subseven trojan=(

[dud2k]

hey,
i think it is possible that i have this trojan, how can i fix this?
can i just re-install my OS system? or are other files infected?

 

[ddiccico]

did you run an anti-virus program?

 

[dud2k]

yes

 

[ddiccico]

check out this page if you're worried.

 

[cheapbastich]

checked the page, and didnt see any of the signs in the .ini file,
but my norton firewall tells me it is blocking subseven trojan fairly
regularly.......... ??????

thanks

 

[Fardringle]

Does the firewall say it is blocking the virus from going out, or from coming in? If it's trying to come in, does the firewall also list the IP address and/or DNS name (many do) of the offending site that is trying to give you a virus? If so, send the authorities after them, or at the very least send them a friendly email asking them to run a virus scan on their system before they try to hack into your system again... 😀

 

[SharkB8]

Fardringle- My firewall filters have turned away several attempts on port 27374, commonly used by Sub-7. My syslogd daemon program reports ip address, source and destination ports. I want to know how to "send the authorities after them". Exactly who do I notify and what do I tell them.

 

[littleprince]

well, if your firewall is blocking incoming... than you probaly don't have the virus... someone is just constanty trying to access your comp...
you don't have the ip address do u?

 

[cheapbastich]

yes, it usually gives me an ip but what to do with it ?

 

[mitaiwan82]

try The Cleaner

 

[uCsDNerd]

My firewall is BlackIce Defender. Whenever somebody attacks my computer, it reports all information it can about the attacker to me. Additionally, it will give me the option to click on an 'advice' button. This then opens a website which will inform me about how to report this intruder to the proper people (i.e. thier system administrator). I don't know if your firewall supports this feature, but this one does.
As for that Sub7 thing. I say, if you really have a bad feeling about having a Sub7 Trojan, backup all your files and reformat your HDrive and reinstall your OS. Its always a good thing to do every now and then anyway. ALSO, be sure to scan your backup with a newly updated Virus Scanner before copying them back to your newly installed OS.

 

[cheapbastich]

24.30.154.136,2055 (port, I guess)

this is the ip hitting me today- how do I trace it, send a complaint?
thanks
- removed the trojan program, 'fake-ftp'

 

[WoundedWallet]

Go to Arin http://whois.arin.net/whois/ and find out where is the IP located.

Then contact the ISP and the pope, cause I don't know of any law enforcement organ that would truly do anything about it.

But make sure you keep the mofo blocked.

 

[cheapbastich]

thanks, since it originates from my own company, they should do something
(I hope)........ yes, blocked the IP.....

oh, thanks for the link to 'the cleaner', that's what found it, Norton
missed it completely.........

 

[WoundedWallet]

What/where/who is the cleaner?

 

[SharkB8]

The Cleaner

 

[Vad3r]

I was under the impression, firewalls like BlackIce only reported attack, but could do nothing about it other than tell u ip and stuff. Does BlackIce alow you to "block" the attackers ip ?
If not BlackIce, is there one that does ?
I should start using/doing something, as I'm on dsl with Norton Antivirus disabled cause it slows down q3 :/

 

[SaturnX]

Vad3r: BlackICE does in fact block incoming attacking attempts. It identifies the problem and closes the ports so they can't be accessed. When using something like BlackICE, your computer is non existent on the Internet, partially. Another good firewall is ZoneAlarm, and it's free.

--Mark