BlueMedicine Security Forum

heb al enkele weken een router en bekeek zonet het log van de firewall en dat ziet er maar raar uit. kan er iemand mij zeggen of dit goed is of niet?
er hangen twee pc's met draad aan de router en twee laptops met draadloos. ze zijn allevier gescand met combofix en virusvrij.

09/22/2009 00:24:01 **UDP Flood Stop** (from WAN Inbound)
09/22/2009 00:24:00 **UDP flood** 82.155.5.13, 21961->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:24:00 **UDP flood** 86.98.167.221, 60760->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:23:59 **UDP flood** 116.206.153.5, 21831->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:59 **UDP flood** 58.94.58.60, 16594->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:59 **UDP flood** 60.50.10.215, 1087->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:58 **UDP flood** 116.68.113.5, 17770->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:58 **UDP flood** 75.162.46.13, 12630->> 81.82.129.218, 24104 (from WAN Inbound)
09/22/2009 00:23:58 **UDP flood** 58.13.205.211, 11851->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:56 **UDP flood** 212.182.64.150, 27420->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:55 **UDP flood** 85.134.105.243, 19662->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:54 **UDP flood** 173.23.200.252, 25105->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:54 **UDP flood** 75.158.57.46, 59502->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:54 **UDP flood** 69.122.7.25, 27344->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:53 **UDP flood** 219.197.164.40, 21893->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:23:52 **UDP flood** 221.224.233.90, 3180->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:52 **UDP flood** 92.61.64.213, 51029->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:23:52 **UDP flood** 98.14.185.23, 38116->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:52 **UDP flood** 69.144.154.170, 61268->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:23:51 **UDP flood** 89.142.252.193, 23873->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:51 **UDP flood** 95.35.81.43, 8704->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:51 **UDP flood** 113.61.134.46, 7283->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:50 **UDP flood** 151.61.43.51, 13132->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:23:49 **UDP flood** 219.77.147.140, 15735->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:49 **UDP flood** 68.147.20.59, 19782->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:49 **UDP flood** 209.102.246.83, 16042->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:48 **UDP flood** 94.96.87.100, 800->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:48 **UDP flood** 24.166.101.9, 30902->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:23:48 **UDP flood** 68.173.82.215, 40173->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:47 **UDP flood** 189.144.187.109, 57342->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:47 **UDP flood** 219.128.2.117, 6881->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:25 **UDP flood** 219.128.2.117, 6881->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:16 **UDP flood** 192.168.2.4, 16941->> 212.36.12.5, 53917 (from WAN Outbound)
09/22/2009 00:23:16 **UDP flood** 192.168.2.4, 16941->> 189.191.98.119, 54157 (from WAN Outbound)
09/22/2009 00:23:16 **UDP flood** 192.168.2.4, 16941->> 69.243.30.185, 26669 (from WAN Outbound)
09/22/2009 00:23:16 **UDP flood** 192.168.2.4, 16941->> 68.82.226.208, 27863 (from WAN Outbound)
09/22/2009 00:23:16 **UDP flood** 192.168.2.4, 16941->> 114.30.118.222, 42038 (from WAN Outbound)
09/22/2009 00:23:15 **UDP flood** 192.168.2.4, 16941->> 213.63.66.208, 32542 (from WAN Outbound)
09/22/2009 00:23:15 **UDP flood** 192.168.2.4, 16941->> 116.48.2.181, 60954 (from WAN Outbound)
09/22/2009 00:23:15 **UDP flood** 192.168.2.4, 16941->> 67.61.6.82, 6881 (from WAN Outbound)
09/22/2009 00:23:15 **UDP flood** 61.57.89.63, 64177->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:23:15 **UDP flood** 192.168.2.4, 16941->> 211.76.175.170, 1809 (from WAN Outbound)
09/22/2009 00:23:15 **UDP flood** 192.168.2.4, 16941->> 75.156.206.237, 46850 (from WAN Outbound)
09/22/2009 00:17:13 **UDP Flood Stop** (from WAN Inbound)
09/22/2009 00:17:11 **UDP flood** 125.25.104.154, 10618->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:10 **UDP flood** 195.158.110.231, 5900->> 81.82.129.218, 17284 (from WAN Inbound)
09/22/2009 00:17:09 **UDP flood** 81.82.129.218, 43270->> 195.130.130.4, 53 (from WAN Outbound)
09/22/2009 00:17:09 **UDP flood** 80.171.8.80, 53802->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:09 **UDP flood** 222.147.254.194, 12059->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:17:08 **UDP flood** 74.182.94.219, 50110->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:17:08 **UDP flood** 82.173.121.22, 33104->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:07 **UDP flood** 24.83.112.163, 7674->> 81.82.129.218, 17013 (from WAN Inbound)
09/22/2009 00:17:07 **UDP flood** 189.75.16.218, 13668->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:07 **UDP flood** 195.131.163.239, 7124->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:06 **UDP flood** 218.254.100.182, 18142->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:17:06 **UDP flood** 219.78.152.152, 10621->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:17:06 **UDP flood** 200.35.75.139, 24193->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:06 **UDP flood** 118.168.187.187, 24558->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:06 **UDP flood** 99.230.246.189, 25705->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:05 **UDP flood** 118.171.127.172, 19772->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:04 **UDP flood** 88.220.143.131, 6431->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:04 **UDP flood** 118.243.21.44, 19049->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:17:04 **UDP flood** 210.6.7.169, 18888->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:04 **UDP flood** 97.85.43.47, 25573->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:03 **UDP flood** 216.121.240.17, 61580->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:03 **UDP flood** 219.127.92.162, 9830->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:03 **UDP flood** 75.83.4.128, 41032->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:02 **UDP flood** 84.223.34.1, 44807->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:01 **UDP flood** 62.39.227.248, 21199->> 81.82.129.218, 17013 (from WAN Inbound)
