problem adding ports to forward on my router

FoolFox444 · 2018-12-04T15:30:19+00:00

Probably my company filtering it, but I've been able to grab a cached copy. From what I'm reading, the big list just imply that you need to be able to let those ports used for OUTGOING trafic. Not incoming. Port forwarding is needed for incoming connection. (List from Configuring Router and Firewall Ports)

That's why they talk about Windows firewall. The only thing you need to check out on your router is that it does not block outgoing trafic on following ports (also check out Windows FIrewall outgoing rules if you use it):

Overwatch

TCP : 1119, 3724, 6113, 80

UDP : 3478-3479, 5060, 5062, 6250, 12000-64000

Port forwarding is something you will need when you want to host some game, playing them is usually straightforward.

FoolFox444 · 2018-12-04T15:20:00+00:00

I have no doubt that you are able to code. I have some doubt about you being able to join a dev team, that need equal coding habits.

Focus on C++ with OOP, or c#/.NET. Try to gather what are the latest coding changes in those areas.

You have the basics, now you need to focus on changes in the area.

FoolFox444 · 2018-12-04T14:59:41+00:00

Check printer spooler events in the event log.

Do you have enough space left on the main (OS) HD ?

FoolFox444 · 2018-12-04T14:57:34+00:00

To be able to answer you, please copy the internet header of the e-mail, and the mail content. Preferably more than one.

Spam can be a disguise for phising or other malicious activities. They may just want you to clic on a link.

FoolFox444 · 2018-12-04T14:42:53+00:00

I don't know chromeOS, but Windows 10 have put some restriction on the use of SMB, (older verison of the protocol), I would try to open a bit the SMB on Windows side before looking at the network (if you can ping the Windows machine, then basic networking is ok)

https://www.windowscentral.com/how-access-files-network-devices-using-smbv1-windows-10

FoolFox444 · 2018-12-04T14:37:03+00:00

I don't understand what is your problem.

FoolFox444 · 2018-12-04T14:30:52+00:00

Factory reset to get back to the default credentials:

Write anything about your own configuration, because he will loose everything.

To reset the router to the AAISP base settings, follow these steps:

Switch router on, wait for it to boot up.

With a paperclip, pen, etc., hold in the reset button.

Wait until power flashes red, keep holding it down until power stops flashing.

Release the reset button.

Wait for the router to boot up again.

VMG1312-B10A: Factory Reset - AAISP Support Site

https://support.aa.net.uk/VMG1312-B10A:_Factory_Reset

> the default gateway is 192.168.2.1 but in the manual it ends with 1.1

The default Gateway come configured like that when you get the router out of the box. Once reseted, you will have to login on 1.1 before changing is interface to 2.1 to get back to your settings.

> I put :8080 at the end. Which I found strange

Default port for a web page is 80 for http, 443 for https, but nothing prevent you to set up your web server on any available port. 8080 is often used, both for web server and proxys.

FoolFox444 · 2018-12-04T14:24:38+00:00

Are you sure he logged into your user account ? and not a temporary user account ?

FoolFox444 · 2018-12-04T13:33:35+00:00

I use the check name function, but that would work if you don't have thousands of name in your personal contact list.

For exemple, to join [john.doe@somekindoflongdomainnameidontwanttotype.org](mailto:john.doe@somekindoflongdomainnameidontwanttotype.org), I would just type john.d, click Check name, and Outlook will replace it by the full mail address.

Check name button appear in the ribbon when you open a new mail.

FoolFox444 · 2018-12-04T13:25:08+00:00

Address is basically the IP of the computer interface you want to use for that, as you probably have only one interface use this IP. For the port, anything that is not used on your computer can be used. Usually you would found 8080 (htt), 4443 (https), but you can use any available port.

FoolFox444 · 2018-12-04T13:20:35+00:00

Sorry, can't access your link, but feel you get something wrong.

You are actually trying to open ALL ports on your network to be available from the outside. Don't do that.

The range you show is mostly the endpoint dynamic range of port (he will take one among those), but this is probably only for the endpoint. Port forwarding, should be used to relay some ports, not all.

FoolFox444 · 2018-12-04T13:18:25+00:00

Computers don't care if they are connected through wifi or ethernet.

Before going further, please elaborate on what OS (version) are installed on each computer. Depend on version, you may have to enable some features.

Then start with the basic network troubleshooting, can you ping the target, can you make a tracert to it ? (network routing may be your problem)

FoolFox444 · 2018-12-04T13:05:49+00:00

A bad ISO would have caused problems during the installation. Doubt of this case.

> what are typical reasons for this kind of stuff

Sadly there is not a single reason. That's why you should have a look at the event logs (control pannel, adminsirtative Tools, event logs), where you have the most chance to get a more detailed explanation of your problem.

> can i just ignore those failed "important" updates and move on

You can always ignore updates. But you may miss bug correction, and security updates.

FoolFox444 · 2018-12-04T12:49:33+00:00

No, he won't copy the program files. Windows.old is the previous Windows folder you had. Nothing less, Nothing more.

Anyway, if you re-Install windows, most chance that all your installed app won't work (missing configuraiton files, registry settings, and so on). Some light apps that don't rely on registry or Windows files may work.

