firewall being attack.......

LastIrishMonkey

i have norton personal firewall and keeping getting attack by
Backdoor/SubSeven Trojan horse
thank god its being blocked but id love to stop it for good is there any way ?

Capt'n Midnight

Not unless the traffic is blocked upstream. by your ISP..

You could put a router in outside the firewall to block those IP's - but since a firewall is a type of router it's kinda redundant...

GUI

write a rule
to ignore any packets from sources where the originating packets were not from inside ur lan

radiospan

Originally posted by LastIrishMonkey
i have norton personal firewall and keeping getting attack by
Backdoor/SubSeven Trojan horse
thank god its being blocked but id love to stop it for good is there any way ?

AFAIK, this is just kiddies running IP scanners on huge ranges of IP's. Your computer is not being specifically attacked or targeted, and you're under no real threat as long as the Trojan itself isn't installed on your system.

But I'm open to correction on that. When I had ZoneAlarm installed, my IP was scanned many times a day for a SubSeven backdoor.

Sleipnir

post a couple of log entries.

Sleipnir

oh yeah- you could be infected with the subseven trojan which is opening up a port on your computer that is used by outsiders to connect to your system, but the FW is blocking comms on that port.
It's a backdoor so that's what it's supposed to do anyway!
Scan your system using your own AV or housecall

Oriel

I keep getting the same thing, but with a different trojan.

This may be worth a look.

Situation:
You ran the Symantec Security Check, and it detected the Sokets De Trois V1 Trojan. When you run a full system scan using the most recent virus definitions, no infection is found.

Solution:
The cause of this is not known.

Ah, sounds like Symantec ok.

sceptre

There's a script kiddie at the University of Tehran who seems to like to scan the entire Esat IP range every few weeks looking for PCs infected with subseven. I've noticed the logs on a few machines that I'm acquainted with*. It's the one place that I''ve noticed very consistent and regular scans from.

plazz is almost certainly right. Norton PF probably has your machine set to be relatively invisible to scans anyway.

*read as "people who like me to fix their machines for them when Word &c stop working"