Member Avatar for ejames82

compatibility issues made it necessary to switch from zone alarm to kerio personal. i was told that it is complicated.
my greatest fear is that i have already allowed a hacker in. would any of you experienced kerio personal firewall users guide me thru the steps of shutting down traffic, allowing necessary traffic passage, and researching the connections i have already allowed.
when i get a message like this, "incoming alert- a computer at is attempting to gain access to your computer" how do i know if this is a good guy or a bad guy. any programs that i can use to find out who this IP address is? thanks, Ed James

  • 2 Contributors
  • 2 Replies
  • 108 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by ejames82

Dani AI

Generated

Quick checklist for an urgent lockdown and a practical investigation, tuned to a Kerio switch.

If a live intrusion is suspected, isolate the PC first: unplug the cable or disable Wi-Fi, and do not use that machine to change passwords or access sensitive accounts. Use a known-clean device to change critical passwords (email, banking, routers). After isolation, run an offline or full-scan antivirus and a rootkit scanner before reconnecting.

To see what is currently connected and which process opened the socket, use built-in Windows tools from an elevated command prompt:

netstat -ano
netstat -ano | findstr ESTABLISHED
tasklist /FI "PID eq 1234"
tasklist /svc /FI "PID eq 1234"

Map any suspicious PIDs to running programs, then check startup items (msconfig) and Autoruns (Sysinternals) for persistence. If an unknown process has an established remote connection, terminate it, quarantine with AV tools, and consider offline rescue media for deeper inspection.

In Kerio: review the connection/log history and the per-application rules. Temporarily restrict the policy to deny everything except explicitly allowed programs, and remove any auto-created or unfamiliar rules. If the current rule set looks corrupted or confusing, uninstall Kerio cleanly, reboot, scan the machine, then reinstall and rebuild a conservative rule set that only permits known apps outbound.

For investigating remote IPs, use WHOIS and IP-reputation lookup services and note the remote port: many unsolicited attempts are just scans. An isolated single probe is not proof of compromise; persistent ESTABLISHED sessions to unknown hosts are. If compromise is confirmed or uncertainty remains, prefer restoring from a known-good backup or a clean OS reinstall.

Thanks to for the WHOIS suggestion — that’s a good next step after isolating and mapping connections.

Recommended Answers

All 2 Replies

Member Avatar for caperjack

I use windows firewall ,but here is a site to search ip address although it shows noting for the one you posted .
http://whois.domaintools.com/

Member Avatar for ejames82

caperjack,
that's alot of interesting stuff that you've provided me with. i am going to be busy for a while. thanks, Ed James

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.