Search
Forum Home | Login
Ande
Ande
Join Date 02/2002
0

Trojan

May 17, 2004 10:38:35 PM from WinCustomize ForumsWinCustomize Forums
This is new for me. For the last couple of days my firewall is continually blocking "sockets de Trios v1 trojan horse" This is occuring every couple of minutes. Can anybody tell me what is going on
Locked Post
Search this post
Advanced Search
Subscription Options
Reason for Karma (Optional)
Successfully updated karma reason!
2 Pages1 2 
Ande
eieio
Join Date 03/2003
+52
Reply #1 May 17, 2004 10:41:19 PM
from WinCustomize ForumsWinCustomize Forums
Trying to come in? or trying to go out?
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #2 May 17, 2004 10:43:53 PM
from WinCustomize ForumsWinCustomize Forums
My guess is it's trying to access port 5000. Disable Windows Plug and Play. Use this: http://grc.com/unpnp/unpnp.htm
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #3 May 17, 2004 11:24:31 PM
from WinCustomize ForumsWinCustomize Forums
Had to go away sorry. Did that Gary, will wait and see.
Don't know Stephen, how do you tell. And that little statement will alert you how savvy I am. My knowledge is improving, I spend a little time trolling around after Yrag and Iplural taking notes
Reason for Karma (Optional)
Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

Ande
Ande
Join Date 02/2002
0
Reply #4 May 17, 2004 11:40:06 PM
from WinCustomize ForumsWinCustomize Forums
Started again. The Security Alert says" Attempt to connect to local computer using the Sokets de Trois v1.Trojan Horse blocked, Threat level High Risk. At 1.28Pm on the 18/05/2004 the following communication was detected: Protocol: TCP (inbound)(there you go Stephen)
Remote Address: 202.138.41.172.4325 (this address changers each time it tries to access)
I don't know any Spanish, but what bloody bullfighter is trying to access my puter. >
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #5 May 17, 2004 11:40:43 PM
from WinCustomize ForumsWinCustomize Forums
Started again. The Security Alert says" Attempt to connect to local computer using the Sokets de Trois v1.Trojan Horse blocked, Threat level High Risk. At 1.28Pm on the 18/05/2004 the following communication was detected: Protocol: TCP (inbound)(there you go Stephen)
Remote Address: 202.138.41.172.4325 (this address changers each time it tries to access)
I don't know any Spanish, but what bloody bullfighter is trying to access my puter. >
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
sig101
Join Date 04/2002
0
Reply #6 May 17, 2004 11:43:30 PM
from WinCustomize ForumsWinCustomize Forums
Are you using Norton's firewall? It tends to ID portscans by the trojan known to use the port being scanned. Not too helpful really and sometimes scares newbies into thinking their firewall actually detected a trojan. As long as your firewall is doing its job (and presumably it is since it's giving you alerts) and blocks unsolicited communications from the net, I wouldn't concern myself with it. Too many port scans out there to worry about firewall alerts and logs unless you're a researcher looking for signs of new network infections that might be on the loose.

I'd ditto Yrag's recommendation to disable the Universal Plug & Play service.

Here's some info for home PC security from CERT, just in case you're interested. http://www.cert.org/homeusers/HomeComputerSecurity/
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #7 May 17, 2004 11:43:38 PM
from WinCustomize ForumsWinCustomize Forums
Opps and there is another first. Double post
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #8 May 17, 2004 11:45:33 PM
from WinCustomize ForumsWinCustomize Forums
Norton is known to pop an alert for this. It is blocking it (all the others do, they just don't tell you) and that's all you care about. There should be an option in Norton to not show this alert. Find it and then don't worry about it. If you want to worry about something, then worry about the other 500 or so scans your machine rejects daily with no alert...
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #9 May 17, 2004 11:48:34 PM
from WinCustomize ForumsWinCustomize Forums
...Deb types a lot faster then me....

....anyway...what she said....
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
sig101
Join Date 04/2002
0
Reply #10 May 17, 2004 11:49:40 PM
from WinCustomize ForumsWinCustomize Forums
By the way, perhaps the vast majority of port scans seen on he internet today are either automated scans or the result of infected PCs scanning through the internet looking for vulnerable machines to infect. That is, the idea that there is an actual hacker directing each portscan trying to specifically target you is probably almost never the case.

As long as you have a firewall that is blocking such scans people are usually advised not to be concerned. Some people go further and tell people to turn off the alerts since it doesn''t really do much good. If you maintain your firewall logs you might want to consider participating in a reporting service like mynetwatchman.com or dshield.org. Some related info in the BBR security forum FAQ: http://www.dslreports.com/faq/8226
[Message Edited]
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
sig101
Join Date 04/2002
0
Reply #11 May 17, 2004 11:50:46 PM
from WinCustomize ForumsWinCustomize Forums
Great minds, Gary....
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #12 May 17, 2004 11:56:22 PM
from WinCustomize ForumsWinCustomize Forums
...yup

Ande, if you want go here https://grc.com/x/ne.dll?bh0bkyd2 and scan your ports. It will tell you whats open...if anything and what to do to close it...

...That should keep him busy a while
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
IPlural
Join Date 11/2001
+9
Reply #13 May 17, 2004 11:56:53 PM
from WinCustomize ForumsWinCustomize Forums
Ande, you on broadband\internet?
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #14 May 17, 2004 11:57:37 PM
from WinCustomize ForumsWinCustomize Forums
Gary I have had Norton Firewall(updated) for quite some time. And it does show these types of Alerts from time to time but not this continual pinging. However I have unticked the box for "enable access control alerts". Is that right? And if it is can I go out and play now.
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #15 May 17, 2004 11:59:07 PM
from WinCustomize ForumsWinCustomize Forums
No IP, dial UP ???
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #16 May 17, 2004 11:59:24 PM
from WinCustomize ForumsWinCustomize Forums
Yup......go play
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #17 May 18, 2004 12:27:29 AM
from WinCustomize ForumsWinCustomize Forums
Yrag, done that test, pleased to say I am in full Stealth mode. Can you read this?
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #18 May 18, 2004 12:30:35 AM
from WinCustomize ForumsWinCustomize Forums
Can you read this?


..Nope.
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Jafo
Join Date 03/2001
+1845 sdemployee
Reply #19 May 18, 2004 12:47:06 AM
from WinCustomize ForumsWinCustomize Forums
218985 intrusions blocked since install....5612 high rated.....someone out there really 'wants' me....
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
kona0197
Join Date 02/2003
+86
Reply #20 May 18, 2004 2:24:54 AM
from WinCustomize ForumsWinCustomize Forums
I feel sad. no one has tried to invade my PC. (Knock on wood) I used to use Sygate but It don't like Comcast HSI. So what other freeware firewalls of good reputabe ststus can I use?
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #21 May 18, 2004 2:34:45 AM
from WinCustomize ForumsWinCustomize Forums
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=zadb_zadown
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
eieio
Join Date 03/2003
+52
Reply #22 May 18, 2004 7:22:20 AM
from WinCustomize ForumsWinCustomize Forums
This is also a good one
http://www.kerio.com/kpf_download.html
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
Ande
Join Date 02/2002
0
Reply #23 May 19, 2004 1:37:25 AM
from WinCustomize ForumsWinCustomize Forums
Back again. Yrag or anyone with knowledge. I have had Norton Firewall for some years now, with the "enable alert" option on. Nothing has ever got through and still hasn't. From time to time it very politely advised me when an intrusion attempt happened. I am aware of and have been advised that trojan invasion is a common occurrence. But even with the "Alert Options" disabled an "exclamation mark" is flashing on the Norton Firewall icon in the system tray and its very annoying. Ok you might say remove the subject icon. But I like to know that the Firewall is enabled when I boot up. The minute I log onto the internet this paticular Trojan (Described in post 5) does not let up for a moment, it is constant.

If this is the norm OK. Life goes on. But I am having trouble comprehending this. To me this incessant blocking of the same type of Trojan is not normal. My Firewall has never acted the way before. Ok pl someone, please put my mind at rest. >
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #24 May 19, 2004 1:46:41 AM
from WinCustomize ForumsWinCustomize Forums
For Norton, it is normal....


There should be an option in Norton somewhere to 'not' show alerts thru the tray icon and just show the normal icon.
Reason for Karma (Optional)
Successfully updated karma reason!
Ande
yrag
Join Date 08/2001
+393
Reply #25 May 19, 2004 1:51:10 AM
from WinCustomize ForumsWinCustomize Forums
I do have two questions...when you scanned your ports over at the grc site, did you scan the 'Service ports' and do you have 'Messenger Service' disabled?
Reason for Karma (Optional)
Successfully updated karma reason!
2 Pages1 2 
View all recent posts
Mark all posts as read Delete cookies created by the forum Return to Top
Stardock Forums v        Server Load Time:   Page Render Time: