Concern about FFchat security

[-N-]

Every once in a while on IRC I get a message from Norton saying it blocked a trojan intrusion attempt. I don't think it's from a particular room, and I'm usually too busy to follow up on the IP it spits out. Can anyone (clout, Roo) look into this?

[crono_logical]

If you're too busy to follow up on the information you're given by Norton or any information from your IRC client, we're too busy to help you :monster:

No-one else has reported such a problem :p

[Kakashi509]

hey N norton says everything is a trojan

[crono_logical]

Every once in a while on IRC I get a message from Norton saying it blocked a trojan intrusion attempt. I don't think it's from a particular room, and I'm usually too busy to follow up on the IP it spits out. Can anyone (clout, Roo) look into this?Here's how I read it:

"My firewall says it blocked something while I was connected to IRC. Help."

Very useful how much you've told us, yes? :p

[-N-]

Hey, no need to get your panties in a twist. I just know that me and a few other people are seeing these things pop up, and Resha had her computer go down once from a trojan attack on FFchat. I don't need any help; I'm fine. Otherwise, this would be in the Help Forum, not Feedback. I want to point out what might be a problem.

[Meat Puppet]

Yeah, those bastards hacked me and stole all my porn. :mad2: :mad2: :mad2:

[crono_logical]

All you're pointing out is your computer is moaning about something, but you won't say exactly what :p From the given information, the problem is either your computer and/or it's configuration, or your incapability to comprehend what it's telling you :p

[-N-]

<table><tr><td>Security rule<td>Default Block NetBus Trojan horse</tr><tr><td>Date<td>7/26/2005</tr><tr><td>Time<td>10:27 PM</tr><tr><td>Path<td>N/A</tr><tr><td>Direction<td>Inbound</tr><tr><td>Local address<td>128.12.72.62</tr><tr><td>Local port<td>NetBus(12345)</tr><tr><td>Remote address<td>218.239.210.177</tr><tr><td>Remote port<td>1442</tr><tr><td>Protocol<td>TCP</tr></table>

I don't recognize the IP - but I'm guessing it's using IRC to attempt an attack on my computer.

[XxSephirothxX]

I'm pretty sure I had the same problem happen last month.

[Endless]

It means they are trying to connect to netbus, whose default port is 12345. Netbus is an old trojan, that as far as I know doesn't self propagate, but rather is injected in normal executables or disguised as one. Any AV should pick netbus, so unless you don't have one, there's nothing to worry about.

Also, I'd like to know where you got the idea it comes from FFChat.

[crono_logical]

*sends a few probes to that port from a machine not on FFChat to force that alert to come up again* :monster:

[Shoeberto]

It means they are trying to connect to netbus, whose default port is 12345. Netbus is an old trojan, that as far as I know doesn't self propagate, but rather is injected in normal executables or disguised as one. Any AV should pick netbus, so unless you don't have one, there's nothing to worry about.

Also, I'd like to know where you got the idea it comes from FFChat.
If it's Netbus then it's probably a few script kiddies that have no idea what they're doing.

[Denmark]

you should be glad that the trojan intrusion was blocked.

unless you swing that way, of course. then do what you'd like.

[Old Manus]

THE MATRIX HAS YOU

[Kakashi509]

That's real special manus

[Resha]

Yep...I got this spybot worm thingy- I'm not sure of the name coz I don't have it on this computer, but once I get onto my laptop I'll try and look it up! - and this worm dude gave off a Trojan to hide itself. It was trojancachecachet or something like that :confused: but like I said, I can't remember.

And when I looked up this worm on Norton's website, it said that it spreads through IRC and Kazaa; I don't use Kazaa so it means it must have come from FFChat. I don't download music and stuff, and I only go on FFChat....so? I'm pretty sure BoB knows something about it too.

[crono_logical]

Even if you got infected over FFChat, it says absolutely nothing about FFChat's own security - you're getting infected from someone connected to FFChat :p It's like saying your router or modem is insecure because the trojan happenned to pass through it on it's way to your PC :p

[Resha]

Well :D I don't know much about this stuff. But...let me just look at what symantec.com has to say about the worm again, and maybe I can be clearer about the problem! It was a W32.something, if my memory isn't totally blown.

[Doomie]

They say that if you sit on a public toilet in #eoff, you can get pregnant! :O

[crono_logical]

About 50 billion of the worms on there have names starting with W32 :monster:

[Resha]

I noticed! xD That's why I have no idea which one it. *will look it up...eventually*