Your Ad Here Your Ad Here
Results 1 to 10 of 10

Thread: Urgent Help Please...

  1. #1
    ok, please help me
    i have possible trojans

    this is the report from anti trojan:

    "Port 1047 open. Possible trojans. GateCrasher.b , GateCrasher.c
    Port 5000 open. Possible trojans. Sockets de Troie, Blazer 5"

    now, i'm pretty sure port 5000 is nothing, however, i'm unsure about port 1047

    when i do a netstat -a, i get this:

    Active Connections

    Proto Local Address Foreign Address State
    TCP a:epmap a:0 LISTENING
    TCP a:microsoft-ds a:0 LISTENING
    TCP a:1025 a:0 LISTENING
    TCP a:1026 a:0 LISTENING
    TCP a:1030 a:0 LISTENING
    TCP a:1032 a:0 LISTENING
    TCP a:1047 a:0 LISTENING
    TCP a:3280 a:0 LISTENING
    TCP a:5000 a:0 LISTENING
    TCP a:40019 a:0 LISTENING
    TCP a:1030 216.239.59.99:http ESTABLISHED
    TCP a:1032 216.239.59.99:http ESTABLISHED
    TCP a:1046 a:0 LISTENING
    TCP a:1046 localhost:1047 ESTABLISHED
    TCP a:1047 localhost:1046 ESTABLISHED
    UDP a:microsoft-ds *: *
    UDP a:isakmp *: *
    UDP a:1034 *: *
    UDP a:1054 *: *
    UDP a:ntp *: *
    UDP a:1900 *: *
    UDP a:ntp *: *
    UDP a:1900 *: *
    UDP a:2051 *: *

    can anyone help, please

    when i run anti trojan, no trojan files are found in registry or files...

    thanks in advance
    <span style='font-size:14pt;line-height:100%'>BLAH</span>

    <span style='font-size:14pt;line-height:100%'>Wayne Rooney - A thug and a thief</span>

  2. Software & Hardware   -   #2
    nostalgia's Avatar Frequent visitor
    Join Date
    May 2003
    Location
    Northern part of The Netherlands
    Age
    51
    Posts
    603
    Can it be that Anit-Trojan is warning you that an open port 1047 is vulnerable to Gatecrasher.b and .c instead of you&#39;re already infected with a trojan???


    edit: taken from Anti-Trojan site info about port 5000 http://www.anti-trojan.net/en/faq50006.aspx

    http://www.anti-trojan.net/en/trojportlist.aspx there is a list of known trojans and the ports they normally prefer to use. As you can see 1047 is the port Gatecrasher would use, so it doens&#39;t mean you have this Trojan but it means that this port is open and so Gatecrasher could (if you had it) use this port. I assume you ran Anti-Trojan and Gatecrasher wasn&#39;t found?
    -- They tell me tomorrow will never arrive, but I've seen it end a million times. --

  3. Software & Hardware   -   #3
    Poster
    Join Date
    Jun 2003
    Location
    Australia
    Posts
    376
    port 5000 used to be a trojan port..... by that being open im guessing you have xp... port 40019 <--- has me a bit worried cos it is so high...1047 could be anything like icq for instance
    you need to shut everthing down that is on the net web browser everything wait a few minutes then do a netstat....

  4. Software & Hardware   -   #4
    well, i&#39;ve just formatted there
    after the format, i only installed necessary drivers and nod32
    i updated nod32 and it then found 11 infected files (brought up svchost.exe and dllhost.exe)
    wtf is going on here?
    <span style='font-size:14pt;line-height:100%'>BLAH</span>

    <span style='font-size:14pt;line-height:100%'>Wayne Rooney - A thug and a thief</span>

  5. Software & Hardware   -   #5
    leonidas's Avatar Poster
    Join Date
    Mar 2003
    Location
    Paris
    Age
    36
    Posts
    1,223
    Originally posted by 3rd gen noob@25 October 2003 - 20:04
    well, i&#39;ve just formatted there
    after the format, i only installed necessary drivers and nod32
    i updated nod32 and it then found 11 infected files (brought up svchost.exe and dllhost.exe)
    wtf is going on here?
    "svchost.exe" isn&#39;t a virus it&#39;s just your clock which tries to syncronize with the internet time from a site I don&#39;t remember.

