unrecognised access message

Hi

I have a Safecom SWAMRU 54108 4 port adsl modem and router, I'm not a
techie but checking the routers log I have stacks of the following message:

Unrecognised access from 84.13.23.1:4105 to TCP port 135

The address and port number vary

in simple terms, what's going on, is it normal, if not how can I stop it

any advise would be most welcome


Regards

Ian

> Unrecognised access from 84.13.23.1:4105 to TCP port 135
> The address and port number vary
> in simple terms, what's going on, is it normal, if not how can I stop it
> any advise would be most welcome

http://grc.com/port_135.htm

Its also used by a trojan (must be fairly old, as my list is a couple of
years old...)

"Doly is characterised by its irc notify ability , and its graphics ,
earlier editions where a bit buggy but the latest ones are very powerful
and its very very dangerous to become infected with this trojan."

Basically, it sounds like infected machines port scanning for machines
with an unpatched DCOM vulnerability.

Ignore it, and be glad you bought a router :-)

--
Please add "[newsgroup]" in the subject of any personal replies via email
--- My new email address has "ngspamtrap" & @btinternet.com in it ;-) ---

Colin Wilson wrote:
>> Unrecognised access from 84.13.23.1:4105 to TCP port 135
>> The address and port number vary
>> in simple terms, what's going on, is it normal, if not how can I
>> stop it any advise would be most welcome
>
> http://grc.com/port_135.htm
>
> Its also used by a trojan (must be fairly old, as my list is a couple
> of years old...)
>
> "Doly is characterised by its irc notify ability , and its graphics ,
> earlier editions where a bit buggy but the latest ones are very
> powerful and its very very dangerous to become infected with this
> trojan."
>
> Basically, it sounds like infected machines port scanning for machines
> with an unpatched DCOM vulnerability.
>
> Ignore it, and be glad you bought a router :-)

?????

It's reporting access, not blocked access, be better to make sure that the
OP is fully patched & has an up to date firewall running....

On Sun, 27 Feb 2005 08:44:24 -0000, "Ian" <(E-Mail Removed)>
wrote:

>Hi
>
>I have a Safecom SWAMRU 54108 4 port adsl modem and router, I'm not a
>techie but checking the routers log I have stacks of the following message:
>
>Unrecognised access from 84.13.23.1:4105 to TCP port 135
>
>The address and port number vary
>
>in simple terms, what's going on, is it normal, if not how can I stop it
>
>any advise would be most welcome
>
>
>Regards
>
>Ian
>
84.13.23.1 is opal telecom, the people that provide talk talk, look at
your headers. Have a word with your isp for help.

Thanks for taking the time to reply, I've contacted Talktalk but they said
there is nothing they can do, just check that your software firewall is set
up correctly.

I've downloaded a spyware program that has detected a number of 'high
threat' programs.

I still would like the router log not to be being filled with the original
message, but never mind :-(

Thanks anyway

Ian
<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Sun, 27 Feb 2005 08:44:24 -0000, "Ian" <(E-Mail Removed)>
> wrote:
>
>>Hi
>>
>>I have a Safecom SWAMRU 54108 4 port adsl modem and router, I'm not a
>>techie but checking the routers log I have stacks of the following
>>message:
>>
>>Unrecognised access from 84.13.23.1:4105 to TCP port 135
>>
>>The address and port number vary
>>
>>in simple terms, what's going on, is it normal, if not how can I stop it
>>
>>any advise would be most welcome
>>
>>
>>Regards
>>
>>Ian
>>
> 84.13.23.1 is opal telecom, the people that provide talk talk, look at
> your headers. Have a word with your isp for help.