subseven trojan=(

dud2k

Senior member
May 14, 2000
461
0
0
hey,
i think it is possible that i have this trojan, how can i fix this?
can i just re-install my OS system? or are other files infected?
 

cheapbastich

Banned
Jan 7, 2001
141
0
0
checked the page, and didnt see any of the signs in the .ini file,
but my norton firewall tells me it is blocking subseven trojan fairly
regularly.......... ??????

thanks
 

Fardringle

Diamond Member
Oct 23, 2000
9,200
765
126
Does the firewall say it is blocking the virus from going out, or from coming in? If it's trying to come in, does the firewall also list the IP address and/or DNS name (many do) of the offending site that is trying to give you a virus? If so, send the authorities after them, or at the very least send them a friendly email asking them to run a virus scan on their system before they try to hack into your system again... :D
 

SharkB8

Senior member
May 25, 2000
544
0
0
Fardringle- My firewall filters have turned away several attempts on port 27374, commonly used by Sub-7. My syslogd daemon program reports ip address, source and destination ports. I want to know how to "send the authorities after them". Exactly who do I notify and what do I tell them.
 

littleprince

Golden Member
Jan 4, 2001
1,339
1
81
well, if your firewall is blocking incoming... than you probaly don't have the virus... someone is just constanty trying to access your comp...
you don't have the ip address do u?
 

uCsDNerd

Senior member
Mar 3, 2001
338
0
0
My firewall is BlackIce Defender. Whenever somebody attacks my computer, it reports all information it can about the attacker to me. Additionally, it will give me the option to click on an 'advice' button. This then opens a website which will inform me about how to report this intruder to the proper people (i.e. thier system administrator). I don't know if your firewall supports this feature, but this one does.
As for that Sub7 thing. I say, if you really have a bad feeling about having a Sub7 Trojan, backup all your files and reformat your HDrive and reinstall your OS. Its always a good thing to do every now and then anyway. ALSO, be sure to scan your backup with a newly updated Virus Scanner before copying them back to your newly installed OS.
 

cheapbastich

Banned
Jan 7, 2001
141
0
0
24.30.154.136,2055 (port, I guess)

this is the ip hitting me today- how do I trace it, send a complaint?
thanks
- removed the trojan program, 'fake-ftp'
 

cheapbastich

Banned
Jan 7, 2001
141
0
0
thanks, since it originates from my own company, they should do something
(I hope)........ yes, blocked the IP.....

oh, thanks for the link to 'the cleaner', that's what found it, Norton
missed it completely.........
 

Vad3r

Senior member
Nov 25, 2000
274
0
0
I was under the impression, firewalls like BlackIce only reported attack, but could do nothing about it other than tell u ip and stuff. Does BlackIce alow you to "block" the attackers ip ?
If not BlackIce, is there one that does ?
I should start using/doing something, as I'm on dsl with Norton Antivirus disabled cause it slows down q3 :/
 

SaturnX

Diamond Member
Jul 16, 2000
3,415
0
76
Vad3r: BlackICE does in fact block incoming attacking attempts. It identifies the problem and closes the ports so they can't be accessed. When using something like BlackICE, your computer is non existent on the Internet, partially. Another good firewall is ZoneAlarm, and it's free.

--Mark