Hva betyr denne meldingen fra Norton Antivrus 2007

goggen · 8. mai 2007

Ser i loggen på Norton følgende melding under internet worm protection --> activities;

Unused port blocking has blocked communications.

Inbound TCP connection.

Remote address,local service is 222.59.249.231, 19820.

19820 er lytteporten til Bitcomet, og jeg har lagt merke til at tilkoblingene på Bitcomet detter ut en kort stund innimellom, etter at jeg installerte Norton. Har denne aktiviteten noen sammenheng med det?

sualc · 8. mai 2007

Ser i loggen på Norton følgende melding under internet worm protection --> activities;
Unused port blocking has blocked communications.

Inbound TCP connection.

Remote address,local service is 222.59.249.231, 19820.

19820 er lytteporten til Bitcomet, og jeg har lagt merke til at tilkoblingene på Bitcomet detter ut en kort stund innimellom, etter at jeg installerte Norton. Har denne aktiviteten noen sammenheng med det?

8569109[/snapback]

Jepp, -Norton stopper ett eller annet fra å opprette en TCP-forbindelse til porten 19820. Om det er Bitcomet som mister lovlig trafikk eller en faktisk orm er ikke lett og si, men IPen: 222.59.249.231 tilhører China Railway... (lover ikke egentlig godt

Hvis Bitcomet ikke fungerer som det skal kan du kanskje tillate trafikken og se om det hjelper? Høres ut som om du må fortelle NAV07 at porten 19820 (tcp) er i bruk. Nav burde uansett stoppe en evt orm fra å nå maskinen din.

Endret 8. mai 2007 av sualc

goggen · 9. mai 2007

Ser i loggen på Norton følgende melding under internet worm protection --> activities;
Unused port blocking has blocked communications.

Inbound TCP connection.

Remote address,local service is 222.59.249.231, 19820.

19820 er lytteporten til Bitcomet, og jeg har lagt merke til at tilkoblingene på Bitcomet detter ut en kort stund innimellom, etter at jeg installerte Norton. Har denne aktiviteten noen sammenheng med det?

8569109[/snapback]

Jepp, -Norton stopper ett eller annet fra å opprette en TCP-forbindelse til porten 19820. Om det er Bitcomet som mister lovlig trafikk eller en faktisk orm er ikke lett og si, men IPen: 222.59.249.231 tilhører China Railway... (lover ikke egentlig godt

Hvis Bitcomet ikke fungerer som det skal kan du kanskje tillate trafikken og se om det hjelper? Høres ut som om du må fortelle NAV07 at porten 19820 (tcp) er i bruk. Nav burde uansett stoppe en evt orm fra å nå maskinen din.

8570219[/snapback]

Hehe, China Railway ja..

Nå godkjente jeg jo trafikk for Bitcomet permanent første gang jeg startet det opp etter installajson av Norton og fikk en standard pop-up fra Norton med spørsmål om dette, så det skulle vel ikke være nødvendig å ytterligere måtte angi spesifiserte porter?

Uansett, har siden i går ikke hatt flere slike stopp i trafikken og meldinger fra Norton, så det kan jo ha vært en orm ja. Får sjekke loggen når jeg kommer hjem fra jobb i dag. Takk for svar.

Endret 9. mai 2007 av goggen

goggen · 9. mai 2007

Nå er jeg hjemme fra jobb, sjekker loggen og ser det har kommet flere meldinger. Nå har jeg ikke hatt Bitcomet oppe og gå, men meldingene gjelder fortsatt port 19820 som er porten jeg har satt for Bitcomet. Hva betyr dette da, at noen har fått snusen i porten og kjører angrep uavhengig av Bitcomet?