  6. Software & Hardware   -   #6
    Poster
    Join Date
    Jun 2003
    Location
    England
    Posts
    1,491
    dllhost.exe is win32.nachia i thinks, its a virus ne ways, assoicated with the blaster type virus&#39;s

  7. Software & Hardware   -   #7
    ZaZu's Avatar I know stuff ...
    Join Date
    Sep 2003
    Location
    @Home
    Posts
    1,966
    Do you have a firewall?
    it sounds like you need one
    get ZoneAlarm here


    If you attack the establishment long enough and hard enough, they will make you a member of it.
    -- Art Buchwald --

  8. Software & Hardware   -   #8
    Poster
    Join Date
    Jun 2003
    Location
    Australia
    Posts
    376
    Originally posted by leonidas+26 October 2003 - 06:05--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (leonidas &#064; 26 October 2003 - 06:05)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-3rd gen noob@25 October 2003 - 20:04
    well, i&#39;ve just formatted there
    after the format, i only installed necessary drivers and nod32
    i updated nod32 and it then found 11 infected files (brought up svchost.exe and dllhost.exe)
    wtf is going on here?
    "svchost.exe" isn&#39;t a virus it&#39;s just your clock which tries to syncronize with the internet time from a site I don&#39;t remember. [/b][/quote]
    svchost.exe <--- plenty of worm/viri use that as a name....

    EDIT: im %95 sure this is what you had....tells you all about it

  9. Software & Hardware   -   #9
    leonidas's Avatar Poster
    Join Date
    Mar 2003
    Location
    Paris
    Age
    36
    Posts
    1,223
    Originally posted by exeus+26 October 2003 - 13:03--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (exeus &#064; 26 October 2003 - 13:03)</td></tr><tr><td id='QUOTE'>
    Originally posted by leonidas@26 October 2003 - 06:05
    <!--QuoteBegin-3rd gen noob
    @25 October 2003 - 20:04
    well, i&#39;ve just formatted there
    after the format, i only installed necessary drivers and nod32
    i updated nod32 and it then found 11 infected files (brought up svchost.exe and dllhost.exe)
    wtf is going on here?

    "svchost.exe" isn&#39;t a virus it&#39;s just your clock which tries to syncronize with the internet time from a site I don&#39;t remember.
    svchost.exe <--- plenty of worm/viri use that as a name....

    EDIT: im %95 sure this is what you had....tells you all about it [/b][/quote]
    I&#39;m sorry i didn&#39;t know that.
    So That would explain why I &#39;ve got 4 processes of it running on windows task manager Thanks for the information.
    But damn I have NAV Corp 2003, NPF 2003, Spybot, Adaware & Anti-trojan &#33;
    Why the hell don&#39;t they work&#33;??&#33;?&#33;

  10. Software & Hardware   -   #10
    Poster
    Join Date
    Jun 2003
    Location
    Australia
    Posts
    376
    Originally posted by leonidas+26 October 2003 - 21:23--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (leonidas &#064; 26 October 2003 - 21:23)</td></tr><tr><td id='QUOTE'>
    Originally posted by exeus@26 October 2003 - 13:03
    Originally posted by leonidas@26 October 2003 - 06:05
    <!--QuoteBegin-3rd gen noob
    @25 October 2003 - 20:04
    well, i&#39;ve just formatted there
    after the format, i only installed necessary drivers and nod32
    i updated nod32 and it then found 11 infected files (brought up svchost.exe and dllhost.exe)
    wtf is going on here?

    "svchost.exe" isn&#39;t a virus it&#39;s just your clock which tries to syncronize with the internet time from a site I don&#39;t remember.

    svchost.exe <--- plenty of worm/viri use that as a name....

    EDIT: im %95 sure this is what you had....tells you all about it
    I&#39;m sorry i didn&#39;t know that.
    So That would explain why I &#39;ve got 4 processes of it running on windows task manager

    Thanks for the information. [/b][/quote]
    no multible instances of that running is normall(i spose that is why some programmers take advantage of that when writteing mallicous code)

    a bit of info here if u are wondering what thay are

    EDIT:dont use "run" like it says at ms start the command prompt yourself

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •