system
1
The other day my laptop was bombarded with a ‘NewTear’ ATTACK continuiously for over an hour from a unknown IP address and also my wifes PC, we are linked to the internet.
2011/04/23 10:42:09 192.168.2.4:13105 (KMA-PC) 239.255.255.250:13107 IDS: ‘NewTear’ Attack
2011/04/23 09:56:51 169.254.51.51:29541 239.255.255.250:15987 IDS: ‘NewTear’ Attack
My firewall blocked it and I banned that IP address but just wondering is my wifes PC comprimised or what is going on.
the notes in my firewall are:
A computer at IP Address 169.254.51.51 has sent traffic to your computer that was blocked by our Intrusion Detection System (IDS). The 'NewTear' attack attempts to exploit a problem in the Microsoft TCP/IP stack and how it handles incorrect UDP headers.
Pondus
2
curious…what firewall stopped this ?
My firewall blocked it and I banned that IP address but just wondering is my wifes PC comprimised or what is going on.
check your computer for malware with this....also run a quick scan with avast
Malwarebytes Anti-Malware 1.50.1 http://filehippo.com/download_malwarebytes_anti_malware/
always update so you have latest database before you scan
click on the remove selected button to quarantine anything found
system
3
McAfee
I scanned with AVAST after and it found nothing, I also have MBAM pro that found nothing as well.
Pondus
4
system
5
Yes I read that,more to the point I am wondering why it was saying my wifes PC was doing it as well :-\
DavidR
6
Well considering that IP 239.255.255.250 is a reserved one (see image), so I don’t know if this could be an external threat. Presumably 169.254.51.51 is the local network IP for your wife’s computer.