Norton Firewall

My brother runnning XP, and Norton Firewall 2003, got a message about 6 times today. It says that it has blocked a possible trojan horse, and then blocks the IP for the next half hour. It tracks the IP and it has been the same one everytime.

Is it someone trying to attack him everytime, or could something else cause the firewall to think something is trying to attack him?

Thanks

Does he have Kazaa??

That's my first guess, my second guess is that it's some trojan on his computer that's trying to connect to the outside world. Packets are being sent that you didn't request....either from a trojan from something like kazaa or just some random email trojan. Either way it's doubtful that someone is deliberately attacking him. Go offline for a day or two, if you come back and it's still happening you can bet it's a trojan and not some punk haX0r kid.

and does he have bear share? like kazaa it can be the cause. My Norton 2003 reports attacks whenever I use Bear share.

He does have kazaa, but he scans his computer frequently so I doubt he has picked up a trojan from somewhere else. Ill have him uninstall kazaa and see if the problem persists.

I have that problem quite a bit. Its usually is a port scan though, and tracing the ip just results in a runaround with numerous comps being used as slaves. and the ip usually isn't that of the person trying to gain access.

I don't have Kazaa, and I do spyware checks quite frequently, along with full system scans, and updating Norton software.