How did this connection get through?

I have a D-Link DSL-500(CZ) - firmware 1.14A - with port forwarding to
serve my various needs. But looking at ZoneAlarm's logs the other day, I
see that there have been two connection attempts to one of my various
computers, which were blocked. OK, having them blocked is why I have a
firewall.

But with port forwarding, how did this computer even receive the connection
attempt when the router does not have this particular port, 3167, forwarded
to this box? The router does not have this port listed at all?

I understand that if I initiate communication to "some where out there,"
the router has to keep track of which machine the reply should go back to.
But I'm sure these connection attempts are coming out of nowhere.

A Shields Up test specifying port 3167, capturing packets with EtherPeek,
shows no packets received from that port. So, either *now*, the router is
not forwarding that port, or ZoneAlarm is blocking it (but I get no
announcement from ZoneAlarm that it blocked that port).

What is Poweroncontact?

--
Remove INVALID from e-mail address.

Brian Smither
Smither Consulting

From: "Brian Smither" <(E-Mail Removed)>

| I have a D-Link DSL-500(CZ) - firmware 1.14A - with port forwarding to
| serve my various needs. But looking at ZoneAlarm's logs the other day, I
| see that there have been two connection attempts to one of my various
| computers, which were blocked. OK, having them blocked is why I have a
| firewall.
|
| But with port forwarding, how did this computer even receive the connection
| attempt when the router does not have this particular port, 3167, forwarded
| to this box? The router does not have this port listed at all?
|
| I understand that if I initiate communication to "some where out there,"
| the router has to keep track of which machine the reply should go back to.
| But I'm sure these connection attempts are coming out of nowhere.
|
| A Shields Up test specifying port 3167, capturing packets with EtherPeek,
| shows no packets received from that port. So, either *now*, the router is
| not forwarding that port, or ZoneAlarm is blocking it (but I get no
| announcement from ZoneAlarm that it blocked that port).
|
| What is Poweroncontact?
|
| --
| Remove INVALID from e-mail address.
|
| Brian Smither
| Smither Consulting

Go into the router and specifically block both TCP and UDP ports 3167.
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm