Trojan

Trying to come in? or trying to go out?

My guess is it's trying to access port 5000. Disable Windows Plug and Play. Use this: http://grc.com/unpnp/unpnp.htm

Had to go away sorry. Did that Gary, will wait and see.
Don't know Stephen, how do you tell. And that little statement will alert you how savvy I am. My knowledge is improving, I spend a little time trolling around after Yrag and Iplural taking notes

Started again. The Security Alert says" Attempt to connect to local computer using the Sokets de Trois v1.Trojan Horse blocked, Threat level High Risk. At 1.28Pm on the 18/05/2004 the following communication was detected: Protocol: TCP (inbound)(there you go Stephen)
Remote Address: 202.138.41.172.4325 (this address changers each time it tries to access)
I don't know any Spanish, but what bloody bullfighter is trying to access my puter. >

Started again. The Security Alert says" Attempt to connect to local computer using the Sokets de Trois v1.Trojan Horse blocked, Threat level High Risk. At 1.28Pm on the 18/05/2004 the following communication was detected: Protocol: TCP (inbound)(there you go Stephen)
Remote Address: 202.138.41.172.4325 (this address changers each time it tries to access)
I don't know any Spanish, but what bloody bullfighter is trying to access my puter. >

Are you using Norton's firewall? It tends to ID portscans by the trojan known to use the port being scanned. Not too helpful really and sometimes scares newbies into thinking their firewall actually detected a trojan. As long as your firewall is doing its job (and presumably it is since it's giving you alerts) and blocks unsolicited communications from the net, I wouldn't concern myself with it. Too many port scans out there to worry about firewall alerts and logs unless you're a researcher looking for signs of new network infections that might be on the loose.

I'd ditto Yrag's recommendation to disable the Universal Plug & Play service.

Here's some info for home PC security from CERT, just in case you're interested. http://www.cert.org/homeusers/HomeComputerSecurity/

Opps and there is another first. Double post

Norton is known to pop an alert for this. It is blocking it (all the others do, they just don't tell you) and that's all you care about. There should be an option in Norton to not show this alert. Find it and then don't worry about it. If you want to worry about something, then worry about the other 500 or so scans your machine rejects daily with no alert...

...Deb types a lot faster then me....

....anyway...what she said....

By the way, perhaps the vast majority of port scans seen on he internet today are either automated scans or the result of infected PCs scanning through the internet looking for vulnerable machines to infect. That is, the idea that there is an actual hacker directing each portscan trying to specifically target you is probably almost never the case.

As long as you have a firewall that is blocking such scans people are usually advised not to be concerned. Some people go further and tell people to turn off the alerts since it doesn''t really do much good. If you maintain your firewall logs you might want to consider participating in a reporting service like mynetwatchman.com or dshield.org. Some related info in the BBR security forum FAQ: http://www.dslreports.com/faq/8226
[Message Edited]

Great minds, Gary....

...yup

Ande, if you want go here https://grc.com/x/ne.dll?bh0bkyd2 and scan your ports. It will tell you whats open...if anything and what to do to close it...

...That should keep him busy a while

Ande, you on broadband\internet?

Gary I have had Norton Firewall(updated) for quite some time. And it does show these types of Alerts from time to time but not this continual pinging. However I have unticked the box for "enable access control alerts". Is that right? And if it is can I go out and play now.

No IP, dial UP ???

Yup......go play

Yrag, done that test, pleased to say I am in full Stealth mode. Can you read this?

Can you read this?

..Nope.

218985 intrusions blocked since install....5612 high rated.....someone out there really 'wants' me....

I feel sad. no one has tried to invade my PC. (Knock on wood) I used to use Sygate but It don't like Comcast HSI. So what other freeware firewalls of good reputabe ststus can I use?

http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=zadb_zadown

This is also a good one
http://www.kerio.com/kpf_download.html

Back again. Yrag or anyone with knowledge. I have had Norton Firewall for some years now, with the "enable alert" option on. Nothing has ever got through and still hasn't. From time to time it very politely advised me when an intrusion attempt happened. I am aware of and have been advised that trojan invasion is a common occurrence. But even with the "Alert Options" disabled an "exclamation mark" is flashing on the Norton Firewall icon in the system tray and its very annoying. Ok you might say remove the subject icon. But I like to know that the Firewall is enabled when I boot up. The minute I log onto the internet this paticular Trojan (Described in post 5) does not let up for a moment, it is constant.

If this is the norm OK. Life goes on. But I am having trouble comprehending this. To me this incessant blocking of the same type of Trojan is not normal. My Firewall has never acted the way before. Ok pl someone, please put my mind at rest. >

For Norton, it is normal....


There should be an option in Norton somewhere to 'not' show alerts thru the tray icon and just show the normal icon.

I do have two questions...when you scanned your ports over at the grc site, did you scan the 'Service ports' and do you have 'Messenger Service' disabled?