Have I been Assimilated?

[fredk]

I am running Norton Internet Security 2007 and have come across a bunch of stuff that just dosn't seem right.

It started about a week ago when I was running live update and could not update the firewall. I have tried numerous times and, until last night, everything but the firewall updated fine.

A couple of days ago I started looking at the firewall and found all sorts of rules that wern't there before. Could be because I set the firewall to handle known programs automatically (probably a bad idea).

However, one rule in program control gave full in and outbound permission to 'system'. As I understand it, any process supposedly initiated by the system can go out over the network or be interogated from the network.

I started looking into Norton logs last night and found that, over the last two weeks, something had been trying to access a series of norton programs, files and registry entries and was blocked. The log entries stop on 10/31.

Here is an entry from 10/23:

Event Details:
Actor: C:\WINDOWS\SYSTEM32\SVCHOST.EXE (PID=888)
Target: C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
Action: Unauthorized access
Reaction: Unauthorized access stopped


I checked the firewall log and found that something was updating my firewall rules every 2 to 10 minutes yesterday, and again several times today. Two rules have been created in the last two days.
Here is one of them:

Details: A rule has been created to "permit" communications.
Outbound UDP packet.
Local address, service is (99.236.76.157,netbios-dgm(138)).
Remote address, service is (99.236.77.255,netbios-dgm(138)).
Process name is "System".

There are also several entries allowing shared networking like inbound netbios. I have turned off the Norton firewall and turned on the xp firewall for now.

I also looked at browser activity and found a number of entries with sites I do not recognize like the following:

Details: Connection: a248.e.akamai.net: http(80).
from 99.236.76.157: 1551.
991 bytes sent.
26319 bytes received.
1:06.956 elapsed time.

I suppose some of the entries could be add content from legitamate sites, but the above entry sure dosn't look like anything recognizable.

There is another entry that appears many times that puzzles me. It shows both the local and remote ip addresses as 27.0.0.1

Otherwise, my computer and browser seem to be performing normally. Other than turning off the Norton Firewall, I am unplugging my network connection when not in use.

So, have I been assimilated? Am I an unwhitting bot?

Fred

 

[irishScott]

I don't have much experience with Norton, but from the reviews and numbers (detection rates and whatnot) I've read, it sucks (in terms of detection rates, speed, and bloatware).

Try
http://www.personalfirewall.comodo.com/
and
http://www.free-av.com/

Both are completely free and have higher ratings than anything Symantec. They are also faster and don't contain any bloatware. I've personally used them for years now.

As for your actual problem, it does sound suspicious. I believe that 27.0.0.1 is the standard "localhost" ip which to my limited knowledge simply specifies a connection to your computer. I'd suggest running the 2 tools above and see if anything pops up. Obviously, uninstall Norton Internet security before installing the above, as they could conflict.

Definitely sounds like some thing's trying to disable your security though.

 

[SilentRunning]

Originally posted by: fredk

I also looked at browser activity and found a number of entries with sites I do not recognize like the following:

Details: Connection: a248.e.akamai.net: http(80).
from 99.236.76.157: 1551.
991 bytes sent.
26319 bytes received.
1:06.956 elapsed time.

I suppose some of the entries could be add content from legitamate sites, but the above entry sure dosn't look like anything recognizable.


Fred

akamai.net provides content delivery for legitimate sites. AMD/ATI catalyst drivers are generally delivered through akamai.net

 

[fredk]

It has been a few days and I have been checking logs daily and noticed a few things.

The firewall rules seem to be updating twice daily and any time I switch users or reboot. I am now wondering if this is some sort of Norton administrative activity.

Something is still trying to attack my firewall though it is sporadic.

Today at 4:28pm :

Event Details:
Actor: C:\WINDOWS\SYSTEM32\SERVICES.EXE (PID=564)
Target: C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE
Action: Unauthorized access
Reaction: Unauthorized access stopped

A quick search tells me that this should be a legit version of services.exe. I am running as a restricted user (xp) so I would have thought that this service would only be accessable to the system. Does this mean something has installed itself with admin privilages and is attempting to turn off LuComServer using services.exe?

Checked all previous alerts and this is the only instance where services.exe was involved. The others woere ie and svchost (and havn't happened since 10/30, at which time norton detected and removed several viruses.)

Where do I go from here?

Fred

PS. fwiw, this system is end of life and dosn't contain anything sensitive (or useful for that matter). I am taking this as a learning opportunity.

 

[fredk]

Silent Running. Thanks for the info on akamai. Checking my network activity log for a couple of days, there does not seem to be any unusual activity.

irishScott. I have also seen reviews saying Norton is at the top of the class and much less bloated than before. Doesn't seem to cause much in the way of system slowdown for me and this is on a p3 with less than 512mb of ram.

At any rate, as I wrote in the previous post, this system is end of life. I will be building a new system in the next month running vista I will update my security then.

Fred

 

[gsellis]

Just a note - any point review on any A-V suite will yield at one time or another that they are behind the competition. A-V vendors leapfrog each other in how well they work. Just the nature of the competition.

//disclosure - been using Symantec CE versions for years. At times, top of the heap, at others, needs a little work to catch up.