Re: Security Problem...

From: Greg (greg_68@hotmail.com)
Date: 02/12/03 

From: "Greg" <greg_68@hotmail.com>
Date: Wed, 12 Feb 2003 14:53:04 -0700

I'm running Norton AntiVirus and Norton Personal Firewall. Norton AV was
installed right after a clean install of Windows (brand new hard drive) and
I was originally using the firewall built into XP until the problem with
DirectX 9 and Windows Messenger, so I switched to Norton Personal Firewall.
So, there's always been a firewall and AV running.

"Alun Jones" <alun@texis.com> wrote in message
news:DCx2a.126$F64.44063948@newssvr12.news.prodigy.com...
> In article <eNw1Wgs0CHA.2452@TK2MSFTNGP11>, "Greg" <greg_68@hotmail.com>
> wrote:
> >How can I check? The PID just says svchost.exe. I'm already running
Norton
> >AntiVirus (with a subscription)... wouldn't that have prevented it? I'll
do
> >a full system scan with it and see if it finds anything, unless you have
a
> >better idea?
>
> If there's anyone in these newsgroups less worth listening to than
"Tracker",
> I doubt that I can find it within myself to believe how ill-informed they
are
> likely to be.
>
> Port 1025 is simply one of the first of the ephemeral port range. As
such,
> the first or second program that tries to create and connect a socket
without
> binding it first will find it bound to port 1025.
>
> Here are some of the services that are included in svchost:
>
> 6to4 - supports IPv6 connectivity over IPv4 networks.
> Alerter - Notifies of administrative alerts.
> AppMgmt - software installation services.
> AudioSrv - manages audio devices.
> BITS - Background file transfer.
> Browser - allows you to browse the network.
> etc, etc.
>
> To find out what's started by svchost, you could do a search through the
> registry using "regedit", searching for "svchost".
>
> If you want to find out if there's a Trojan at that port, then find out if
> there's a Trojan on your system - this can be done by running an antivirus
> scanner (you do have antivirus software, don't you?), since they detect
such
> things as well. Your firewall (you do have a firewall, don't you?) should
> already be blocking incoming traffic to ports that aren't supposed to
receive
> incoming traffic.
>
> Alun.
> ~~~~
>
> [Please don't email posters, if a Usenet response is appropriate.]
> --
> Texas Imperial Software | Try WFTPD, the Windows FTP Server. Find us at
> 1602 Harvest Moon Place | http://www.wftpd.com or email alun@texis.com
> Cedar Park TX 78613-1419 | VISA/MC accepted. NT-based sites, be sure to
> Fax/Voice +1(512)258-9858 | read details of WFTPD Pro for XP/2000/NT.

Relevant Pages

  • Re: How to Maintain an IIS Server?
    ... > server running on a Windows 2000 server. ... before a firewall and antivirus have been installed]. ... open ports; however, this will not identify which program is using the port. ...
    (microsoft.public.inetserver.iis.security)
  • Re: keeping ports open
    ... If a port is open, it means that 1) a software or service is running on your ... and 2) you're not using a firewall or your firewall isn't ... Use firewall software and hardware and antivirus software that is ... Follow the instructions for hardening Windows and IIS at ...
    (microsoft.public.security)
  • Re: How to Maintain an IIS Server?
    ... >> server running on a Windows 2000 server. ... > before a firewall and antivirus have been installed]. ... > program or executable using that port. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Is secedit.exe left by a hacker?
    ... >> tested on port 445. ... >> I have a Linksys router that I use as a firewall to my ... >investigate the files on your computer - antivirus with ... >windows and everything else. ...
    (microsoft.public.win2000.security)
  • Re: Is secedit.exe left by a hacker?
    ... > tested on port 445. ... > I have a Linksys router that I use as a firewall to my ... Secedit.exe is the name of a legitimate Windows file, ... investigate the files on your computer - antivirus with the latest updates ...
    (microsoft.public.win2000.security)
Loading