[SyK]

Hey all,

I think my router is getting attacked by a worm or something.

I'm using a D-Link DI-704P router and I noticed sometime last night that my Internet was getting extremely bogged down, and this was the case for all three computers on my network. I checked the router log and noticed that there were a bunch of "Unrecognized access" entries trying to get to my TCP port 135 and some on occassion to port 445. I talked with someone and found out that these ports were used by certain worms, so now I am attempting to start denying some of this traffic.

The problem is I can't seem to get this to work. When you log into the router, there is an option called "Packet Filter" where it appears you can filter packets both inbound and outbound by specifying source/destination IPs and the ports. I am trying to specify the router to disallow access to TCP port 135, but everytime I go back to check the router log, it's still allowing that unrecognized access.

I then tried to configure it to deny all packets except certain ports I specified. The frequency of the access to 135 reduced but now I'm getting unrecognized access to 23359.

So I guess I was wondering if anyone had any experience with packet filtering on a D-Link, or if they've had the same sort of experience and how they went about fixing it.

Here's a small extract from my router log as of right now...

Sunday, January 15, 2006 12:52:30 PM Unrecognized access from 24.166.108.96:26156 to TCP port 23359
Sunday, January 15, 2006 12:52:31 PM Unrecognized access from 205.251.46.188:3307 to TCP port 23359
Sunday, January 15, 2006 12:52:36 PM Unrecognized access from 201.128.250.8:3144 to TCP port 23359
Sunday, January 15, 2006 12:52:36 PM Unrecognized access from 24.166.108.96:26156 to TCP port 23359
Sunday, January 15, 2006 12:52:37 PM Unrecognized access from 205.251.46.188:3307 to TCP port 23359
Sunday, January 15, 2006 12:52:40 PM Unrecognized access from 71.249.71.116:50914 to TCP port 25119
Sunday, January 15, 2006 12:52:43 PM Unrecognized access from 71.249.71.116:50914 to TCP port 25119
Sunday, January 15, 2006 12:52:49 PM Unrecognized access from 71.249.71.116:50914 to TCP port 25119
Sunday, January 15, 2006 12:52:50 PM Unrecognized access from 200.112.49.109:2953 to TCP port 23359
Sunday, January 15, 2006 12:52:53 PM Unrecognized access from 200.112.49.109:2953 to TCP port 23359
Sunday, January 15, 2006 12:52:59 PM Unrecognized access from 200.112.49.109:2953 to TCP port 23359
Sunday, January 15, 2006 12:53:06 PM Unrecognized access from 70.49.167.74:2203 to TCP port 135


If I can get any advice it'd be greatly appreciated.