09/22/2009 00:17:01 **UDP flood** 203.87.184.6, 15301->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:01 **UDP flood** 70.152.125.211, 54187->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:01 **UDP flood** 38.117.84.123, 26952->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:17:01 **UDP flood** 84.79.84.56, 18838->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:16:58 **UDP flood** 151.66.221.77, 16925->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:16:58 **UDP flood** 82.120.97.5, 53133->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:16:57 **UDP flood** 117.199.96.138, 8093->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:16:57 **UDP flood** 189.100.225.214, 15103->> 81.82.129.218, 17179 (from WAN Inbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 95.96.237.5, 22443 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 99.199.50.168, 61836 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 123.103.46.248, 62379 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 69.159.170.30, 61968->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 89.128.231.238, 20215 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 94.169.18.0, 16731 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 188.126.11.56, 49181->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 88.173.170.75, 45816 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 71.237.96.154, 15493 (from WAN Outbound)
09/22/2009 00:16:51 **UDP flood** 66.130.47.95, 40994->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:16:51 **UDP flood** 192.168.2.3, 23971->> 71.63.90.128, 41630 (from WAN Outbound)
09/22/2009 00:16:50 **UDP flood** 192.168.2.3, 23971->> 77.100.217.168, 60813 (from WAN Outbound)
09/22/2009 00:08:36 **UDP flood** 192.168.2.4, 16941->> 123.203.60.227, 37285 (from WAN Outbound)
09/22/2009 00:08:36 **UDP Flood Stop** (from WAN Inbound)
09/22/2009 00:08:36 **UDP flood** 192.168.2.4, 16941->> 24.27.54.237, 50242 (from WAN Outbound)
09/22/2009 00:08:36 **UDP flood** 192.168.2.4, 16941->> 81.201.255.88, 33006 (from WAN Outbound)
09/22/2009 00:08:35 **UDP flood** 98.215.150.170, 59911->> 81.82.129.218, 24268 (from WAN Inbound)
09/22/2009 00:00:57 **UDP Flood Stop** (from WAN Outbound)
09/22/2009 00:00:56 **UDP flood** 59.40.44.65, 14666->> 81.82.129.218, 17089 (from WAN Inbound)
09/22/2009 00:00:55 **UDP flood** 88.105.166.38, 44643->> 81.82.129.218, 17176 (from WAN Inbound)
09/22/2009 00:00:55 **UDP flood** 173.88.204.175, 19880->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:53 **UDP flood** 220.141.34.216, 20025->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:53 **UDP flood** 97.104.174.249, 27271->> 81.82.129.218, 17284 (from WAN Inbound)
09/22/2009 00:00:53 **UDP flood** 66.244.127.44, 21066->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:53 **UDP flood** 74.115.1.16, 10965->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:52 **UDP flood** 95.37.73.15, 39148->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:52 **UDP flood** 217.17.37.5, 42713->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:51 **UDP flood** 96.230.141.195, 50564->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:51 **UDP flood** 83.14.166.122, 34323->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:50 **UDP flood** 87.222.240.80, 49722->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:48 **UDP flood** 76.30.237.3, 40233->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:48 **UDP flood** 76.122.249.157, 55011->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:48 **UDP flood** 24.26.81.64, 58550->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:48 **UDP flood** 91.15.52.76, 26894->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:47 **UDP flood** 93.108.195.106, 17779->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:47 **UDP flood** 69.144.154.170, 61268->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:46 **UDP flood** 79.132.119.251, 42746->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:46 **UDP flood** 89.29.230.58, 29173->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:46 **UDP flood** 78.106.220.245, 29036->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:46 **UDP flood** 95.133.69.199, 56413->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:45 **UDP flood** 80.42.176.249, 44040->> 81.82.129.218, 17273 (from WAN Inbound)
09/22/2009 00:00:45 **UDP flood** 219.137.22.123, 11895->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:45 **UDP flood** 84.54.184.2, 59702->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:44 **UDP flood** 84.52.6.58, 11186->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:44 **UDP flood** 123.193.206.10, 16739->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:44 **UDP flood** 66.233.44.130, 53506->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:43 **UDP flood** 61.135.162.202, 6881->> 81.82.129.218, 17179 (from WAN Inbound)
09/22/2009 00:00:43 **UDP flood** 219.85.47.194, 11234->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:43 **UDP flood** 192.168.2.3, 23971->> 84.64.199.87, 30257 (from WAN Outbound)
09/22/2009 00:00:42 **UDP flood** 76.68.115.210, 60649->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:42 **UDP flood** 192.168.2.3, 23971->> 211.30.120.154, 42572 (from WAN Outbound)
09/22/2009 00:00:41 **UDP flood** 93.189.149.244, 19834->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:41 **UDP flood** 192.168.2.3, 23971->> 90.60.48.97, 60540 (from WAN Outbound)
09/22/2009 00:00:41 **UDP flood** 117.255.72.142, 59229->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:40 **UDP flood** 79.110.5.16, 17343->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:40 **UDP flood** 192.168.2.3, 23971->> 95.74.53.208, 54040 (from WAN Outbound)
09/22/2009 00:00:39 **UDP flood** 192.168.2.3, 23971->> 90.200.1.2, 60503 (from WAN Outbound)
09/22/2009 00:00:39 **UDP flood** 192.168.2.3, 23971->> 78.37.48.217, 61980 (from WAN Outbound)
09/22/2009 00:00:38 **UDP flood** 91.177.48.80, 15086->> 192.168.2.3, 23971 (from WAN Inbound)
09/22/2009 00:00:38 **UDP flood** 81.82.129.218, 43195->> 195.130.130.4, 53 (from WAN Outbound)
09/22/2009 00:00:38 **UDP flood** 83.22.81.190, 10175->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:38 **UDP flood** 91.107.75.159, 56984->> 81.82.129.218, 17317 (from WAN Inbound)
09/22/2009 00:00:38 **UDP flood** 192.168.2.3, 23971->> 86.213.143.129, 23500 (from WAN Outbound)
09/22/2009 00:00:37 **UDP flood** 192.168.2.3, 23971->> 126.118.162.161, 18471 (from WAN Outbound)
09/22/2009 00:00:37 **UDP flood** 192.168.2.3, 23971->> 90.216.109.98, 23676 (from WAN Outbound)
09/22/2009 00:00:37 **UDP flood** 192.168.2.3, 23971->> 66.15.45.134, 6648 (from WAN Outbound)
09/22/2009 00:00:37 **UDP flood** 192.168.2.3, 23971->> 61.255.100.186, 55069 (from WAN Outbound)
09/22/2009 00:00:37 **UDP flood** 192.168.2.3, 23971->> 76.172.77.34, 48338 (from WAN Outbound)
09/22/2009 00:00:37 **UDP flood** 192.168.2.3, 23971->> 78.106.157.213, 20490 (from WAN Outbound)
09/22/2009 00:00:36 **UDP flood** 192.168.2.3, 23971->> 122.90.171.94, 16697 (from WAN Outbound)
09/22/2009 00:00:36 **UDP flood** 192.168.2.3, 23971->> 79.164.126.110, 9090 (from WAN Outbound)
09/22/2009 00:00:35 **UDP flood** 192.168.2.3, 23971->> 210.6.107.146, 62909 (from WAN Outbound)
09/22/2009 00:00:35 **UDP flood** 192.168.2.3, 23971->> 81.24.123.189, 54701 (from WAN Outbound)
09/22/2009 00:00:35 **UDP flood** 118.100.198.108, 16603->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:34 **UDP flood** 192.168.2.3, 23971->> 84.59.34.202, 18965 (from WAN Outbound)
09/22/2009 00:00:34 **UDP flood** 192.168.2.3, 23971->> 92.80.61.54, 29769 (from WAN Outbound)
09/22/2009 00:00:34 **UDP flood** 221.223.249.203, 9789->> 192.168.2.4, 16941 (from WAN Inbound)
09/22/2009 00:00:34 **UDP flood** 192.168.2.3, 23971->> 200.126.136.165, 60998 (from WAN Outbound)

