wsftp_pro getting hammered by trojans

Discussion in 'other anti-trojan software' started by jazzylee77, Mar 11, 2005.

Thread Status:
Not open for further replies.
  1. jazzylee77

    jazzylee77 Registered Member

    Joined:
    Mar 11, 2005
    Posts:
    6
    I've been doing long uploads the past couple days. (35,000 html pages)

    wsftp_pro slows way down and I start getting NAV messages about blocked incoming trojan attempts one after another.

    Names of trojans too numerous to mention...

    At first they were most transcout trojans and now I see everything.

    Would this just be a symptom of running my ftp program over a long period?

    It's gettting to be a nuisance as I think it is causing occaisional errors interrupting the uploads.

    I wonder if the slowdown is done my my host...it starts fast and gradually slows down to a trickle.

    I've run avast virus cleaner and norton, checked for transcout related files. Nothing.

    How can I be sure a trojan isn't getting through?

    Just make me nervous with all the attacks. Usually around 6 of them one after another every few minutes. Others more randomly.

    Also I had intended to switch my new computer over to Avast soon when the NAV trial expires...but since Norton seems to be blocking trojans...(or maybe it isn't !) I'm hesitant to remove it.

    looking forward to all clues to ftp security ...please spare me the ftp is a terrible protocol lecture...I want to know what I can do about it. :)
     
  2. jazzylee77

    jazzylee77 Registered Member

    Joined:
    Mar 11, 2005
    Posts:
    6
    one other thing...and this makes me very suspicious...

    sometimes Zone Alarm alerts that wsftp_pro is requesting to run as a server. I deny and it continues to function normally. Could just be an update function, but sounds trojan-like to me.
     
  3. Firecat

    Firecat Registered Member

    Joined:
    Jan 2, 2005
    Posts:
    7,927
    Location:
    The land of no identity :D
    If your using NAV for Trojan detection its possible that some of them have successfully entered your PC. NAV is really not that good in Trojan detection.
     
  4. jazzylee77

    jazzylee77 Registered Member

    Joined:
    Mar 11, 2005
    Posts:
    6
    I'd be interested in hearing about good additional trojan protection...I was going to switch to Avast, somethihng I'm familiar with...is it any better in this department or should I run a specific trojan tool? recommendations appreciated.
     
  5. Firecat

    Firecat Registered Member

    Joined:
    Jan 2, 2005
    Posts:
    7,927
    Location:
    The land of no identity :D
    Y'see the main problem with Norton is that it will DETECT most of the Trojans, but all that is through a generic signature. Moreover, those types of signatures in Symantec database do not remove the assosciated startup keys, registry entries, browser helper objects etc.

    PLEASE NOTE THAT THE ABOVE INFORMATION MAY ONLY FULLY APPLY TO NAV 2004 AND UP!

    I recommend you back up NAV with an Anti-Trojan such as A-Squared or Ewido Free and an On-Demand AV like BitDefender Free 7.2

    For best overall malware protection KAV seems to be the best, and ArcaVir is coming out on second for me...

    Firecat
     
  6. jazzylee77

    jazzylee77 Registered Member

    Joined:
    Mar 11, 2005
    Posts:
    6
    ok...I'm catching up on threads in the "other anti trojan" forum. I'll settle on one of those mentioned often there and give it a spin. Looks like I should have posted in that area...oops
     
  7. jazzylee77

    jazzylee77 Registered Member

    Joined:
    Mar 11, 2005
    Posts:
    6
    I've added BoClean and bit defender, so far
     
  8. Firecat

    Firecat Registered Member

    Joined:
    Jan 2, 2005
    Posts:
    7,927
    Location:
    The land of no identity :D
    That should be good enough...You can also add A-Squared Free and Ewido Free (Ewido's among the best ATs I think).
     
  9. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi jazzylee77,

    I've moved your thread over into the "Other Anti-trojan Software" forum as it is a more suitable forum for your topic. ;)

    Regards,

    snap
     
  10. Blackcat

    Blackcat Registered Member

    Joined:
    Nov 22, 2002
    Posts:
    4,010
    Location:
    Christchurch, UK
    Not too bad with these recent results; http://www.av-comparatives.org/ ;)

    Not as good as KAV, but Norton's on-demand scanner even beat well-known trojan slayers, Dr Web and McAfee in trojan/backdoor detection in the above test.

    Overall, layered defense is recommended; an AV and AT combined; http://www.techsupportalert.com/free-vs-paid-av.htm
     

    Attached Files:

    Last edited: Mar 11, 2005
  11. bellgamin

    bellgamin Very Frequent Poster

    Joined:
    Aug 1, 2002
    Posts:
    5,648
    Location:
    Hawaii
    BOClean is superb AT protection. Good move!

    I wonder if WSFTP has been directly attacked -- infected or corrupted? Have you considered uninstalling it, then using a registry cleaner to ensure ALL of it is gone, then re-installing it? Pain in the nether regions, but might be worth it.
     
  12. jazzylee77

    jazzylee77 Registered Member

    Joined:
    Mar 11, 2005
    Posts:
    6
    Registry cleaner? That does sound like a pain, I'll think about it tommorrow! I've used registry mechanic on another system...willl that do the trick? I was even thinking of removing ftp pro and getting a different ftp program altogether since I'm only guessing whether it is clean or not.

    A trojan was found...ByteVerify. Java class junk. It doesn't sound like it would be related to the ftp program. I've seen no alerts since running all the extra stuff. I have ewido on now too. Bit defender picked up a couple threats that the others had missed. I feel a little more secure now...if I only knew why! :)
     
Thread Status:
Not open for further replies.