To: Martin E. Frankel who wrote (11678 ) 9/3/2000 6:37:29 PM From: mr.mark Respond to of 110582 hi marty... i was just about to shut down when i saw your post. let me quickly address a couple of your questions, then come back to them later if others haven't chipped in. i recently installed some tracer software and ran same using the IP address you posted. this program generates a text file for each trace. here is what it found on your 'friend'... ************************* PCHelp's --*# Network Tracer #*-- Copyright 1999 pchelp Free for non-commercial use. Free for any use. pc-help.org Tracing: 167.206.117.190 Date: 09-03-2000 Start Time: 3:18:45.20p -- PING RESPONSE -- Pinging 167.206.117.190 with 32 bytes of data: Reply from 167.206.117.190: bytes=32 time=307ms TTL=116 Ping statistics for 167.206.117.190: Packets: Sent = 1, Received = 1, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 307ms, Maximum = 307ms, Average = 307ms -- NetBIOS QUERY RESULTS -- Host not found. -- NSLOOKUP QUERY RESULTS -- Query type: PTR IP: 167.206.117.190 Server: ns2.netsol.com Address: 198.17.208.83 190.117.206.167.in-addr.arpa name = hicks117-190.optonline.net 117.206.167.in-addr.arpa nameserver = ns.cv.net 117.206.167.in-addr.arpa nameserver = ns.cvnet.com ns.cv.net internet address = 167.206.1.30 ns.cvnet.com internet address = 167.206.1.103 Query type: ANY Name: hicks117-190.optonline.net Server: ns2.netsol.com Address: 198.17.208.83 hicks117-190.optonline.net internet address = 167.206.117.190 optonline.net nameserver = ns.cv.net optonline.net nameserver = ns.cvnet.com ns.cv.net internet address = 167.206.1.30 ns.cvnet.com internet address = 167.206.1.103 -- DOMAIN NAME RECORD QUERY RESULTS -- NOTE: whois.abuse.net lists a Net-abuse report address for hicks117-190.optonline.net: support@optonline.net postmaster@optonline.net -- ARIN WHOIS QUERY RESULTS -- Cablevision Systems Corp. (NET-CVNET) One Media Crossways Woodbury, NY 11797 US Netname: CVNET Netnumber: 167.206.0.0 Maintainer: CVNT Coordinator: OOL Hostmaster (OH4-ORG-ARIN) hostmaster@CV.NET (516)393-3281 Domain System inverse mapping provided by: NS1.CVNET.COM 167.206.1.103 NS1.CV.NET 167.206.1.30 Record last updated on 19-Nov-1998. Database last updated on 1-Sep-2000 17:59:40 EDT. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. Trace Started: 3:18:45.20p Trace Finished: 3:19:37.16p ************************************** note the (my) bold text. that's at least a start on where to send info on this attacker. here's a useful article on zonealarm:zdnet.com particularly helpful is the last page of the article, posted here for your convenience. see how your settings are compared to the recommended ones.... **************************************** "Recommended Basic Settings To recap, these are the recommended settings for ZoneAlarm: Alerts Panel Log alerts to text file? Yes Show the alert popup window? Yes Lock Panel Automatic Lock: Enable Engage Internet lock after: 10 minutes Allow "Pass Lock"? if necessary for email client Security Panel Internet Zone: High Security Local Zone: High Security Internet Servers Blocked? Yes, unless server software is needed (see below) Local Servers Blocked? Yes, unless server software is needed (see below) MailSafe enabled? Yes Programs Panel Allow without asking: e-mail clients, Web browsers, non-ICQ instant messaging apps Allow after asking: media players, FTP clients, ICQ clients, and other applications normally allowed network access Disallow: applications not expected to have network access; any unknown software Pass Lock enabled: if necessary, e-mail clients; Web browsers and/or FTP clients should be given temporary pass lock status for long downloads Allow Server: none; if absolutely necessary, server applications should be assigned "allow after asking" status and given temporary server privileges when launched Configure Panel: On top during Internet activity? No Load ZoneAlarm at startup? Yes Check for updates automatically? Yes" *************************************** you asked about compatibility of other firewalls with zonealarm? i am now running three in tandem. za, blackice and norton personal firewall. no conflicts. <g3> i'll try to get back to you on some of your other stuff later, marty. time for some real world events in my life. :) mark