port scanned, should I panic?

[ShawnD1]

I've just been port scanned by a computer within my network. I've had my network in place for more than a year and I've never been scanned by that computer. The computer scanned me on ports 2012, 2497, 2085, 3875 and 1262. Three minutes later, it scanned me on ports 1262, 139, 2497, 2012 and 1214. Notice that some of the ports were scanned twice....

The person who uses that computer is not computer literate at all, he visits porn sites all the time (adaware and spybot go crazy), and I think he may have uninstalled the firewall. I VNCed the computer and nobody was using the computer so I don't know what caused the scan.

What should I do? If that computer has a worm, it poses a serious threat to my entire network. All computers in my network have Norton installed and up to date. If the worm (assuming there is a worm) got passed Norton, I'll be totally screwed if this thing spreads.

Should I isolate that computer from the network or am I overreacting?

[Bill in SD, CA]

Sounds like something's on that computer that's not good and considering the porn sites I'm not surprised.

Might want to run The Cleaner and scan for trojans.

Free for 30 days.

Also there's Trend Micro Virus Scan and Adaware

Bill

[ShawnD1]

Thanks.
That stupid POS scanned me again. 2085, 2012, 3599, 139 and 3875.

Ok there is definitely something wrong. I tried to go to that trend micro link you gave me (on that computer through VNC) and IE is UNABLE to load any page other than searchpage.cc

[Bill in SD, CA]

Well, you know the browser's been hijacked.

Maybe you can install over the network HijackThis and CWShredder and see if you can get the browser back.

Also this may be of some help: IE hijack

Bill