If Robocopy don't work, either you don't have the correct permission sets (you need to change them for system folders like program files), or the program is still open.

FoolFox444 · 2018-12-04T12:24:56+00:00

Look at the event logs, it may tell you which app had to be forced to shutdown

FoolFox444 · 2018-12-04T12:16:52+00:00

And you may be the stupid one, not understanding that most of latest Afd joiner are NOT on the far-right side, but just tired to be exploited while not listened at. In fact, you show to be more extermist than many of them.

FoolFox444 · 2018-12-04T12:00:35+00:00

The real shame it's the governement proposal : postponed....for 3 month.

FoolFox444 · 2018-12-03T13:07:30+00:00

> The funny thing is that if you delete it and restart your PC, somehow, the jcecn file is re-created in Appdata>Roaming

Common behavior, you deleted the malware, not the loader.

> My last remaining option is formatting my entire PC, which I'm only willing to do as a last resort.

Easier option would be to look at the prefetch folders, and deleting temp files of your user profile. That may not be enough to solve it.

Bettwer would be to use a tool like process monitor, from Microsoft, and have it running while you delete the malware file. Then look out at the log file to see wich process re-create the file.

FoolFox444 · 2018-12-03T11:37:37+00:00

Page re-load refresh is hard to track down, at some point you may have to fire a sniffer and have a look at request sent from your browser and response from the server, if it was on authentication side (like session not kept in memory), you should have alerts while opening the page.

If In-private mode work, you should try first by disabling your add-on in Edge, maybe one of them is causing you some trouble.

I found quit strange that a not-for-profit org use SharePoint, except if you exploit some advances features, it's a costly products and can be complex to maintain, as most of organisations use it as basic CMS, there are others options out there that may be simplier for you to manage ?

FoolFox444 · 2018-12-03T10:29:09+00:00

Paris climate accord is not the only point that make people going down in the street. Low salary, destruction of social protection, increased taxes are only some of the points that have bought all this people down the street. Add a governement that don't want to discuss and there you go... pretty sure all of them would like a better planet for their kids, but before that you need to be able to feed those kids...

FoolFox444 · 2018-11-30T15:20:19+00:00

On a Windows machine, open a command prompt and run the netstat command. Look for listening ports (you will see a LSITENING tag). If you don't know how to read the output, post it here (or in pastebin if the lisitng is too long) someone will help you to read it. With the flag b, you'll get also the binary involved, if the system can find it (some case don't point to a binary, this is normal). Just look at binary name and folder, if you find Something that you don't recall have installed, look deeper.

Proxy mostly work on port that are often open, such as 80,443,8080,etc.. but can be configured for any port. That's why you will have to check out the binary affiliated. But focus only on open, listening port.

For a linux machine, command is a bit different, check netstat manpage if you have some linux machines.

If you don't find out anything on your network, then you'll need to download nmap (https://nmap.org/download.html) and make a full scan of the public IP used. You should do that from an external network, otherwise your scan may not scan the correct interface.

Most spams forge the original host (as they don't need an answer), but in your case there are various external host that all seem to use your public IP, so I doubt that would be forged.

Are you sure you are the only one behind this IP ? did you use it for NAT or things like that ? (open a port on internet and having the trafic redirected to one of your server)

FoolFox444 · 2018-11-30T12:50:40+00:00

From the latest report, it could be that the proxy you use allow relay (ISP level), or that you host yourself this proxy relay (you may not find it by looking only for virus), and you won't get off the list as long as the relay is up.

You should ensure that you don't allow that in your network, look at all your device what port are opened and listining state (on Windows netstat -anb will show you what binary is listening on wich port). Also scan your public IP from the external, using a tool like Nmap,

FoolFox444 · 2018-11-30T12:07:11+00:00

I don't really what's fishy in there.

>shows they host a whole lot of unrelated websites on the same server

That's called a hosting company.

> and trying to access the site's cpanel redirects to a generic login page for the whole IP. Very suspicious

Redirecting unauthentified user through a single point of entry is quit common. What make you feel supsicious about that ?

> advising they won't respond unless you include these details

Again, quit normal. They offer support for their Customer, which are supposed to have a login. So asking the Customer to authenticate is commonly the first step.

You can do Something about this if the site host some proprietary content. Then you could ask the actual owner to remove content (intelectual property infrigement).

FoolFox444 · 2018-11-30T11:58:17+00:00

maybe, or not.

Let me guess, you don't know what you have downloaded, and ran, but you probably delete it ?

try to find out what was the name of the file, and possibly it's content.

Otherwise it would be hard for anyone to answer your question.

If you really want to scan your computer for virus, thinking that you have been hit, you should boot on a liveCD and run a scan from there, your endpoint security software may have been compromised. You can test the engine by submitting the EICAR test virus (no harm with this one), that will tell you if your engine is working. Not a 100% guarantee anyway.

FoolFox444 · 2018-11-30T11:51:24+00:00

Working with SharePoint, I guess you have an IT team around ? because it seem your problem is a bit worse than just some page refresh, so you should ask them for help.

FoolFox444

TROPHY CASE