HydraHeaded

I have a Huawei SmartAX MT882 modem. I changed the mode of the modem today, so that while earlier when I switched on the modem, it would automatically connect to the net, now I have to manually type in the username and password in windows.

I did this just today, and now I am facing a lot of hack attempts: ZoneAlarm keeps giving messages of having blocked access attempts from different IPs:

193.138.232.17
118.168.135.86
222.216.28.168
10.10.49.220
213.234.219.11
122.116.17.131
218.165.128.76
61.92.52.107
59.95.14.154
59.95.128.161
77.122.203.46
122.116.112.163
61.92.52.107
122.116.17.131
59.95.14.154
118.167.130.5
122.116.17.131
59.95.129.183

Most of these are from somewhere in Taiwan / China / Hong Kong...

I dont have any enemies there; I don't have any enemies anywhere, if I remember correctly )

1st: Does this have anything to do with my changing the modem mode?

2nd: When the IP is shown as of a particular country, does it really mean that it is someone from that country who is trying to hack? Is it possible that someone from Algeria, etc is using a software that makes it looks as if he / she is in Taiwan? Bcoz there are softwares that change your IP, so that it looks as if you are accessing the net from France or Malaysia. I am not sure if these softwares really do what they claim to do, because I once used a software, and then when I googled for my IP, most sites fell in for the trick and showed that I was in some other country, but one or two sites showed two IPs: one was my real IP, and the other was the fake one, shown as a proxy IP. Does anyone know of any working software that will hide the IP, and more importantly, is there any real need for this?

G25r8cer

Those are probably all just ip's of servers there that you were trying to receive info from. Were you downloading anything when it happened?

__________________

Tuffie

That many connections at one time could mean as Torrenting type software, do you have anything like that installed?

Tuffie.

__________________
formerly XRT

HydraHeaded

The only thing that I was running at the time when these problems happened was that I was downloading from RapidShare. But even right now, when I am not downloading anything, ZoneAlarm keeps giving up popups of having blocked an IP:

The firewall has blocked Internet access to your computer (NetBIOS Session) from 59.96.955.97 (TCP Port 4716) (TCP Flags: S).

I don't think I am trying to access anything from anywhere; at least, I have disabled all software updates, so that I can manually update whenever I like, and I pretty much know what is allowed and not allowed through ZoneAlarm, though I don't know what this NetBIOS and TCP Ports are.

As for torrent software, I do have Utorrent installed, but I haven't run it since some time, and in Windows Task Manager, in the open processes list, it doesnt show as a running process.

The IP addresses that are trying to connect are of a whole lot of places, but most of them are from around the Taiwan China HongKong region. Is there anything like a list of particular rogue IPs that you can just block?

G25r8cer

You can use a free program called peerguardian which will block all "bad" ip's! They update it all the time so new ip's are added! Be aware that it might slow down your bandwidth but it might be worth it.

http://phoenixlabs.org/pg2/

__________________

HydraHeaded

I already have PeerGuardian up and running, and its history file, where it stores bad IPs, is almost 1 GB huge. I think Peerguardian is only for blocking those MPAA IPs, the ones that go after copyright violaters. The ones that I am getting seem to be individual users, at least, as far as I can see...

Raise109

Have you tried completly shutting down RapidShare as some of these types of programs continue to share even if your not downloading???

__________________
SYS ONE Q6600 G0 @3.4
GA-EP35-DS4
XFX 8800GTS XXX
4 x 1GB Crucial 8500 dominator
XFI platinum
x2 500GB Hitachi
750W Storm modular PSU
Vista HP
VM04= WinXP32/Fedora/Mandriva/Ubuntu

HydraHeaded

Even with nothing on, I mean, no downloads, only Yahoo mail open, ZoneAlarm keeps giving popups of having stopped attempts. I went to its firewall log, and saw that it gave popups only for what it termed as high risks, the medium risks were not reported.