Kaspersky - "Attacked!" popup box

Morlan · 11 Mar 2006 at 00:11

I recieve this message a few times a day. It's always the same virus "Helkern" Why isn't the Windows Firewall catching it before it reaches Kaspersky? I also have a firewall on my router.
Kaspersky won't give me the port number that I've been attacked on, it there anyway to find out?

ste_bla · 11 Mar 2006 at 00:17

MS SQL ports 1434

from

http://www.avp.ch/avpve/worms/sql/helkern.stm

Morlan · 11 Mar 2006 at 01:04

Thanks pal.
That's odd as I don't have that port open on the router. I don't even have a sQL server. Any ideas why attacks are getting through on this port?

bledd · 11 Mar 2006 at 01:40

perhaps dmz is turned on on your router."?

Morlan · 11 Mar 2006 at 01:49

Hi bledd. No, dmz is not turned on. But the router aside, why isn't XP Firewall blocking this port? I've checked the exceptions and there is no port 1434 open. I really don't get it. The attacking IP address is always different so something is getting through to my PC. I've done full virus scans, XP is all patched up, the router firewall is on. It's a bit of a mystery.

How could I test my router for security or open ports? Is there a site or tool that I could use?

Many thanks.

Scythe · 11 Mar 2006 at 09:43

I use ShieldsUp, its very good.
https://www.grc.com/x/ne.dll?bh0bkyd2

Aliboy · 11 Mar 2006 at 09:45

Scythe said:
I use ShieldsUp, its very good.
https://www.grc.com/x/ne.dll?bh0bkyd2

Seconded

Fourstar · 11 Mar 2006 at 09:50

Old No.7 said:
Seconded

Was just going to suggest the same

It also looks like the traffic comes over UDP. Maybe your firewalls are only blocking TCP?

markysparky · 13 Mar 2006 at 12:33

Windows firewall is rubbish - its like having no firewall at all. Find yourself another firewall, by the way a lot of people receive that message on kaspersky. not sure why but it seems very common

Morlan · 13 Mar 2006 at 20:24

Thanks for that ShieldsUp link. I ran a test on port 1434 and it passed. It must be a false alarm with Kaspersky as markysparky says others are having the same popup.

sedj · 18 Mar 2006 at 22:41

markysparky said:
by the way a lot of people receive that message on kaspersky. not sure why but it seems very common

Im one of those people, could it be kasperskys way of showing its doing something ??

Tis annoying when your ingame tbh.

n3x · 20 Mar 2006 at 16:39

im in the same boat

there must be some way of disabling the message...?

Rambaud · 26 Mar 2006 at 11:18

n3x said:
im in the same boat

there must be some way of disabling the message...?

Yes, there is :

"PROBLEM
Kaspersky Anti-Hacker notifies you there was attempted Helkern attack on your computer. If you receive repeated notifications, you can disable the Helkern notification option within the Kaspersky Anti-Hacker Intrusion Detection System. Disabling the notification does not halt protection.

RESOLUTION
Open Kaspersky Anti-Hacker from the Windows system tray (located near the clock).
From the Service menu on the upper left, click Settings.
From the Intrusion Detection System tab under Attack type: select Helkern (enabled) and clear the Enable detection of this attack check box.
Then click OK.

Hopefully, that should do it.