Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Keep receiving intrusion warning: Sokets De Trois Trojan Horse

by kimchiman Mar 22, 2004 7:35PM PST

I have Norton PF and AV 2003, all updated, everyday. Running Windows 98SE. I have DSL, but only leave my computer on while at home. I usually get a firewall security warning a couple times a day, but as of last week, I have been under an unprecedented, numerous series of attacks, all originating from Australia, all "Sokets De Trois v1" Trojan Horse, one I have never seen used on my computer before. Whenever I see a new IP address listed under PF settings autoblock, I add it to the restricted IP zone (which now has hundreds of IP addresses), then continue my surfing. For example, in the last 20 minutes while taking a shower, I was attacked 402 times by the same IP address, which I added to the restricted zone as well. In addition, I've been attacked hundreds of other times in the last week.

Does anyone know why my computer has gone from being attacked a few times a day, to hundreds a day? I should also say I've done the Norton security scan, and it says all scans are safe.

Thanks

Discussion is locked

3 Posts
- Collapse + Expand Details
- Collapse -
Re:Keep receiving intrusion warning: Sokets De Trois Trojan Horse
by kimchiman Mar 22, 2004 8:23PM PST

I forgot to mention that I checked the detailed statistics firewall log and all of these attacks are the same: "unused port blocking has blocked communications, inbound TCP connection"

- Collapse -
Re:Re:Keep receiving intrusion warning: Sokets De Trois Trojan Horse
by Donna Buenaventura Mar 22, 2004 10:03PM PST

Hi kimchiman,

Are you using Ultima Online Service? Found this info in Symantec site:

Situation:
Norton Internet Security or Norton Personal Firewall reports "Default Block Sokets de Trois v1. Trojan" when you are using Ultima Online Service.

Solution:
You need to add a firewall rule to permit Ultima Online Service to access your system. - Symantec

If you aren't using Ultima Online Service but kept receiving alert that Norton has blocked Default Block Sokets de Trois v1. Trojan, I would not worry much because Norton is doing its job to protect your system from such attacks. I understand that huge # of notification is annoying while you are using your PC and while connected. You can configure Norton Firewall to NOT to notify when Nortons' Intrusion detection blocks connection while autoblock is on.

Does anyone know why my computer has gone from being attacked a few times a day, to hundreds a day? I should also say I've done the Norton security scan, and it says all scans are safe.

You might want to visit http://www.grc.com to check your system if there are open ports.

- Collapse -
A knock on the door.
by r. proffitt Forum moderator Mar 22, 2004 10:58PM PST

What many slowly learn is that such alerts are just a "knock on the door" of the machine and not an attack. An attack, in order to be successful on Windows 98 would have to have a "server" or "trojan" installed on the W98 machine to complete the transaction.

If you don't share the file system with the Internet and don't have a virus/trojan installed, and just one update from Microsoft, the "attack" is not an attack, but a knock on the door.

Anyone home?

Bob

Back to Spyware, Viruses, & Security forum

CNET Forums

Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Brand Forums
Roadshow Autos
Off Topic

Other Forums

Forum Info