I unistalled Norton a few months ago, and I don't use Outlook (I even removed it). But before I uninstalled nav, I didnt change the "email scanning" option. Today I noticed that NETSTAT shows "pop3.norton.antivirus ESTABLISHED". Should I be concerned? Searched google for a few hours, tried a few things with ZA. Nothing stops this. Tks! modan
What operating system? m$ has a new portmapper service that gives a very nice detailed description of listening/established.
You can also use fport from www.foundstone.com and find out which app is doing this.
Then stop the program from starting up or deal with the problem accordingly.
I'll check the links, Tks!
This is leftover from your AV scanner. It is the "SHIM" that Symantec uses to scan e-mail.
From the Symantec site:
Why does Norton AntiVirus change your email settings?
To keep your email program from timing out when scanning your email attachments, NAV creates a virtual proxy server on your hard drive. Email is downloaded to the proxy server instead of directly to your email program. Once it is scanned for viruses and other malicious code, the proxy server sends the messages to the Inbox of your email program. To do this, NAV must modify the settings of your email program with the address of the virtual proxy server:
NAV 2000 uses the address 127.0.0.1
NAV 2001 uses the address pop3.norton.antivirus
Thanks for the info. Still cant find what starts this (Fport would have helped, but theres no version for win98). Read something about removing pop3.norton entries in the "hosts" file. Would it make a diff? Should I just forget this? tks!
SysInternals has TDIMon....http://www.sysinternals.com/ntw2k/freeware/tdimon.shtml
I haven't played with it too much, but it may help...
coincidence or ESP.. I found that site a few mins ago. Looks like my browser (firefox) is the process, and the report shows a non stop loop (every few secs).. 127.0.0.1:1027 -- 127.0.0.1:1028
my firewall was nav 2001