norton popup netbus trojan

Discussion in 'malware problems & news' started by scott lang, Nov 10, 2004.

Thread Status:
Not open for further replies.
  1. scott lang

    scott lang Registered Member

    Joined:
    Oct 20, 2004
    Posts:
    211
    Location:
    claremore,ok
    for the last several days someone has been trying, unsuccessfully, to hit me with netbus trojan. ill be on and a popup comes up saying a dns server with netbus trojan is trying to access and was blocked. i actually one time after telling it no i did not want to see alert assistant, which was reccommended, went into the trace utility for that. and found out its coming from korea. i tried to report this but i guess thery didnt care. i guess nothings gonna hurt as long as it keeps on blocking it.
     
  2. scott lang

    scott lang Registered Member

    Joined:
    Oct 20, 2004
    Posts:
    211
    Location:
    claremore,ok
  3. dog

    dog Guest

    Yes ... everything is OK if Norton is blocking it.

    If you want some added protection, consider a router w/ a Nat firewall ... which will stop unwanted inbound traffic, whiles your software firewall will concentrate on outbound connections, and as a second line of defense for inbound traffic.

    Crazy M (Wilders resident FW expert) has a great site, on configuring Norton if you're interested --> http://www.gpick.com/agnisrules/index.html

    dog - *puppy*
     
  4. scott lang

    scott lang Registered Member

    Joined:
    Oct 20, 2004
    Posts:
    211
    Location:
    claremore,ok
    i had another one a few mins ago. this time i told it not to notify me next time it blocks it. so i shouldnt have it come up, just block it without tellin me. and i have it set to block for 48 hrs.
     
  5. BlueDaemon

    BlueDaemon Registered Member

    Joined:
    Nov 16, 2004
    Posts:
    4
    Location:
    USA
    Yeah, Netbus was made by cDc (Cult of the Dead Cow) around 1998 which they showed the first version over in LV.Unfortunately all versions to 1.7 doesnt allow firewall and antivirus deactivation.So I would think you must have Netbus on your system becuase it comes with an IP Address scanner that scans for computers infected with it.An average virus scanner would pick it up unless the attacker redid the server or if he compressed it with an unknown compressor.You would have to find it in the registery and delete it from there.
     
  6. danny chavis

    danny chavis Guest

    This same thing is happing to me but i have two diffent one attackers trying on mine so i do i find it if is compressed on my computer to delete it. one of mine is from the usa and the other is from krea.
     
Loading...
Thread Status:
Not open for further replies.