Nerte 7.8.1 Trojan

savagegoose · Cadet Joined: May 14, 2003 Posts: 2 Location: Australia

ehh i think its a false report,

that sheilds up place says i have stealth every port, your trojan hunter found nothing of note.

it dud say port 120 is suss, and also reported paltalk.exe maybe a downloader hehehe i think it is.

isnt there a lot of false alarms about port 80 anyhow?

Jamming · Colonel Premium Member Joined: Jun 22, 2002 Posts: 1874

Yeah, there are a number of them.
If you ever find a suspicious file you can submit it to for Magnus to look at.

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

Ok all the scans are working on site now.

Muddy · Cadet Joined: Sep 11, 2003 Posts: 1 Location: USA

Im getting that same error and I have all the latest Norton defs and am running a current version of Zone ALarm

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

Hmm that's odd because the problem was resolved. I'll double check again.

bradleywillson · Cadet Joined: Feb 26, 2004 Posts: 1 Location: USA

mileslevy · Cadet Joined: Mar 29, 2004 Posts: 1 Location: USA

Also was notified of the possilbe Nerte trojan... netstat did NOT show 32 in use or listening. Scan'd the registry for nerte... NADA..
I suspect a false positive on the scan.

erbuc · Cadet Joined: May 08, 2004 Posts: 4 Location: Thailand

Hi everyone,

I have a slightly different issue here in Thailand with some very interesting results.

When you subscribe to a xDSL service here, you get two logins:

1. for all local internet websites, email etc.
2. for all international internet websites, email etc.

They charge me per hour for the international but the local is a flat rate. If you login with the local account, any attempt to access a web site outside Thailand times out because it is blocked. So I tried to outsmart the system by using a local transparent proxy with international access. Works like a charm.

However, when using the scanners here, the IP Address scanner does not know I am behind a proxy and returns a single, anonymous IP address, not the IP address assigned to me.

Secondly, the trojan scanner claims there may be a Nerte virus on ports 80 and 21 (assigned to the proxy for local login) when I am logged in using the local account. But shows no trojan when I am logged on using the international account.

Does anyone have any idea what could possibly be listening on ports from my local machine (127.0.0.1):

TCP 1025, 2051, 1028
UDP 2051, 1028

There are no foreign addresses connected to these according to netstat.

Cheers,

Eric

erbuc · Cadet Joined: May 08, 2004 Posts: 4 Location: Thailand

Hi everyone,

I have a slightly different issue here in Thailand with some very interesting results.

When you subscribe to a xDSL service here, you get two logins:

1. for all local internet websites, email etc.
2. for all international internet websites, email etc.

They charge me per hour for the international but the local is a flat rate. If you login with the local account, any attempt to access a web site outside Thailand times out because it is blocked. So I tried to outsmart the system by using a local transparent proxy with international access. Works like a charm.

However, when using the scanners here, the IP Address scanner does not know I am behind a proxy and returns a single, anonymous IP address, not the IP address assigned to me.

Secondly, the trojan scanner claims there may be a Nerte virus on ports 80 and 21 (assigned to the proxy for local login) when I am logged in using the local account. But shows no trojan when I am logged on using the international account.

Does anyone have any idea what could possibly be listening on ports from my local machine (127.0.0.1):

TCP 1025, 2051, 1028
UDP 2051, 1028

There are no foreign addresses connected to these according to netstat.

Cheers,

Eric

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

I'm curious what does the IP come back with when you go thru the transparent proxy versus the international hookup?

erbuc · Cadet Joined: May 08, 2004 Posts: 4 Location: Thailand

Through Transparent Proxy

Paul · Admin Joined: Feb 22, 2002 Posts: 5719 Location: USA

So on the first its scanning the proxy IP and its open ports.

erbuc · Cadet Joined: May 08, 2004 Posts: 4 Location: Thailand

That's correct. And that's when the Computer Cops Trojan Scanner picks up the Nerte virus on ports 21 and 80.

Should this be a concern to me in using that proxy?

bassweb · Cadet Joined: Mar 30, 2004 Posts: 1 Location: Netherlands

Port 80 is the standart Internet Port so if you are internetting you have port 80 open Smile

That's my opinion though


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 923 pages served in previous 5 minutes. Page Rendered: 0.512 seconds.