Am I Being Attacked?

[Dibiase]

i am getting messages like these for the past 2 weeks, and i get this message at least 5 times a day.

[nmb]

take a look at all these :

1. http://www.trustedsource.org/query/24.143.82.171

2. http://www.trustedsource.org/query/24.68.50.115

3. http://www.trustedsource.org/query/24.103.180.26

4. http://www.trustedsource.org/query/24.229.110.150

5. http://www.trustedsource.org/query/24.77.220.169

it may or may not answer the question but it may help someone to help you.

[Dibiase]

so, im being DOS'ed?

[DavidR]

You personally, no, these DCOM attacks are random in nature as they use a random IP address generator in the hope of a couple of things:
1. you don't have an effective firewall.
2. your OS is vulnerable to attack, e.g. not fully up to date.

So what is your firewall as that should really be your first line of defence ?

Your ISP when you first connect assigns a dynamic IP address, this should change each time you first connect (broadband) or every time you connect (dial-up). So hopefully you can see it is not a targeted attack, but a speculative one. It is possible that someone who also uses that ISP has an infected system and that makes it a little easier to generate IP addresses for other ISP users.

[jpmartin]

I have the same things happen to me too, but i think the avast has detected it and block it before it get into your system. In my suggestion i think you should get the Malwarebytes' Anti-Malware on-demand version 1.40, they have the ip protection is very useful for you, but you have pay for it . it's block you from going to to those ip that was infected.

[DavidR]

MalwareBytes won't do anything to protect against this type of thing (it isn't a firewall) as it would have to first get on to your system. Also unless you get the Pro version it isn't resident so I don't see how this would work on the free version.

(ADDED) IP blocking protection - never connect to a malicious website again!

So from this you can see it is outbound protection only, and then as I said I don't see how the free version could do this if not resident.

Not to mention the avast Network Shield also blocks outbound DNS requests or direct IP connections to malicious sites.

[maxwachtel]

Your first line of defense should be a hardware router w/built-in firewall, they are inexpensive these days (I found mine on sale for 35$US).

[Shiw Liang]

Don't forget threat fire or spyware blaster or even eh Spybot guys what do you think?

[DavidR]

Neither of those program options will do anything to protect against this type of thing (DCOM inbound attack) as it would have to first get on to your system. SpywareBlaster may be of help if the attack came from one of the domains on its list, which I highly doubt.

DCOM attacks commonly come from infected systems in a botnet so a users IP dynamically assigned is unlikely to be on the list.

[Mr.Agent]

I did see this problem in a old thread of Avast! and the guy wasnt having Firewall so be sure you got 2 ways firewall.

[Yanto.Chiang]

If we speak about network and system security, they are have a huge products range to discussion.
The ideal network and system security are your company protected by Unified Threat Management Firewall (Firewall + Anti Spam + URL Filtering + IPS) and also System Antivirus.

If you have avast as your system protection then you need to decided your network security in e.g : Watchguard (www.watchguard.com) or Fortinet (www.fortinet.com), etc
As i knew DDos attacks normally could detected by IPS, and DDos always attacks your network to flooding your network pipe till your servers down and to avoid this you need to separate your IP Server then create it in different segment of your network like put in to DMZ port.

Hopefully my knowledge which i shared could solved your problem.