check my files please

Hi,

Welcome to the forum!

Since you've edited your post a couple times, I decided to totally redo my reply.

Let me start with something from your first post because you may be under a false assumption and I think we should clear that up first.

I've looked at your text file, (t5t.txt), and that appears to be fairly normal probes from the Internet. Your system is blocking them (otherwise it wouldn't be recording them) so that is not a problem at all. We all get Subseven scans from the outside, it doesn't mean our systems are infected. They are nothing more than attempts to connect to our systems to see if we are infected by Subseven.

As for the pings, those are normal too, though hopefully that activity is going to reduce as time goes by. All these probes and scans are nothing more than other people's infected systems trying to reach out and infect our systems. They are harmless if we block them and aren't infected by something previously.

Blocked scans do not mean you are infected. It's important to realize that.

Now, as for the "priority order" we should follow to address your situation, the most important thing is to get all the facts out and then determine if your system is infected or not, regardless of the external scan info.

To proceed... First, which system is the one you believe has the problem? The Windows ME system? Is that where the image above comes from - the Windows ME task manager (ctrl alt del)?

If that's the system it has Anti-Trojan Shield running. But, do you have a regular Anti-Virus package on there? Norton? McAfee? other? We'll need to start with a scan. If you don't have an AV package, we'll do an online scan instead.

Side note: It looks like you are running two software firewalls - LooknStop and Zone Alarm. That's not a good idea. A system should only ever have 1 installed and running software firewall application.


Edit: I think I'll move this thread to the "other security issues" forum section later on. There will be a moved placeholder left in this forum with a link to the new thread. In any case, look for it there later.

 

Hi again,

First, there is nothing unusual in your Port Explorer image (for as much of it as is visible in that screen shot). Did you have specific questions about it? I think you are evaluating Port Explorer so, if you do have questions about it then you should start a new topic in our Port Explorer (link) forum section with details regarding whatever concerns you.

As for anti-virus, you do need one! Especially if you are concerned that your system is infected. At this point though, I'm still wondering if you are infected at all. There has not been any clear indication of an infection in what you've posted so far.

My first advice is to run an online anti-virus scan. I suggest the Panda Scanner. It runs right from your Internet Explorer browser window. A link to it is available from our Free Services page here:

http://www.wilders.org/free_services.htm

It's the Panda Active Scan. It'll take a while to run, but it is very powerful. You should run that and report back about what it finds, if anything.

As to running two firewalls, the "remote connection" message, and your Zone Alarm image above, let's leave that until after we find out whether your system is infected or not. An active malware infection is much worse than any of these other things so let's find that out first.

 

FYI - If Panda is down then just use Housecall, it's the next one down on our page there.

When you come back, try to type in the full message regarding that "remote connection". I'm still not clear on exactly what that is yet. It may be something normal, I can't tell until I see the exact message. (If you can capture a screen image of the message and post that, it'd be much better.)

See you when you get back! Have a good day.

 

Hmm, I don't see anything wrong in the images you've posted.

Still waiting to hear the results of your online virus scan. If not Panda, then Housecall.

The remote computer line in the dialup dialog is totally normal. Your modem dials, connects to a computer (for authentication) at your IPS ISP and sends it the username and password the ISP assigned you. That's how a login is done.

My svchost.exe is identical to the one you posted an image of above. The differing sizes are simply because files are allocated in blocks of space on a disk, in your case and mine that is in multiples of 4KB. If a file is 5KB in actual size, it would show 8KB in the Size on disk field. I've attached the "Version" tab of my svchost just so you can step down through that and see all the Microsoft specs in there. I highlighted the file version field. But, your looks fine from here.

Since svchost is a generic container for multiple network based functions, that's why there are many functions in the policy screen that map to different svchost startup commands. Also, that's why there are multiple copies of svchost running in the task manager. I have 4 myself here, though I've seen people with as many as 6, I think.

Really, you should do a full system scan and let us know what it finds if anything. Also, we can do more after that. Any other specific questions?

 

Angel,

I never said I was 100% sure that everything is fine on your system. I simply meant that based solely on what you posted, there is no sign that there is a problem. Having multiple svchost.exe running, for example, is totally normal. Everyone running XP has those. The size of your svchost.exe is totally normal. Neither of those is a sign of a problem.

As for the dialup dialog image you posted. "Connected to remote computer" is also normal. The "remote computer" is your ISP's authentication server. That's is simply how it validates that you are who you say you are (username & password) and it then gives you your Internet connection. So this is also not a sign of a problem. (Edit: See image below. I went over to my old Windows 95 system that has the same type of dialer as you are using and captured that picture. Notice it is the same as yours.)

The thing that I was trying to stress as most important and a priority was to run an online virus scan, which you still haven't done. A couple times above you said you were "downloading the product". I was not saying to go and get an evaluation copy of those AV scanners, or to buy anything at this moment. (We can advice you later about different products, from free ones to really good pay products.)

The "online scanners" I pointed you to are just webpage applets that run in your browser and scan your system for free. You can use them anytime. The links over on our free services page should bring you right into either the Panda scanner or the Housecall scanner. Click on them in IE, if necessary add their sites to your IE trusted zone and then run the scanner in the browser window. Let it scan for viruses and trojans and it'll report back when it is done.

If you are worried about having something bad on your system you should be running these scans first thing!

As for the spaces in that one image, that looks like an oddity to me, but I've never seen that myself. I won't say right away that it is anything to be worried about because I've seen lots of display problems before. The virus scan should find anything bad.

More coming in my next post...

 

Openports is a command line utility program. You need to run it from a CMD window (it looks like an old style MS-DOS window). To get a CMD window up on XP... "Start" menu > "Run..." > enter "CMD" in the line next to Open: (see image below) > hit "OK button.

This should bring up a CMD window, see next post.

 

Here's what it looks like...

 

Pings and misc. scans from the Internet are totally normal and there are so many of them occurring that ISP's rarely act upon any of the reports unless... One person is doing a real lot of scanning and causing serious problems on the ISP, though this is rare. Or, if a person is actually caught hacking, which is extremely rare.

These probes against you are not serious hack attempts. You can report them, but don't expect to much from the ISP.

I'm not sure what you concern is here. Reverse DNS lookups are available for a lot of ISP connected people. In your image above, you circled a few and wrote things like "there all different" when talking about the "source" of the probes. That is normal. These are coming in from all over the Internet so of course they are different sources (different people, different computers out there) and both the IP address and their name is different. They aren't "changing" their DNS, those are simply what their ISP's assign to them as hostnames.

The destination in all the circled cases is your system, so, your IP address and DNS name are the same in all those records.