[thoreau]

Lately Verizon DSL has demanded that I grant permission in my 8SIGNS firewall to allow Verizon to use ports in the topmost range, namely 49000-65535
Why? Isn't this the range where Trojans operate. IANA says these ports are for private use. What gives???

[lunarlander]

It sounds suspicious to me. Did Verizon tell you how to configure your firewall specifically?

[thoreau]

No, I cannot speak with Verizon or access my account there, seems my access data has been changed and they will not tell me my new password. I've tried three times already to get it. Last time they asked for access to my desk top and began a download from my hard drive.
The problem is gone for now because i deleted the partition and reinstalled a clean image of it. I appreciate you help Lunar Lander, I expect it will not be long before another or the same cretin has attached itself here. Thanks for responding, perhaps I was too quick to delete the partition.
I had packets saved but cannot find them now. I remember that when i tried to update AVG Anti-Virus a message popped up and said I had some sort of NetNanny installed that was preventing it. That's not the exact name.
I will continue to try to remember and will post anything I find here. Thank you again for the rescue attempt Lunar Lander.

[lotuseclat79]

Call Verizon on the telephone for support - they are very good. Ask them if it was them making the demand - I bet not.

Your problem sounds like it was not Verizon making the demand, but someone that had already co-opted your system.

-- Tom

[thoreau]

I have found more info that I had saved to CD. The offending IP addy was 96.236.170.198 which when checked with ROBTEX and SORBS came back as being in the blacklist.
latest news: Jan 26: new version of the shared tab with more extensive DNS-relationships 96.236.170.198


LISTED IN BLACKLIST!
dnsbl.sorbs.net
dul.dnsbl.sorbs.net
sorbs.dnsbl.net.au
t1.dnsbl.net.au
summary
server type
route name
as name

• ip
• graph
• whois
• blacklists
• analysis
• contact

baserecordnameipreverserouteas

96.236.170.198!!2
dot



...

blocklistlinkstatusdescriptionreddnsbl.sorbs.net link (127.0.0.10) - Aggregate zone (contains all DNS zones) dul.dnsbl.sorbs.net link (127.0.0.10) - Dynamic Address ranges (NOT a Dial Up list!) sorbs.dnsbl.net.au (127.0.0.2) t1.dnsbl.net.au link (127.0.0.2)

[thoreau]

The links listed above, in my previous post are no longer available from here.

[thoreau]

Right this moment,6:43 pm, Feb 5 09, as I attempted to open ROBTEX my DSL disconnected and immediately reconnected as 96.236.246.107

It was 72.95.248.194

[thoreau]

I was cybernapped!! After restoring a clean image the problem is gone, port assignments are back to normal.
I don't know what the trojan was but it had a stranglehold on my connection. I hope my computer didn't commit any crimes while it was assimilated by the BORG.