Intruders In My Local Area Network

[hiteshkkk1 327]

Hello all..

Below attached screenshot is copy of my log of Netgear Router WGR614.

As we can see, some random IPs are accessing my PC on LAN (ip : 177.177.15.110).

When I checked those IPs they were located in random locations like Karachi, Ukraine, UK, etc.

I want to know what are they doing on my network & how do I stop them. Also, is it because utorrent was started on my PC?? Thought at that time I was not downloading or seeding.

Pls guide me what should I do... I am not using any firewall software & Windows firewall is activated (Using Win7). For antivirus, I use AVG Free & I am very safe surfer. I dont open any suspicious links.

[santanu@impaq 16]

Most likely utorrent is the reason

[csmart 472]

check thi slibnk

http://www.speedguide.net/portscan.php?port=63507&tcp=1&udp=1

also check the open ports on your router and also on utorrent. generally port 63507 is used by virus or vuze attack.

[rajanmehta 4,056]

Use a good firewall software. Windows built in is not sufficient. Should configure router firewall if any. Also check whether Utorrent is using port 63507 on your PC because all remote acess is on that port in your image. If not, then it should be considered intrusion.

[santanu@impaq 16]

uTorrent uses TCP port - 63507, UDP - 63508.

[hiteshkkk1 327]

Thanks for inputs... Based on those & some more digging I have found below observations..

1. In Utorrent, Port used for incoming connections was mentioned as 63507 & Enable UPnP port mapping was selected.

2. In router in upnp status, it was showing as below..

3. When I clicked this link http://www.speedguid...507&tcp=1&udp=1 given by csmart, both TCP & UDP shown as filtered when utorrent was not running. I started utorrent & then refreshed, then for TCP it showed as open.

Finally, it is concluded that those were intruders bcoz of utorrent. Now I want o ask if

1. I should disable upnp port mapping n will it make any difference in utorrent downloading performance?

2. I should disable upnp in my router itself?

3. I have option to use random port in utorrent. Should I use that?

Thanks in advance.

Edited September 3, 2011 by hiteshkkk1

[santanu@impaq 16]

Turn off uPnP, Enable SPI and then observe for a couple of days.

[csmart 472]

you can decide your own port for listening. there is option in utorrent for the same. further try other anti virus. I also get MS RPCSS attack warning. this used to happen whenever i was on tata photon (it was hard to detect). but my anti virus, Symantec used to block it warn me about the attack. after that i try to reduce tata photon and also raise the complain with them.

[rajivunique 6]

Disable UPNP and observe the connection for few days.. (in this duration, I would like to remind u try browsing all the websites u usually do on a daily basis..why becoz lots of sites need this enabled on modem or routers).. if all the sites are working without upnp disabled..then u are all good to keep it disabled.

Thanks,

-Rajiv

Edited September 3, 2011 by rajivunique