Nettet mitt lagger innimellom så noe er det. Hmmm..

goggen · 9. mai 2007

Nå er problemene så store at jeg poster logen fra HijackThis iht. guiden som er klebrig på denne siden. Så håper jeg noen kan se om det er noe "skummelt her;

Logfile of HijackThis v1.99.1

Scan saved at 21:45:56, on 09.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\SlimServer\SlimTray.exe

C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe

C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe

C:\Program Files\SlimServer\server\slim.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Symantec Shared\ccLgView.exe

C:\Documents and Settings\gg\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vg.no/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.online.no:8080

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {472b481f-4dab-491d-945c-a18b9b89310c} - C:\WINDOWS\system32\msdsec.dll

O2 - BHO: FINBHO - {5C472352-90D0-4214-BF20-8E4A2B82F980} - C:\Program Files\Telenor\Online Start\modules\BrowserHelper.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\tmp6.tmp.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [sBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - Startup: Telenor Sikker Lagring.lnk = C:\Program Files\Telenor Sikker Lagring\safestorage.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: SlimServer Tray Tool.lnk = C:\Program Files\SlimServer\SlimTray.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/lib/bilibrary/suppo...s/ebraryRdr.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130264120343

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1130267185828

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp09.photoprintit.de/microsite/18/...IPSUploader.cab

O16 - DPF: {E43DF60D-D6FA-42AB-921C-FE0A023C5BE1} (eWebEditProLibCtl.eWebEditPro) - http://adm.home.online.no/ewebeditpro2/ewebeditpro.cab

O18 - Protocol: fin - {5C472352-90D0-4214-BF20-8E4A2B82F980} - C:\Program Files\Telenor\Online Start\modules\BrowserHelper.dll (file missing)

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs:

O20 - Winlogon Notify: msdsec - C:\WINDOWS\SYSTEM32\msdsec.dll

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe

O23 - Service: SlimServerMySQL - Unknown owner - C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe

O23 - Service: SlimServer (slimsvc) - Unknown owner - C:\Program Files\SlimServer\server\slim.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

9. mai 2007

Last også ned SAS, installer, oppdater, kjør 'complete scan'.

Legg så ut en logg er. (Preferences->statistics/logs)

Endret 9. mai 2007 av medlem-105082

9. mai 2007

Når du har scannet ferdig med SAS, kjør Hijackthis på nytt og legg ut en ny logg her sammen med SAS loggen

goggen · 9. mai 2007

Her er SAS-log;

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 05/09/2007 at 11:19 PM

Application Version : 3.7.1018

Core Rules Database Version : 3234

Trace Rules Database Version: 1245

Scan type : Complete Scan

Total Scan Time : 00:25:27

Memory items scanned : 570

Memory threats detected : 0

Registry items scanned : 4487

Registry threats detected : 6

File items scanned : 35214

File threats detected : 72

Adware.Vundo Variant

HKLM\Software\Classes\CLSID\{D651AFF4-9590-424d-BD1E-8E33E090DFB3}

HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}

HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}\InprocServer32

HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}\InprocServer32#ThreadingModel

C:\WINDOWS\SYSTEM32\TMP6.TMP.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D651AFF4-9590-424d-BD1E-8E33E090DFB3}

HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}

C:\SYSTEM VOLUME INFORMATION\_RESTORE{3EC70CCC-A27C-426C-B4D8-D546AAB54975}\RP586\A0069786.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{3EC70CCC-A27C-426C-B4D8-D546AAB54975}\RP587\A0069790.DLL

+ en del Adware.Tracking Cookies

goggen · 9. mai 2007

Og her er ny scan med HijackThis;

Logfile of HijackThis v1.99.1

Scan saved at 23:28:39, on 09.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\SlimServer\SlimTray.exe

C:\Program Files\Telenor Sikker Lagring\safestorage.exe

C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe

C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe

C:\Program Files\SlimServer\server\slim.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\gg\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vg.no/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.online.no:8080

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {472b481f-4dab-491d-945c-a18b9b89310c} - C:\WINDOWS\system32\msdsec.dll (file missing)