[helldelta]

Hello TSG,

A girlfriend of mine is being harrased by a guy that she met online. He has been sending a form of DoS attacks to eat up her bandwidth (he has told her that he likes to do this and has done it to her before). She has restarted her router to change her IP, however he's been able to retrieve her IP every time. She has never sent an email to him, or replied to any form of his attempts to contact her, and she has scanned her computer with AVG and Spybot, and the results were clean.

So as a suggestion from another friend of mine we obtained Outpost Firewall, and since then the lagging was stopped somehow. However, Outpost Firewall brought to our attention that there is a constant port scan on her computer, starting from 1000 and going up by 1 port. We do not know if this is him or not, the IP origin changes constantly.

How do we prevent the scans on her ports from even happening? What can we do?

Thank you in advance.

[lunarlander]

There is nothing you can do about other people scanning your ports. If you don't have a router, I suggest you get one, cause the scans will then only reach your router and not your PC. My router has a firewall too and it logs everything and I see lots of scans every day. Scans are not dangerious in themselves, but is kind of a scouting tool - a scan will reveal which ports are open, and then the attacker can then focus on attacking the application that has that port open. Get a router, even if you only have 1 PC, and the scans will reach only a blank wall.

[BlueEyedFox]

Outpost is pretty good and pretty high rated but, Comodo is better in my opinoin and free.

http://www.comodo.com/

I reccomend contacting her ISP espically if you know its him DoSing her

Lets make sure her ports are secure. As long as they are secure from hackers, he is scanning for nothing.

http://www.grc.com/files/LeakTest.exe

[helldelta]

Okay, thanks guys. We already have a linksys router and the leaktest results were fine, I think all the random lagging is from the DoS attack, which looks like there is no choice but to contact our ISP.

[Broni]

Leak tests concern outgoing traffic, so it has nothing to do with someone trying to access your computer.
Run ShieldsUp: https://www.grc.com/x/ne.dll?bh0bkyd2 to see, if you have any port open, and if they're listed as stealth.

[Elvandil]

You will find that people are scanning ports all the time, as well as IP ranges to find ports that are open or unprotected. That's what firewalls are for, of course, though the statistics are in your favor that no one would ever get in, firewall or not. Keeping the same IP for long periods requires more security than changing it often (and advantage to dialup).

[helldelta]

The results from the second test that was suggested were also clean with no problems. Random lag spikes occur less often now.