1. Home
  2. Networking Firewalls
  3. chatty wab

chatty wab

I have recently replaced Zonealarm with a copy of Sygate Personal Firewall. Today it stopped wab.exe, the XP addressbook applet, from attempting an outgoing connection to aus.mozilla.org via Firefox (my default browser). I usually use the Thunderbird addressbook but had opened wab to check an old address.

Is this normal behaviour for wab? Sygate labelled it as "application hijacking" and I wonder is some email virus or Trojan is at work. Avast antivirus reports nothing but a scan with antivir did find a "trace" of a virus in one of my Java files. I let antivir delete the file and all seems to be running fine.

Reply to
hetzer
Loading thread data ...

It is probably not a virus or trojan. Anytime one of your valid applications causes another of your valid applications to connect to internet, Sygate recognizes it as a hijacking. The Sygate warning window ususlly tells you what is happening and lists the two applications. Casey

Reply to
Casey Klc

Thanks for your prompt reply, Casey! I am somewhat reassured, though I shall also be keeping an eye on wab.exe's ins & outs!

Reply to
hetzer

I share your concern on this issue. While the file appears to be a legitmate MS file, I'd be concerned why it's "calling home." I use Sygate with XP and have never seen this issue. I did a quick search and did not find anything to help. I'd suggest some additional research.

Reply to
Anonymous

I found this information, which might be of some help. I would at the least look for a removal tool for this worm and follow the guidance on this site to see if the registry has been compromise.

formatting link
Good luck.

Reply to
Anonymous

Thank you for the URL. Sorry for not replying sooner but I have been elsewhere engaged. So far no signs of infection in Registry etc Like you I wonder what business wab.exe has in contacting aus.mozilla.org with Firefox!!?? Unless I specifically tell it to do so for some reason, wab.exe should not be making internet calls at all!! I do not consult or keep any data on MSN or any other Internet data bases, address books etc. hetzer

Reply to
hetzer

aus.mozilla.org is where Firefox searches for updates.

See:

formatting link
formatting link
I do not have the XP addressbook applet, so I am not sure what it is calling Firefox for, but as Firefox is your default browser, I would not be surprised to see it attempt to contact aus.mozilla.org.

david

Reply to
david

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.