What am I infected with?

hmm..its still open.. have no idea what I can do about it..but so far I haven't "experienced" any problems with having the open port though...

thanks

Can you use the following and determine what program is listening or using that port? You should be able to determine that using this below.
http://www.diamondcs.com.au/openports/

Typing "netstat -ab" in the command prompt ought to give you the same result.

Can you determine what program is listening on that port?

hmm..."netbios-ssn" isnt the http port right?...what about "microsoft-ds"?

____________________________________________________________

C:\Documents and Settings\love_aoi>netstat -ab

Active Connections

Proto Local Address Foreign Address State PID
TCP aoifutaba:microsoft-ds aoifutaba:0 LISTENING 4
[System]

TCP aoifutaba:netbios-ssn aoifutaba:0 LISTENING 4
[System]

TCP aoifutaba:1151 baym-cs347.msgr.hotmail.com:1863 ESTABLISHED
156
[MsnMsgr.Exe]

UDP aoifutaba:1161 *:* 156
[MsnMsgr.Exe]

UDP aoifutaba:isakmp *:* 576
[lsass.exe]

UDP aoifutaba:4500 *:* 576
[lsass.exe]

UDP aoifutaba:1206 *:* 900
C:\WINDOWS\system32\mswsock.dll
c:\windows\system32\WS2_32.dll
c:\windows\system32\DNSAPI.dll
c:\windows\system32\dnsrslvr.dll
C:\WINDOWS\system32\RPCRT4.dll
[svchost.exe]

UDP aoifutaba:1065 *:* 900
C:\WINDOWS\system32\mswsock.dll
c:\windows\system32\WS2_32.dll
c:\windows\system32\DNSAPI.dll
c:\windows\system32\dnsrslvr.dll
C:\WINDOWS\system32\RPCRT4.dll
[svchost.exe]

UDP aoifutaba:1041 *:* 900
C:\WINDOWS\system32\mswsock.dll
c:\windows\system32\WS2_32.dll
c:\windows\system32\DNSAPI.dll
c:\windows\system32\dnsrslvr.dll
C:\WINDOWS\system32\RPCRT4.dll
[svchost.exe]

UDP aoifutaba:microsoft-ds *:* 4
[System]

UDP aoifutaba:ntp *:* 840
c:\windows\system32\WS2_32.dll
c:\windows\system32\w32time.dll
ntdll.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]

UDP aoifutaba:1153 *:* 156
[MsnMsgr.Exe]

UDP aoifutaba:1900 *:* 920
c:\windows\system32\WS2_32.dll
c:\windows\system32\ssdpsrv.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]

UDP aoifutaba:4065 *:* 824
[wmplayer.exe]

UDP aoifutaba:4605 *:* 2660
[iexplore.exe]

UDP aoifutaba:45654 *:* 156
[MsnMsgr.Exe]

UDP aoifutaba:ntp *:* 840
c:\windows\system32\WS2_32.dll
c:\windows\system32\w32time.dll
ntdll.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]

UDP aoifutaba:1900 *:* 920
c:\windows\system32\WS2_32.dll
c:\windows\system32\ssdpsrv.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]

UDP aoifutaba:netbios-ns *:* 4
[System]

UDP aoifutaba:discard *:* 156
[MsnMsgr.Exe]

UDP aoifutaba:netbios-dgm *:* 4
[System]

So it looks like those two ports are open.

I get the those first two also with the microsoft-ds and the netbios-ssn. I think you are fine.

Just curious--does http://hackerwatch.org/probe still say Port 80 is unsecured?

thanks but um..yes i guess...

_______________________________________________________

Secure
21 (FTP)

This port is completely invisible to the outside world.



Secure
23 (Telnet)

This port is completely invisible to the outside world.



Secure
25 (SMTP Mail Server Port)

This port is completely invisible to the outside world.



Secure
79 (Finger)

This port is completely invisible to the outside world.



Open and Unsecure!
80 (HTTP)

If this computer is not supposed to be acting as a web server you should not have this port open.



Secure
110 (POP3 Mail Server Port)

This port is completely invisible to the outside world.



Secure
139 (Net BIOS)

This port is completely invisible to the outside world.



Secure
143 (IMAP)

This port is completely invisible to the outside world.



Secure
443 (HTTPS)

This port is completely invisible to the outside world.

http://www.pcflank.com/scanner1.htm

I think you will need to start at this page but on the following page
http://www.pcflank.com/scanner_s1.htm
you can specify the port to check. Please verify that port 80 is open.

If your port 80 is open, you might want to double-check with your ISP. I saw where some say the Skype program may cause it to be open. If it is not your ISP, we need to determine what is causing it to be opened.

Please let me know what you find out.

hi, hmm...the site says they cannot identify my IP address. should I disable my firewall (zonealarm) and try the scan?

https://www.grc.com/x/ne.dll?bh0bkyd2

Also can you view the following topic? I do not know the answer but maybe your situation is similar.
http://www.malwareremoval.com/forum/viewtop ... 923b5ac6c1

thanks hmm..i think i'll check with my ISP.

Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.