ray'

Ok let see yesterday I have instaled Kaspersky 2009....and after few hours had started to give me a note in what it telled me that I am atacked.....anyway I atached 3 print screen-s to the post with the alerts.....




Ok very strange in this thing is that the form of my ip adress is like this 10.12.X.XX I've put the x thing for security purpose....well you have seen in the prints that the atacks are coming from ips that looks like my ip........

cohen

do you think you have a virus?

__________________

ray'

no...I think someone is trying to conect at my pc...but i am not sure

tlarkin

subnets that are on 10.x.x.x IP ranges are reserved for private networks. That is someone that is on your network. It could be a bot or a rooted machine that is on your network and the virus/malware/trojan is trying to copy itself across the network.

It isn't coming from the Internet though, that is for sure.

cohen

Yes, good point, because online IP addresses are long aren't they? and have 3 numbers at from like 123.x.x.x, correct?

__________________

tlarkin

No, there are just certain blocks of IPs which are public and assigned to the internet and ISPs. Others like 192.x.x.x and 10.x.x.x and in a more rare case like 73.x.x.x and of course 127.0.0.1 are all reserved IP addresses for specific usage. The fact that he/she was getting attacked from a 10.x.x.x IP address means it is a private IP and part of a private network, which you can further deduct that it was from inside the network, since you can't just route over subnets like that unless you have certain things set up that way.

Further more port 445 is used for SMB over TCP/IP which is what windows uses for networking. So, it is like someone is trying to connect to the user's machine for file sharing.