my norton's alerted me to an attack and blocked it. this is the ip address it shows 24.29.160.65 what should i do now?

 

Quarantine & delete it.

 

It was blocked. Do nothing. Probably came from some poor sap who doesn't even know his machine has it. My firewall logs show sometimes as many as 1000 port probes and connection attempts an hour, it just logs and ignores them....

 

Not much more to do other than what was noted. As was mentioned, most likely someone that has no clue they have have an infected computer. FWIW, here is the info on that IP addy (this is readily available public information, source = http://ww2.arin.net/whois/):



Search results for: 24.29.160.65


OrgName: Road Runner
OrgID: RRMA
Address: 13241 Woodland Park Road
City: Herndon
StateProv: VA
PostalCode: 20171
Country: US

ReferralServer: rwhois://ipmt.rr.com:4321

NetRange: 24.24.0.0 - 24.29.255.255
CIDR: 24.24.0.0/14, 24.28.0.0/15
NetName: ROAD-RUNNER-1
NetHandle: NET-24-24-0-0-1
Parent: NET-24-0-0-0-0
NetType: Direct Allocation
NameServer: DNS1.RR.COM
NameServer: DNS2.RR.COM
NameServer: DNS3.RR.COM
NameServer: DNS4.RR.COM
Comment:
RegDate: 2000-06-09
Updated: 2002-08-22

TechHandle: ZS30-ARIN
TechName: ServiceCo LLC
TechPhone: +1-703-345-3416
TechEmail: abuse@rr.com

OrgAbuseHandle: ABUSE10-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-703-345-3416
OrgAbuseEmail: abuse@rr.com

OrgTechHandle: IPTEC-ARIN
OrgTechName: IP Tech
OrgTechPhone: +1-703-345-3416
OrgTechEmail: abuse@rr.com

# ARIN WHOIS database, last updated 2004-07-06 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

 

Thanks....that is cool....with that kind of info you really can't hide....

 

Well, yes and no. With the date and time, RR can ID who has that IP addy. From my end, I don't know how to see exactly who it is.

 

i copied the info and reported it to Road Runner, well see what happens if they do anything with it. thanks again.