port 6346 connections????

I am in the process of trying to help a friend.
His computer is being attacted by connections through port 6346. We looked on google.com for some help on the problem but got none as there is nothing to do with gnutella with him.
Seems there are atotal of 5 different IP addresses that have now started NETBios port probes also.
Am looking for any hel that may be the cause of this. We are thinkin possible hackers that know of the port6346 scans and are using that so as when people see that they are thinking gnutella.
Any help or ides are much apreciated