sub7:They tried it

Hi everybody,
I got a warning from my norton firewall that someone tried a sub7 trojon. I wasn't sure if they were tring to put one in my os(ms-xp) or if there was one in there already. I ran my norton virus check that had been update the day before and I got a clean bill of health. I got the IP address were it came from and ran it on AO's IP locator. The IP address is 65.49.44.167 and this is what I got from the ip locator: CPE00045a965b77-CMO14130003296.cpe.net.cable.rogers.com. My questions are:

1. Did my norton virus check miss a sud 7 trojon?
2. Who is this person?
3. Sence this was the 1st time it happened, am I safe from this person?

Freddy

Freddy: It could be somebody with a client scanning for servers or somebody looking for the server they installed. It's usually the former. I would not worry about it.

Fred Brown

i wouldn't worried about it your firewall blocks it out for 30mins.I get them type of hits at least 6 to 7 times a day.

Quote:

---

Freddy: It could be somebody with a client scanning for servers or somebody looking for the server they installed. It's usually the former. I would not worry about it.

---

Very true.

The warning that you got was it ?
"The trojan subshiz tried to load" (or tried to connect)
or
"someone tried to connect on port 37337 (subshiz)"

If it is the first you are probably infected (don't know how that happened since you keep all things updated and stuff) and you need to get the removal instructions.

If it were the second then there is not much to worrie about, just someone trying to connect to a port on your system (identified as subshiz), that happens quite often.

You could always try and run an anti trojan scanner on your system
The cleaner: www.moosoft.com
Tauscan: www.agnitum.com

noODle,
Here's a part of the report:

Rule "Default Block Backdoor/SubSeven Trojan horse" blocked (65.49.44.167,27374)
Inbound TCP connection

The vrius check show no trojons.

Freddy

Quote:

---

Inbound TCP connection

---

This is what Drunk on Duvel and cdkj were talking about.
There is nothing to worry about, just some punk scanning to see if you are infected.
Ignore them.

That's what i thought , but I wanted to double check, Thanks.

Freddy

The IP locator says I'm in Australia... that's kind of far from where I really am in Detroit...

Quote:

---

Originally posted here by rabidus6
The IP locator says I'm in Australia... that's kind of far from where I really am in Detroit...

---

From the IP locator
www.microsoft.com (166.90.148.246) is located in Broomfield, Colorado, United States.

Not Seattle at their main offices?

you might want to try a trojan remover instead of a virus remover...your could be useless againts trojans such as sub7. There's programs out there that are made specifically to remove trojans such as sub7 and Back Orifice

I downloaded 'the cleaner' trail and just ran it. No trojons. It just must have been a try to put one in. I sent all the info. I got to my provider. I don't know what they can do. By the way the IP Locator locates were your provider is not were your computer is.

I got another hit by a sub7. This time its from a place called roadrunner-southwest. The Visual Tracking from Norton gave me this address: 13241 Woodland Park Rd. Herndon, Va. 20171, but the map shows a location on the West Coast in Sunnyvale. Well, the Cleaner says there is no trojons in the system, so I will not worry about it. I have to worry about getting another $3500 for my new place, but I have no more money for a downpayment. Oh well, I guess I'll just have to keep renting.

Freddy

port 27374 is the default sub7 port (used to be 1243 i think) its prolly just someone scanning for infected computers - also the ip you traced the scan back to prolly is not the person doing it - sub7 has a built in port scanner on the servers so once the person found one infected computer he could make it do the scans for him/her remotely reducing the chance of it being traced back to them - well they would if they had any sense!! I wouldn't worry about it - I get hit by things like that maybe 4/5 times a day at least - people just take ip blocks and scan each one for the default port to see if they can get anyone who is infected to connect to

v_Ln

The IP you gave returned this:
Rogers Cable Inc. Bloor ON-ROG-4-BLOOR-5 (NET-65-49-44-0-1)
65.49.44.0 - 65.49.47.255

# ARIN WHOIS database, last updated 2003-09-04 19:15

A traceroute revealed this:
1 1.11.1.1 3ms 3ms 3ms TTL: 0 (No rDNS)
2 170.1.11.6 35ms 31ms 28ms TTL: 0 (me.at.somewhere.net ok)
3 170.21.11.5 29ms 30ms 29ms TTL: 0 (No rDNS)
4 207.173.144.57 37ms 47ms 41ms TTL: 0 (a5-1-0--133.gw01.mcln.eli.net ok)
5 208.186.20.145 41ms 52ms 37ms TTL: 0 (srp2-0.cr01.mcln.eli.net ok)
6 207.173.114.130 41ms 46ms 38ms TTL: 0 (so-1-0-0--0.er01.asbn.eli.net ok)
7 208.173.50.241 39ms 38ms 36ms TTL: 0 (bpr2-ge-5-0-0.VirginiaEquinix.cw.net ok)
8 206.24.179.49 38ms 37ms 38ms TTL: 0 (acr2-as0-0.Restonrst.cw.net ok)
9 208.173.52.114 38ms 37ms 65ms TTL: 0 (dcr1-so-4-3-0.Washington.cw.net ok)
10 208.175.10.9 80ms 67ms 66ms TTL: 0 (dcr1-so-0-2-0.Chicago.cw.net ok)
11 208.175.10.86 71ms 77ms 71ms TTL: 0 (telus-rogers.Chicago.cw.net ok)
12 66.185.83.166 98ms 75ms 127ms TTL: 0 (gw03.bloor.phub.net.cable.rogers.com fraudulent rDNS)
13 65.49.44.1 96ms 116ms 84ms TTL: 0 (No rDNS)
14 No Response * * *

You'll never know who did this but this will give you a sense of where the connection originated from.

As others have said, this type of connection attempt is common. I see about 30 - 60 a day via my external IDS.

regards,

--TH13

thehorse13 :: tracing back the ip the scan came from 99% of the time is off little/no use - as I mentioned above the vast majority of scan attempts will be from people who are already infected themselvves and are being used unwittingly by the kiddie to do the scans for them making actually tracing them back more difficult - not only would you have to trace the ip of the scanner back but then you would have to contact their ip to find out every ip that connected to them - as the kiddie doesn't need to stay connected throughout the scan b8ut can set it going then disconnect and connect again later to pick up results it could be very difficult to pin-point the correct ip(s) of the kiddie - so I wouldn't even bother trying to trace back scan attempts as there is very little you can do with the information - except perhaps alert the person who is being used to do the scans that they are infected

v_Ln

Fred, getting a warning from Norton saying someone tried to connect to your computer with a trojan is really a part of life.

I get these about 3 times a day alon with the Blaster worm tring to connect to my computer about 30 times a day. Its a part of life getting scanned for trojans. As long as your running a firewall you will be pretty safe. Even if you did have a trojan on your computer, it would have to make a outbound connection. What would happen then is your Norton Firewall would pop a message up saying something like this. "Sub7.exe is attempting to access the internet" You then have a option to permit or refuse.

All in All, you should be pretty safe.

Thanks everybody for the insight. I feel better, and I got a trial trojan cleaner to boot.

Freddy