Het kunnen zowel false-meldingen zijn als een echt probleem. Waarschijnlijk zijn deze meldingen veroorzaakt door het surfgedrag. Wil je zeker zijn dat het niets is, biedt dan even een Hijackthis-log aan om te laten controleren in de HJT-sectie en verwijs in je melding even naar dit item. Een van onze specialisten zal dan je log even goed bestuderen en daar waar nodig adviezen geven.

maar met welke pc moet ik het log dan maken want er hangen 4 pc's aan de router

In het overzicht zie je dat de meldingen redelijk geclusterd zijn. Middels de tijdindicatie kun je achterhalen met welke pc je op dat moment aan het werk was. Neem dan van die pc een log.

Ter verduidelijking, het gaat om de pc waarmee je op de volgende tijd en datum in ieder geval mee aan het werk bent geweest:

• 09/22/2009 - 00:00:34 tot 00:00:57
• 09/22/2009 - 00:16:51 tot 00:17:13
• 09/22/2009 - 00:23:15 tot 00:24:01

Zo te zien zal het hier om dezelfde pc gaan.

Aangezien er al een tijd niet gereageerd is ga ik er vanuit dat je probleem opgelost is. Hierbij sluit ik het topic. Indien je het weer open wilt hebben, stuur mij dan even een PM.