Every once in a while on IRC I get a message from Norton saying it blocked a trojan intrusion attempt. I don't think it's from a particular room, and I'm usually too busy to follow up on the IP it spits out. Can anyone (clout, Roo) look into this?
Printable View
Every once in a while on IRC I get a message from Norton saying it blocked a trojan intrusion attempt. I don't think it's from a particular room, and I'm usually too busy to follow up on the IP it spits out. Can anyone (clout, Roo) look into this?
If you're too busy to follow up on the information you're given by Norton or any information from your IRC client, we're too busy to help you :monster:
No-one else has reported such a problem :p
hey N norton says everything is a trojan
Here's how I read it:Quote:
Originally Posted by -N-
"My firewall says it blocked something while I was connected to IRC. Help."
Very useful how much you've told us, yes? :p
Hey, no need to get your panties in a twist. I just know that me and a few other people are seeing these things pop up, and Resha had her computer go down once from a trojan attack on FFchat. I don't need any help; I'm fine. Otherwise, this would be in the Help Forum, not Feedback. I want to point out what might be a problem.
Yeah, those bastards hacked me and stole all my porn. :mad2: :mad2: :mad2:
All you're pointing out is your computer is moaning about something, but you won't say exactly what :p From the given information, the problem is either your computer and/or it's configuration, or your incapability to comprehend what it's telling you :p
Security rule Default Block NetBus Trojan horse Date 7/26/2005 Time 10:27 PM Path N/A Direction Inbound Local address 128.12.72.62 Local port NetBus(12345) Remote address 218.239.210.177 Remote port 1442 Protocol TCP
I don't recognize the IP - but I'm guessing it's using IRC to attempt an attack on my computer.
I'm pretty sure I had the same problem happen last month.
It means they are trying to connect to netbus, whose default port is 12345. Netbus is an old trojan, that as far as I know doesn't self propagate, but rather is injected in normal executables or disguised as one. Any AV should pick netbus, so unless you don't have one, there's nothing to worry about.
Also, I'd like to know where you got the idea it comes from FFChat.
*sends a few probes to that port from a machine not on FFChat to force that alert to come up again* :monster:
If it's Netbus then it's probably a few script kiddies that have no idea what they're doing.Quote:
Originally Posted by Endless
you should be glad that the trojan intrusion was blocked.
unless you swing that way, of course. then do what you'd like.
THE MATRIX HAS YOU
That's real special manus
Yep...I got this spybot worm thingy- I'm not sure of the name coz I don't have it on this computer, but once I get onto my laptop I'll try and look it up! - and this worm dude gave off a Trojan to hide itself. It was trojancachecachet or something like that :confused: but like I said, I can't remember.
And when I looked up this worm on Norton's website, it said that it spreads through IRC and Kazaa; I don't use Kazaa so it means it must have come from FFChat. I don't download music and stuff, and I only go on FFChat....so? I'm pretty sure BoB knows something about it too.
Even if you got infected over FFChat, it says absolutely nothing about FFChat's own security - you're getting infected from someone connected to FFChat :p It's like saying your router or modem is insecure because the trojan happenned to pass through it on it's way to your PC :p
Well :D I don't know much about this stuff. But...let me just look at what symantec.com has to say about the worm again, and maybe I can be clearer about the problem! It was a W32.something, if my memory isn't totally blown.
They say that if you sit on a public toilet in #eoff, you can get pregnant! :O
About 50 billion of the worms on there have names starting with W32 :monster:
I noticed! xD That's why I have no idea which one it. *will look it up...eventually*