Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Need problem infection removed.

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Unread postby Vino Rosso » November 20th, 2006, 4:10 am

Hi Dougal

Dougal wrote:but I just thought I should run through with you about what the logs in Zonealarm were like.
I suspect most, if not all, of these would be incoming alerts therefore demonstrating the need to run a firewall.

Dougal wrote:The logs also had what looked like internet web addresses but when I put them in the address bar they went nowhere. Some looked a bit suspect but I can't remember any of the addresses now. Here are a couple I wrote down but they aren't as suspect as some of the others.
Not something I would recommend without very good protection running on your computer!

Dougal wrote:Should I reinstall ZA and get some better log details?
On no account should you run two firewalls at the same time on the same computer. Doing this would cause conflicts likely to result in reduced protection and resource problems. If you prefer Zone Alarm over Norton then you must remove Norton before installing Zone Alarm. However I recommend that you leave things as they are and update to SP2 before considering changing firewalls.

Please go ahead with updating to SP2.

Vino
User avatar
Vino Rosso
Admin/Teacher Emeritus
 
Posts: 9024
Joined: April 24th, 2006, 8:36 am
Location: Gloria Jean's in Murray St. Mall (I wish!)
Advertisement
Register to Remove

Unread postby Dougal » November 20th, 2006, 9:28 pm

Just one more thing I forgot to mention.

I emailed the only 2 entries I had in NAV's logs earlier this year to my ISP's technical support division. Here is their reply:


I have received notification that you have firewall
logs showing incoming traffic to your computer on known trojan horse ports.

From examining the IP addresses supplied (202.124.114.131 on 1 May
2006, and 202.124.110.150 on 6 November 2005) I have determined these to
point to your account on both occasions. As such, it appears
your computer is attacking itself using the external dial-up interface,
using the IP address we're giving your computer when it dials up. It
looks as though this happens almost immediately after you dial up,
judging by your firewall records and our dial-in records.

I recommend that you scan your machine for viruses, using an up-to-date
virus scanner; additionally, scanning your machine for spyware/malware
using a scanner such as Spybot Search & Destroy, and as a last resort,
dropping your computer to a computer repair centre for inspection.


I know this probably doesn't change the situation but I thought I better let you know anyway.

Will continue on with the SP2 install. Will reply back on either Thursday/Friday night depending how well I go.

Thanks for your time and patience.
Dougal
Dougal
Regular Member
 
Posts: 27
Joined: November 6th, 2006, 7:26 am

Unread postby Vino Rosso » November 21st, 2006, 2:39 am

Dougal wrote:I have received notification that you have firewall
logs showing incoming traffic to your computer on known trojan horse ports.

Hi Dougal

If you still have the firewall logs, they will show the traffic direction.
User avatar
Vino Rosso
Admin/Teacher Emeritus
 
Posts: 9024
Joined: April 24th, 2006, 8:36 am
Location: Gloria Jean's in Murray St. Mall (I wish!)

Unread postby Dougal » November 21st, 2006, 4:47 am

Hi Vino,

They were inbound. Are you saying that I do not have to worry about my computer being infected unless the traffic is outward bound? Sorry if that is a dumb question.

Here are the logs.

1/5/2006 - 5:47:26pm
Rule "Default Block DeepThroat Trojan horse" blocked (202.124.114.131,3150).
Inbound UDP packet.
Local address,service is (localhost,3150).
Remote address,service is (202.124.114.131,3150).
Process name is "N/A".

6/11/2005 - 6:00:37pm
Rule "Default Block Master Paradise Trojan horse" blocked (202.124.110.150,3129).
Inbound UDP packet.
Local address,service is (localhost,3129).
Remote address,service is (202.124.110.150,3129).
Process name is "N/A".

Thanks
Dougal.
Dougal
Regular Member
 
Posts: 27
Joined: November 6th, 2006, 7:26 am

Unread postby Vino Rosso » November 21st, 2006, 5:34 pm

Hi Dougal

Basically, 'incoming' means just that! Your firewall is doing what it should by blocking unsolicited incoming packets.
I suggest it's highly unlikely that malware would want to go out through the firewall and back in again to attack your PC. Unless there is a corresponding outgoing entry in the firewall log, I doubt there is a problem and would suggest the warnings may be 'false positives'.

Searching on Google for the two warnings you've shown brings up some interesting stories such as >here< and >here< where false positives are suspected.
User avatar
Vino Rosso
Admin/Teacher Emeritus
 
Posts: 9024
Joined: April 24th, 2006, 8:36 am
Location: Gloria Jean's in Murray St. Mall (I wish!)

Unread postby Dougal » November 21st, 2006, 9:05 pm

Hi Vino,

Thanks for the reply and the links. Would appreciate having security software that didn't worry you unnecessarily. I have only ever owned NAV so have never been able to monitor outgoing traffic (maybe something to think about changing). When I did have ZA firewall installed though I don't remember any blocks on suspicious outgoing traffic. Therefore the computer is clean I guess. :)

Will get back on Friday when everything is finished.

Thanks once again.
Dougal.
Dougal
Regular Member
 
Posts: 27
Joined: November 6th, 2006, 7:26 am

Unread postby Dougal » November 23rd, 2006, 11:28 pm

Hi Vino,

Am having trouble getting the computer in good working order before installing SP2. When I did the system recovery 6 months ago it seems to have mucked up the uninstall programs for some of software that I have. The problem is trying to figure out how to remove the software properly without these. Adobe Reader is one piece of software I am struggling with.

Will get back to you next Friday. Hopefully all will be finished.

Dougal.
Dougal
Regular Member
 
Posts: 27
Joined: November 6th, 2006, 7:26 am

Unread postby Vino Rosso » November 25th, 2006, 5:20 am

Hi Dougal

If you are having non-malware related issues with your computer, for example uninstalling Adobe Reader as you mention, I can recommend you visit and ask for assistance at a forum that specialises in these types of problems. Try >PCPitStop< or >Computer Trouble<. Should you have any malware related issues, please come back and see us... we would be very happy to help.

I'd be grateful if you could reply to this post so that we know it can be archived. Should you find that you are having malware problems, you will be able to re-open this thread at a later date.

Thanks and good luck
Vino
User avatar
Vino Rosso
Admin/Teacher Emeritus
 
Posts: 9024
Joined: April 24th, 2006, 8:36 am
Location: Gloria Jean's in Murray St. Mall (I wish!)

Unread postby Dougal » November 28th, 2006, 3:33 am

Hi Vino,

Sorry about the late reply.

Yes, I might go and check out one of those two forums. I was considering paying somebody to fix the computer but the cost involved is probably not worth it.

Anyway, I would like to thank you for all the effort you have put in, in trying to figure out what was wrong with the computer. It's been great having a place like this to come and ask for help. Hopefully once the software problems are sorted out that will be the end of it.

Thanks once again and good luck for the future.
Dougal.
Dougal
Regular Member
 
Posts: 27
Joined: November 6th, 2006, 7:26 am

Unread postby NonSuch » December 8th, 2006, 3:05 am

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 27230
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 31 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware