Wondered if anyone has any info on these:

"Default Block Backdoor/Subseven Trojan" (inbound)

"Default Block TransSout" (inbound)   Havnt found any info on this 1 and
have no clue what it is!

"Default Block Hack 'A' Tack Trojan" (inbound)

I have had more attempts with different ones but havnt kept the logs!

Is it possible to find out wich country it comes from just with the
ipadress?
Is there a reason i should be worried?

The attempts come maybe every second day and usually from 20.00pm and later

these attacks are normal / normal to face with such these attacks on the net
!

if you know that you have protected you may not worry any more...

I would see 20 or so attempts within an hour and get upset.  Now I simply
ignore them and let my program do its job.

All the best, Dave

This is the reason I dislike the idea of 'personal firewalls' in
mainstream use (pstn at least. broadband needs it). People see these
scarey sounding alerts, panic, then waste both their time, and other
peoples, establishing that its nothing but a port scan, which is
completely harmless!

Inbound connection attempts are *nothing* to worry about. Ignore them
completely, dont even bother logging them. It doesnt mean you have a
virus, or are running a trojan service. It means some one is 'probing'
your computer, to see if you've got a trojan acting as a server,
waiting for them to log in and take control of various aspects of your
machine.
But as a)you dont have the trojan installed (AV will pick up all comon
trojans like sub7 etc), and b)the packets have been filtered (ie: the
log-in attempt blocked at the earliest stage), there is no problem,
nothing to worry about.

I hope that explained it slightly. The things you need to worry about
are terminology that sounds like 'connection established', as opposed
to 'connection attempt'. It you get the first, or some wording
variation, it means a handshake has occured, authentication is either
in process or has been established.
As I use a static IP at home, I run tiny personal firewall. It doesnt
log much, and I never ever check alerts. The only interaction I have
with it is if a local application tries communicating out, or an
external address tries communicating in, to a known service.
Everything else is blocked by my first default rule (block all in, all
out). This way, I dont need to do a dam thing, it just runs quietly in
the background. And thats as good as its gonna get (without a
router/firewall inbetween my box and the connection).

Jon