firewall

hi..... newbie needs help....

I have pccillin firewall telling me that my last attack was subseven coming from my own ip address????? does this mean have sub seven lurking in there somewhere or what???


thanks

yes that means that you have subseven in your puter and need to get rid of it there are a couple fix at hackfix.org/subseven

More than likely this means that you have downloaded a Sub seven trojan onto your system. Do you have any P2P programs?? More than likely you got it from there. I would uninstall any p2p programs on your system. Not to mention most P2P downloads are illegal. If you want to get rid of this trojan go to www.moosoft.com and download The cleaner and scan drive c:\ this should detect the trojan and remove it. Good Luck -Twisted-

http://www.comusolv.com/security/trojan.htm

you can find some good trojan removal tools here

That's bad news 4 u.
u should make a complete check on ur computer & not only remove sub seven.
I also advise u to check the personal data u keep on ur hard disk, like account details and take conter measure by telling ur bank.

While most virus scanners will find most notorious trojans, you should also consider adding a trojan scanner to your system.

One you may consider is BOClean, found at http://www.nsclean.com/boclean.html

The other is TDS-3, found at http://tds.diamondcs.com.au/

They're well worth the cost, and TDS-3 also includes some great network tools as well.

Don't forget The Cleaner-->http://www.moosoft.com/

And Tauscan-->http://www.agnitum.com/products/tauscan/


I use them both frequently, and i can vouch for their effectiveness.

I have to agree with the above replys on using a good trojan scanner, antivirus sofware's are geared towards removing virus's and not trojans. Heres a new kid on the block, its detection rating is high on finding and disabling trojans give it a try. http://www.simplysup.com/tremover/download.html

Yea like tsr said , www.simplysup.com is an excellent site.
But first go to dos and run netstat -a , and if you find port 27374 open , then your definetely infected.

You can now configure Trojans to open up whatever port you want (ie. Trojans are not bound to the default port like 27374 fro SubSeven, or 12345 for NetBus), so doing a netstat is not an accurate reflection of if you are infected.

Very true. Don't expect it to sit on that specific port. However, if pccillin found it, there is a good chance that it is running on that port. Unless pccilling flags on packet payload rather than source/dest ports. Either way, if you see some ports open that you cannot identify after doing a netstat, then subseven could be running on one of those.

My advice to a noob would be to become very familiar with what software you have on your system and know how it behaves (what ports it uses, what processes it starts, etc). This way, you can definately spot when things are running amiss on your box.