Broadband Tech > Security > Security > Altert: NetBus Trojan horse blocked

Altert: NetBus Trojan horse blocked

Blocked means your Firewall did it's job. Did it say blocked from getting IN or blocked from getting OUT? If the former then you should be fine.

Regards,

Doctor Olds

reply to urbanman
It was "inbound" so it was blocked from getting in.

reply to urbanman
Your ISP is not trying to hack you. It was another user on your ISP doing port scans to see if you had the trojan installed so they could hijack your computer
--
Forum Posts:2800

reply to urbanman
Curious. Was it from remote port 53?

reply to Qumahlin
No it wasn't port 53.

Did you run a full scan with an up-to-date anti-virus program, as well as a full scan with an up-to-date anti-trojan program? If not, you should probably do so to determine if anything unusual is on your system.

There are several versions of NetBus, and it's difficult to suggest what to check for without knowing which version it was. It would be much more useful if you posted the entire firewall alert - remote IP, remote port, local port ...

[text was edited by author 2003-06-08 13:56:36]

reply to urbanman
NEtbus is so darn old, people still use that?

Oh well, do a scan on RR network and you'll probably find couple hundred of "NetBus-Enable-PCs"

reply to urbanman

said by urbanman:

---

I got a firewall alert saying a Netbus Trojan horse had been blocked.. when I went to track the ip I got my isp's ip.. is my isp trying to hack my computer? This happened in the wee hours of the night also. Should I be worried?...

---

said by jvmorris:

---

said by urbanman:

---

I got a firewall alert saying a Netbus Trojan horse had been blocked.. when I went to track the ip I got my isp's ip.. is my isp trying to hack my computer? This happened in the wee hours of the night also. Should I be worried?...

---

First, welcome aboard! I think you will find this forum quite useful.

Now, if your firewall is one of the Norton products (e.g., NIS, NPF, or NIS Pro), -- which it certainly sounds like -- you can (and should) simply ignore this 'alert'. The 'intrusion' was blocked (otherwise you wouldn't have gotten a notice).

And, again, if you're running NIS/NPF/NISPro, I would recommend that you consider changing your Reporting Level setting to "Minimal". This eliminates a lot of distractions. If you still see these NetBus alerts, you can go to the Default Trojan Block section of your ruleset and then, one by one, turn off the "Security Alert" settings for each of the approximately 70 Trojans that NIS/NPF/NISPro targets routinely. Your firewll will work the same as always, you just won't get distracted with all these pop-up warnings!

If you want to understand the significance of that message (which I still maintain is not worth getting your shorts all knotted up over), come on back and I'll tell you exactly what it means.

---

Natch. Anytime, feel free to call.
--
Regards, Joseph V. Morris