Its been really bugging me that whenever I scan my connection with wireshark I see this one person sending me a SYN packet every minute on port 445. I know this is the dangerous port that the Conficker worm travels along. So far my computer seems to be immune and I know, at least on the Linux side that I can just add a rule to my ip tables to block that port indefinitely. I want to know what the next step is.

00 0c 41 b2 e4 1d 00 11 09 b2 2f 0e 08 00 45 00
00 30 91 84 40 00 80 06 d1 c7 46 4f 86 29 XX XX
XX XX 10 43 01 bd 9e 23 d6 27 00 00 00 00 70 02
ff ff 65 58 00 00 02 04 05 b4 01 01 04 02

This is one of the packet captures I am getting. After sending me this and getting no reply, all of a sudden he goes up an ip. Basically this would be the pseudocode for what it looks like hes doing on my end.

while(1){
for(int i = 1; i != 255; i++){
send_connection_attempt("XX.XX.XX." + i);
}
}

To me this looks like this guy has hijacked a computer and is using it to run a script over. He is still scanning my network as I said earlier, what should I do? Should I contact my ISP? or just nail down the hatches and make sure nothing is exposed on my network?

Port 445 is used by Microsoft file sharing. This is likely a virus or worm
that the other guy isn't aware of. Best thing is to keep your firewall
running and double-check your security settings.

It's a good idea to notify your ISP, although they might not be able to
do much. Ask them if they want to know when there are problems like this.

You must be able to see where the connections are coming from, so you can block that ip in iptables, either permanently or using a blacklist. Blocking the port is a bit drastic.

You could rate limit it instead http://www.debian-administration.org/articles/187

Also, you can use that incoming ip to find out who is responsible for that net block and send an email to their abuse department. You don't always get a response, but at least you've tried.

ip tables is fine for linux, but its windows I am worried about. I play games on that OS and my mother also does serious things on her computer too. I really need to build a firewall server one of these days.

But I am curious about how I would go about using their ip and contacting the abuse department you mentioned?