April 10th, 2004, 07:14 AM
I unistalled Norton a few months ago, and I don't use Outlook (I even removed it). But before I uninstalled nav, I didnt change the "email scanning" option. Today I noticed that NETSTAT shows "pop3.norton.antivirus ESTABLISHED". Should I be concerned? Searched google for a few hours, tried a few things with ZA. Nothing stops this. Tks! modan
April 10th, 2004, 07:27 AM
What operating system? m$ has a new portmapper service that gives a very nice detailed description of listening/established.
You can also use fport from www.foundstone.com and find out which app is doing this.
Then stop the program from starting up or deal with the problem accordingly.
is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.
April 10th, 2004, 08:08 AM
I'll check the links, Tks!
April 10th, 2004, 08:57 AM
This is leftover from your AV scanner. It is the "SHIM" that Symantec uses to scan e-mail.
From the Symantec site:
Why does Norton AntiVirus change your email settings?
To keep your email program from timing out when scanning your email attachments, NAV creates a virtual proxy server on your hard drive. Email is downloaded to the proxy server instead of directly to your email program. Once it is scanned for viruses and other malicious code, the proxy server sends the messages to the Inbox of your email program. To do this, NAV must modify the settings of your email program with the address of the virtual proxy server:
NAV 2000 uses the address 127.0.0.1
NAV 2001 uses the address pop3.norton.antivirus
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
April 11th, 2004, 06:52 AM
Thanks for the info. Still cant find what starts this (Fport would have helped, but theres no version for win98). Read something about removing pop3.norton entries in the "hosts" file. Would it make a diff? Should I just forget this? tks!
April 11th, 2004, 07:44 AM
SysInternals has TDIMon....http://www.sysinternals.com/ntw2k/freeware/tdimon.shtml
I haven't played with it too much, but it may help...
April 11th, 2004, 08:33 AM
coincidence or ESP.. I found that site a few mins ago. Looks like my browser (firefox) is the process, and the report shows a non stop loop (every few secs).. 127.0.0.1:1027 -- 127.0.0.1:1028
my firewall was nav 2001