Weird IP problems

[fstroupe]

As I've said before, I'm a networking moron.

Anyway, trying to keep the story as short as possible, Wikipedia blocked my IP from editing because my IP is an open proxy, or a Zombie has sucked my brains out. LOL Whatismyip gave a different IP address, but said that it is an open proxy

So, of course, I start doing some research. Some trojans use an IRC client to open a port to the backdoor. Well, after some thought, I remember that late in the week, I rebooted for something, and mIRC launched by itself. It has been so long since I used it, I really didn't think it was still installed. Actually, I never used it by itself, always by a plugin.

So, as much as I hated to, I reinstalled XP. I updated the firmware on my router. Etc, etc, etc. My computer directly thru the modem still shows the same IP, though my other computers don't. Any of them thru the router does. Of course, my main computer is the admin of the router.

I just got off of the phone with my ISP. He said that my download traffic was pretty high, 5 gigs today, 20 for the week. Upload was pretty normal. My copy of XP is an earlier SP1, so yeah, I downloaded a lot of updates, but between that, drivers, and a couple of programs, along with a couple of programs my grandson downloaded today, I just don't think we downloaded anywhere near 5 gigs today, and surely not 20 for the week. I wasn't even on for a couple of nights.

I'm at a total loss.

[FunkZ]

Go to https://www.grc.com/x/ne.dll?bh0bkyd2 and use the ShieldsUP utility to see if any ports are open and vulnerable.

If you are using a Cable/DSL router with built-in firewall there are usually not any. The only one that might not be stealthed is the IDENT port 113 which usually reports as closed. If you setup a forwarding rule in your router to a null IP on the inside then that will stealth that port as well.

So being that the router blocks pretty much any traffic from originating from outside your home network, the only vulnerability has to come at the request of a PC from inside. If you've got a trojan or some other malware on a PC on your network, it can be requesting junk to be downloaded from the internet or just generally wreaking havoc on your internal network.

You can use housecall.trendmicro.com for a free scan of your PC. I would recommend you start there for every machine on your network. To keep the bad stuff off make sure to take advantage of the new IE7, Windows Defender, and Windows Updates as well as useful 3rd party utilities like SpyBot Search & Destroy.

As for the whatismyip.com that will show you the outside IP address of your router, which is the IP assigned to you from your ISP. Each of your PC's inside the router will typically have a private IP such as something in the 192.168.1.x range. The router's job is to allow multiple PC's inside the network (all with private IP's) to share the one public IP address that your ISP gives you.

I would not operate a PC on a public IP without a firewall of some sort, not even on dial-up. If you have a home network, each PC should be protected by the router. If you have a single PC connected to a Cable/DSL modem or regular dial-up modem, use the built-in XP firewall or a personal software firewall like ZoneAlarm. I read a statistic somewhere that an unprotected PC on a public IP will be compromised within 30 minutes of being connected to the internet.