Why the heck is my computer passing data while it is powered off??!!

[HunterCub]

To preface this post i have recently done a full format of my computer, reinstalled drivers and has my computer checked for malware in the HJT log forum.

My computer seems to be infection free and yet I am having odd phenomenon like my modem still being able to see my computer when it is powered off and it also seems my computer is passing data through my modem while off as well.


I have no Idea why this is able to happen.

From wut McAffee has told me recently though, it seems like people have been trying to access various ports on my computer (mostly UDp ports 1026-1028). I also know people have been trying to access my comp using PC Anywhere and another program like it.


Any suggestions or comments?

[Done_Fishin]

If your PC is powered off, nothing can get in or out, but your router/modem is another matter.

I am assuming that you have enabled DHCP and that your router will constantly be in contact with your ISP.

The router is probably putting up a bogus local network IP which (when in contact with your PC) will then translate to the proper network address in order to allow you and your "authorised" IP's on the www to keep in contact.

It's not unusual for hackers to try to gain access to your router, that's why it's important to have a good firewall. I prefer to have one on the router and another on (each of) my PC(s).

It's extremely important that you also get inside your router and change the default password.. it's the same password for every model number made by the same manufacturer, and the hackers are very much aware of this.
NOT changing that password can allow a hacker to gain control of your router, and in the least, making it unusable by yourself to gain access to the Internet. I don't know just how much damage the hacker can do when he gets that far ..

and I personally wouldn't like to find out, especially the hard way.

[HunterCub]

I dont have a router, I just have my cable modem connected directly between my comp and the wall outlet. if there is a router on the network it is owned by cox and is not anywhere i can access.

As for DHCP, yes it is activated otherwise Cox service doesnt work.

[Done_Fishin]

If you have a good firewall then it should keep most of the hackers out. DHCP will keep your true location hidden at your ISP. Every time you close and re-open your link you'll get a new connection from your ISP which should have a different IP.
Hackers will try to get through but your firewall should stop them .. just make sure that you have it configured properly and enabled at all times. Only open ports for services that are really important to you. If you don't have a firewall , sugest you ghet and use ZoneAlarm .. free to home users with a limitations, but good. Also askes you if a new program/source is trying to access the internet, your PC or network. Gives you control.

[HunterCub]

I have McAffee firewall activated.

As for my IP address, it is static (never changes)

[Done_Fishin]

I think you'll find it's static for your ISP but your ISP should be using DHCP or similar to "fool" the whereabouts of your true identity. Check it out with your ISP.
Maybe some other networking guys will post their thoughts about this and your starting post.

[crazijoe]

As for my IP address, it is static (never changes)

How do you know it's static?

[HunterCub]

because i can see it in my network connections. It is always the same everytime i look at it. PLus I had to have it changed recently because I was getting pinged and peeps kept tryin to get into my computer. After i had the ip changed the hits slowed a tiny bit but since then the hits are back at there normal 2-10 per 10 minutes heck sometimes even more. A few hits recently have been HTTP Proxy Scans and scans of my various UDP and CP/IP ports.

[crazijoe]

Unplug the modem and plug it back in and I bet you get a different IP.

[HunterCub]

no if i reset the modem i get the exact same ip again
same if i disconect the ethernet (cat 5) cable which i have been doing when i power off the computer since it was still trying to pass data

[JohnthePilot]

Originally Posted by HunterCub

because i can see it in my network connections. It is always the same everytime i look at it. PLus I had to have it changed recently because I was getting pinged and peeps kept tryin to get into my computer. After i had the ip changed the hits slowed a tiny bit but since then the hits are back at there normal 2-10 per 10 minutes heck sometimes even more. A few hits recently have been HTTP Proxy Scans and scans of my various UDP and CP/IP ports.

2-10 a minute is quite normal. I also use McAfee and occasionally look at the event viewer. It's amazing how many people do try and acccess your machine. I dread to think what would happen if I didn't have my firewall up.

[HunterCub]

I also just got hit by someone tryin to use VNC-App1 is that a possible problem?

[HunterCub]

Oh, also, is it safe to turn off the blue warning banners that McAffee posts? Having them pop up letting me know people are trying to get into my computer once or more a minute is quite annoying.

Also, is it necessary to ban all the IP's trying to get into my comp? That gets annoying as well.

[JohnthePilot]

Originally Posted by HunterCub

I also just got hit by someone tryin to use VNC-App1 is that a possible problem?

Not as long as your firewall is up.

[HunterCub]

Originally Posted by JohnthePilot

Not as long as your firewall is up.

I never turn it off, although some programs do make exeptions automatically in the firewall so they can work. Like any kind of messanger for instance.

[JohnthePilot]

Originally Posted by HunterCub

I never turn it off, although some programs do make exeptions automatically in the firewall so they can work. Like any kind of messanger for instance.

In that case don't worry. McAfee is obviously doing it's job.