Received notifications Scan.Generic.PortScan/TCP

[Bargenheimer]

Hello,

While browsing the internet last night, I received 12 notifications that Kaspersky Internet Security had blocked a network attack. Each entry in the log has a different port number. The attacking IP appears to be the same IP as my router. Under the results tab, it says “detected object is added to exclusions.”

 

I have seen other posts here where this sort of thing can be a false positive. Is it likely that is the case here, or could this have been an actual port scan attack?

[Berny]

@Bargenheimer Welcome. Can you please post a screenshot from some detections :
> KIS > More tools > Reports
 

[Bargenheimer]

 

I have blacked out the IP addresses because they all appear to be my router IP, plus a couple of zeros after one of the numbers. If you need this information, I will supply it to you. Thank you.

[Berny]

@Bargenheimer If the IP numbers are similar to e.g. 192.168.x.xx then these notifications are referring local network devices.

[Bargenheimer]

Those are indeed the first six numbers. I checked other devices in the house with the “ipconfig” line in command prompt, and a laptop on the network shows that same exact number (the entire “attacking IP address”) as its IPv4 address. Could this be indicative of malware on that laptop trying to spread across the network?

[Berny]

@Bargenheimer You shouldn’t worry about this issue, for a second opinion you can always contact Kaspersky Technical Support.

[Wesly.Zhang]

Hello,

This behavior has been fixed in MR3 build in the future. You can ignore this alarm.

Link

Regards.