Advice Request Who is attacking me?

[LukeNukesEm]

Kaspersky blocked a network attack just now, and when I look at the logs, I've been attacked multiple times. Scans come up with nothing. I think something could've gotten through as I left voodooshield on training for a few days. Check the file I uploaded, it's the logs of the attacks. Thanks in advance!

 

[Ink]

Do you have a home router with hardware firewall enabled?

221.232.247.2 | China Telecom Hubei | AbuseIPDB
120.193.156.74 | China Mobile Guangdong | AbuseIPDB
180.164.117.123 | China Telecom Shanghai | AbuseIPDB

 

[Wave]

Run some scans with a couple on-demand scanners and if it doesn't pick anything up then create a FRST log and post it in the MRA section for TwinHeadedEagle to look at just to double check that your system is actually clean since malware can leak your IP address to the attacker and this can then be used to attack you via botnet infected systems and the such.

I wouldn't get paranoid about it though because then you'll become stressed and won't be thinking straight, and in this situation you'll just make things worse than resolved.

 

[Ink]

I wouldn't get paranoid about it though because then you'll become stressed and won't be thinking straight, and in this situation you'll just make things worse than resolved.

Routers are first line against "attackers" and are not uncommon?

 

[Wave]

Routers are first line against "attackers" and are not uncommon?

To be completely honest I am not sure because networking is more of a weakness of mine than a strength, but I guess for what it's worth he may as well make a log and post it in the MRA as it could lead to somewhere but I am not actually sure.

 

[askmark]

Kaspersky blocked a network attack just now, and when I look at the logs, I've been attacked multiple times. Scans come up with nothing. I think something could've gotten through as I left voodooshield on training for a few days. Check the file I uploaded, it's the logs of the attacks. Thanks in advance!

Someone from the internet is scanning your PC for a Sql server listener (udp port 1434) which is used by the Slammer worm to infect networks.

If Kaspersky is intercepting these attacks then either a) you don't have a hardware router with builtin firewall or b) you've placed your PC in the router"s DMZ (all inbound internet traffic effectively bypasses the router and is sent directly your PC). Either way is a very risky way to be connected to the internet.

How does your PC connect to the internet?

 

[Berny]

Also , please contact Tech Support https://center.kaspersky.com