Virus Source

[Andy Rudoff]

>I think I found the Virus source, that infected my machine and is continuing
>to "attack" my machine. Everytime I log on to the Starlink Pianotech Chat
>line, my firewall alarm goes off. It seems to be coming from the same
>source, EVERY TIME! I've tried to contact the Starlink Security, but can't
>get through. Any one know how to navigate this and get them on to the
>intruder?

Your firewall software should give you more detail on the traffic it
is intercepting, and that may lead you to find out it is something
easily explained away and not worth tracking down.  For example, it
is quite common for IRC programs to attempt to contact the "ident server"
on your machine.  That's an old protocol for getting your full name
and most machines don't support it these days.  So if connecting to
Starlink always causes it to see if your machine supports ident, and
your firewall isn't expecting someone to try to contact ident on your
machine, you'll get a message from your firewall software but nobody
is, in fact, trying to attack your machine.

I'm not saying your machine is not being attacked -- I'm just saying
you usually need to investigate the next level of detail to figure out
if it is.

The firewall software should have also told you the IP address of the
machine that originated the traffic.  Before you even know who to contact
to follow-up on this, you need to understand who that IP address belongs
to.  Sites like http://www.rwhois.net/ allow you to see who the IP is
assigned to, but you'll soon grow tired of trying to track these things
down, I bet.

Instead your time is better spent just making sure your machine is
not vulnerable.  Since you're getting the "alarm" from firewall software,
it sounds like you're already doing the right thing.  Using a "port
scanner" to check for vulnerabilities is always a good idea (for example,
see http://grc.com and click on "Shields Up!").  If your machine checks
out as secure, I'm not sure spending time trying to track down the
firewalled traffic is worth it.

-andy