192.168.2.2 220.191.23.140 56168 25598 - - - - - - - - -
2008-01-03 05:38:12 OPEN UDP 192.168.2.2 222.20.224.107 56168 16001 - - - - - - - - -
2008-01-03 05:38:14 OPEN UDP 192.168.2.2 89.103.133.137 56168 13171 - - - - - - - - -

I have also noticed that the "used" level of my hard disk is also constantly increasing, rather more - I suspect - than the as might be expected by the above pfirewall.log entries might justify.

I would be most grateful for any ideas. Should I be concerned; what is it, and what is the solution?

Many thanks in advance,

Ken

[wk2000]

Please download and run HijackThis, available here:
http://www.trendsecure.com/portal/en...ols/hijackthis

And copy and past the log produced here. Someone with a golden shield will have to help you out.

Do you run any peer to peer file sharing program ?

[TOGG]

According to the IANA Ports list, UDP port 192 is used by the Ohio State University Network Monitoring System; http://www.iana.org/assignments/port-numbers

I understand that there is, unfortunately, nothing to stop malware using any port it wants to, so, unless you have some connection with OSU, you may well have a problem that the HJT log could help to identify.

[strouprob]

192 is part of the IP address (192.168.2.2) on the LAN not a port number.
Have you ran a complete virus scan and malware scan?