Concern about FFchat security

[-N-]

Every once in a while on IRC I get a message from Norton saying it blocked a trojan intrusion attempt. I don't think it's from a particular room, and I'm usually too busy to follow up on the IP it spits out. Can anyone (clout, Roo) look into this?

[crono_logical]

If you're too busy to follow up on the information you're given by Norton or any information from your IRC client, we're too busy to help you

No-one else has reported such a problem

[Kakashi509]

hey N norton says everything is a trojan

[crono_logical]

Every once in a while on IRC I get a message from Norton saying it blocked a trojan intrusion attempt. I don't think it's from a particular room, and I'm usually too busy to follow up on the IP it spits out. Can anyone (clout, Roo) look into this?

Here's how I read it:

"My firewall says it blocked something while I was connected to IRC. Help."

Very useful how much you've told us, yes?

[-N-]

Hey, no need to get your panties in a twist. I just know that me and a few other people are seeing these things pop up, and Resha had her computer go down once from a trojan attack on FFchat. I don't need any help; I'm fine. Otherwise, this would be in the Help Forum, not Feedback. I want to point out what might be a problem.

[Meat Puppet]

Yeah, those bastards hacked me and stole all my porn.

[crono_logical]

All you're pointing out is your computer is moaning about something, but you won't say exactly what From the given information, the problem is either your computer and/or it's configuration, or your incapability to comprehend what it's telling you

[-N-]

Security rule	Default Block NetBus Trojan horse
Date	7/26/2005
Time	10:27 PM
Path	N/A
Direction	Inbound
Local address	128.12.72.62
Local port	NetBus(12345)
Remote address	218.239.210.177
Remote port	1442
Protocol	TCP

I don't recognize the IP - but I'm guessing it's using IRC to attempt an attack on my computer.

[XxSephirothxX]

I'm pretty sure I had the same problem happen last month.

[Endless]

It means they are trying to connect to netbus, whose default port is 12345. Netbus is an old trojan, that as far as I know doesn't self propagate, but rather is injected in normal executables or disguised as one. Any AV should pick netbus, so unless you don't have one, there's nothing to worry about.

Also, I'd like to know where you got the idea it comes from FFChat.

[crono_logical]

*sends a few probes to that port from a machine not on FFChat to force that alert to come up again*

[Shoeberto]

It means they are trying to connect to netbus, whose default port is 12345. Netbus is an old trojan, that as far as I know doesn't self propagate, but rather is injected in normal executables or disguised as one. Any AV should pick netbus, so unless you don't have one, there's nothing to worry about.

Also, I'd like to know where you got the idea it comes from FFChat.

If it's Netbus then it's probably a few script kiddies that have no idea what they're doing.

[Denmark]

you should be glad that the trojan intrusion was blocked.

unless you swing that way, of course. then do what you'd like.

[Old Manus]

THE MATRIX HAS YOU

[Kakashi509]

That's real special manus