Symantec and trendmicro

Greeting's:

My firewall asked for permission to let norton's liveupdate access the internet but when i checked te site it wanted to connect to,
this is what i get...
Liveupdate is trying to connect to TRENDMICRO'S SITE .

I have attached JPEG having the alert.

I am not sure if my computer is infected with a trojan or a virus.

I have already started a scan at housecall but what the hack i dont know if i can trust them.


Edit :
I ran housecall scan AFTER i got this alert (and that also after about 7-8 alerts)

housecall did not detect anything.

I am not too sure, but it looks like you may have run "housecall" from Trend Micro............Norton has detected the attempt to update?

Personally, I delete norton on sight, it is real crapware IMO

:)

Greeting's

Now when i tried to connect to TRENDMICRO'S site an application (TmProxy.exe) which i belive is Trend Micro proxy and is included in their Internet security Pack 2005. But i have not installed Pc-Cillin proxy at all i just installed it's anti-virus.
I dont know what to trust ...... crap.

Details in the JPEG

Greetings

OKay this is last time i may report such behaviour by live update because i am planning to uninstall symantec's products only after i figure out nice replacements for them, anyway this time liveupdate is trying to connect to c7.zedo.com and also scripts.lycos.com !!

JPEG has the details. (only about C7.zedo.com because i can attach only one file)

any suggestions or idea why this is happening

nihil what do you recommend as AV if not Norton... or are you just refering to Norton Firewall

I currently run sygate personal firewall and PC Chillin Trend Micro as my Antivirus. Trend Micro is very good AV software IMO. It does do a lot of live updates but thats a good thing. As far as:TmProxy.exe <--that is required to connect to their server to update the software same with tmo agent.exe if your running Sygate Personal Firewall double click on the icon in the sys tray you will see all running applications right click on the ones for pc chillin and trend micro go to allow access.

hey BW.. are you running 2 Av progs by any chance?

Quote:

---

OKay this is last time i may report such behaviour by live update because i am planning to uninstall symantec's products only after i figure out nice replacements for them, anyway this time liveupdate is trying to connect to c7.zedo.com and also scripts.lycos.com !!

---

just curiosity: is this NIS a retail version or a e-mule, DC++, Kazaa version ? :)

if its a "generic" one, i strongly advise you to uninstall it IMMEDIATLY! There is a lot of NIS 2005 "kicking" on those p2p networks that are infected with back doors....

i run norton products. i am generally happy with them. but there has always been a lot of worry on the part of the industry as to the quality of sym. products.

they have been knows to crash machines, have negative impact by very high utilization, not catch certain viri, and a few other little annoyances. but they do do the job as long as you are using them properly.

- dont run 2 AV's. there is no point and they might battle each other.
- trend-micro has been getting a lot of nice press. but i havent used them. we are a symantec customer.
- and naturally, make sure you update your AV regularly. at least 1x or 2x a week. and open up FW ports to allow the update.

if NAV liveuypdate is cause grief. goto the Symantec site and search/downoad the most current Live Update package for you product. that might solve the update issues.

Quote:

---

nihil what do you recommend as AV if not Norton... or are you just refering to Norton Firewall

---

I have used Trend Micro for over 5 years, and am satisfied. I also use McAfee and AVG, and find them to be satisfactory products.

I would only use the professional (corporate) version of Norton (Symantec)............it is worth the extra bucks.

I am told that Kaspersky is very good, and it certainly scores well in recent tests.

I guess I would probably buy PC-Cillin, if I were to go to the shop today

Cheers :)

From your screenshot, I can see that you are using Sygate personal firewall. I am also using this firewall and have similar problem as you for a long time. The firewall seem to contain a bug and sometime displays the wrong destination. I am not sure if this is really caused by the firewall though...

Greeting's :

I am sorry i couldn't reply for 3 day's, I was out of town. Anyway the problem is still there,
some more information that i think i should share,
1. I use original version of all the products.
2. I am not running tow AV's or firewalls

here is what i use :
I use PC-Cillin AV (trial version) (latest ver and def)
Sygate Firewall (paid) (latest ver and def)
and Norton GoBack, Ghost and Partition magic (all paid).

I dont know if my system is 0wned (may be one of you can help me here) I have kept checking all open connection using F-Port 2.0. I get lot of Incoming and Outgoing packets to 10.40.0.1 ?? the application which sends this is "\system32\drivers\ndisuio.sys.

I dont know what should i do all my project work is on the computer if i format and re-install i might loose some work and if i take backup..... I am worried that if my computer is really infected then there is a risk my backup will be same..... any suggestion.

You might consider getting a windows version of Ethereal or another "network sniffer", crank it up with everything else accessing the internet off (messengers, browsers, games, everything) and then auto-update your AV. With the capture of your tcp dump, you'll be able to trace packets and see exactly where they're really going. By doing so, you figure out if it's your firewall misreporting something or if it's truly going there for some reason.