Re: An app is trying to get unauthorized access to the net.............a trojan??

From: Boll Weevil (dryer_at_maytag.com)
Date: 04/10/04 

Date: Fri, 09 Apr 2004 17:59:34 -0500

On Fri, 09 Apr 2004 17:21:03 GMT, Duane Arnold <notme@notme.com>
wrote:
>
>http://www.isi.edu/atomic2/pcbswap.html
>
>I think that whatever spyware or Trojan etc., etc. is on your machine has
>beaten Sygate to the punch at boot up and has sent its data and the close
>the port sequence has been interrupted by Sygate as it finally gets there
>on the TCP/IP connection.
>
>You can see my response and possible tools that can be used in finding the
>culprit at the *Svchost Exploit on Ports 80, 443 & 21* thread in this NG.
>
>You should place a short-cut to Active Ports in the Start-up folder with
>display resloution at *High*. It should give you a clear picture if Sygate
>is getting beaten to the punch.
>
>After you have gotten things cleaned up, you can use the Host as a
>prvention measure.
>
>http://www.mvps.org/winhelp2002/hosts.htm
>http://www.snapfiles.com/get/hoststoggle.html
>
>The blocking of ads and all that stuff is cool. But what the local HOST
>file is about is stopping the O/S's ability to come up with the IP to
>access www.milfseeker.com that the offending program is requesting. If
>www.milfseeker.com in the HOST file with 127.0.0.1, it cannot make contact
>with the site. If it is not in the HOST file, then the O/S is going to go
>to the ISP's DNS and get the correct IP and the program will be able to
>make contact.
>
>Duane :)

Duane,

Great info! Thanx a bunch. I have added the offending URL to my host
file with the 127.0.0.1 address. I wonder is there are any apps out
there that can tell you what app is opening witch port?

Relevant Pages