router log, intrusion detected

[m_paird]

looking at a friend's router log, there is multiple instances of intrusion detection and a list of ip addresses. the router is a compUSA brand version b which he had left his pc in the dmz. big oops as he should have checked the router before reformatting and re-installing windows as he was sure there was some kind of malware that he had not found and removed. the router has been reconfigured and added zone alarm to his pc which seems to help with the inability to connect to the internet, yet it is still slower speeds than what his cable service provides.

my question is, what is the next course of action? the network is clean of malware but the internet speeds are still extremely slow at times. his router log and firewall are showing many attempts to access his network. when contacting his service provider they could not be of much help unless it is another of thier customers he was told. they did point to a site to whois the ip addresses which all go to isp's in china. is it worth the time and effort to contact the abuse depts of those isp? any input is greatly appreciated.

thanks in advance

[z1p]

You are always going to have hits on your firewall (thats why you need one). The question is how bad is it, how worked you want to get and what you want to do.

The # of hits on my firewall range from 200 to 3000 a day. I do see a network performance hit when it hits the 2000/3000 range, thankfully that is very rare.

As far as reporting the abuse, that is up to your friend and how much time he wants to spend on it.

I personnally have my router send it logs to my PC running kiwi syslogd and I run the dshield client which reports the firewall hits to dshield. I figure that way they at least have the stats and may possible deal with the main offenders.

I also get daily email reports back from dshield and it is these I look at to keep track of my firewall hits. I find it easier that logging into the router to moniter the firewall hits.