Could/Does MalwareBytes stop this?

[joecatch]

While looking at my Verizon Fios router's firewall rules I found out that my son's computer had port forwarding set for some uTorrent program. There were a dozen or more ports forwarded. I deleted them as I don't want any torrent stuff running on my network. A few days later I checked and they were back again. I deleted them again but they came back.

I asked my son and he is not going into the router to allow port forwarding. SO my questions are how in the world is my Verizon FIOS router being modified w/o my approval and since Malwarebytes is running on my son's computer, I assume it doesn't catch this activitiy?

Joe C

[Firefox]

Hello and

Malwarebytes can not monitor changes to your FIOS router. What internal IP address are they being forward too, that will tell you what computer is trying to receive that traffic.

Also make sure you change the password to your router and do not share the password with your son, and then see if it changes again. After you make the changes make sure you save the settings, it is possible your removed the entries but forgot to save the changes.

[joecatch]

Hello and thank you for the quick reply. I know MWB can't monitor the router but my router, like everyone elses I bet, is at 192.168.1.1 so if a trojan or virsus tried to talk to that address, I thought MWB could at least flag it.

I did change the router's pw and no one but me knows it yet the ports are being set up in the router. And I did APPLY the changes and verified. That is what has me upset. How can the router be modifed without me or my son logging into it? My son doesn't know the pw and I don't think is smart enough to figure out how to hack into the router.

JC

[exile360]

It's possible that one of your nearby neighbors was able to hack into the router by using a password cracking program and is using your internet connection to download via uTorrent. If the router is capable, make certain that you use WPA2 encryption, not WEP, as WEP is far easier to crack. You might also consider setting up MAC Address Filtering (consult Verizon Support for details on how to do this with your router). MAC Address Filtering should keep all computers aside from those which you specifically allow off of your internet connection.

[joecatch]

I know the Torrent came from my son's computer. He has since removed it. But for my own piece of mind I need to find out how this is happening. I do use WPA/2 and I do use MAC filtering and a non-boradcast SSID.

JC

[shadowwar]

http://en.wikipedia....l_Plug_and_Play

NAT traversal

One solution for NAT traversal, called the Internet Gateway Device Protocol (IGD Protocol), is implemented via UPnP. Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings. By adding a port mapping, a UPnP controller behind the IGD can enable traversal of the IGD from an external address to an internal client.

That may explain whats going on. Basically upnp is automatically opening the ports on the router. You can shut this off on the router end (upnp) but might run into some troubles with other legit apps.

[joecatch]

Wow, excellent response and is exactly what I was looking for. I will invesitgate and report back. Thanks!

JC

[shadowwar]

Most torrent programs use upnp to set the router up automatically.

This post may pertain:

http://www.dslreports.com/forum/r26271887-Northeast-Turn-off-UPnP-

[joecatch]

Yes, today in the router under ADVANCE FEATRUES, under Universal Plug and Play, I found 2 check boxes. One was checked that said something about remote access and confugration. I unchecked and will wait to see what happens. I checked the PORT FORWARDING before I did this and again there was one entry from my son's computer even though he said he removed the uTorrent program. I deleted the port and now we'll see if what I did today fixes it.

JC

Most torrent programs use upnp to set the router up automatically.

This post may pertain:

http://www.dslreport...-Turn-off-UPnP-