1. Home
  2. Networking Firewalls
  3. Filewall Alert on Bla Trojan Horse?

Filewall Alert on Bla Trojan Horse?

Hi,

I have Symantec Firewall running on a WinXP Pro workstation with Service Pack 2. Just got this alert message and not sure what it meant.

Alert message:

Rule "Default Block Bla Trojan horse" blocked (COMPUTER (xx.xx.xx.xxx),1042). Inbound UDP packet. Local address,service is (localhost,1042). Remote address,service is (COMPUTER(xx.xx.xx.xxx),1042). Process name is "N/A".

I did a complete virus scan using Norton AntiVirus and it didn't find anything. I ran SpyBot also and the machine was clean. Should I be concerned about this alert? What might have caused this flag?

Thanks in advance for your help!

Terry

Reply to
Terry
Loading thread data ...

I'd like to add that it seemed like the traffic was from my computer to my computer (same IP address). Is this a false alarm or is there a trojan horse program running on my machine?

Thanks!

Terry

Reply to
Terry

*blocked*
formatting link
Why worry about it?

Duane :)

Reply to
Duane Arnold

Terry wrote in news: snipped-for-privacy@news.tc.umn.edu:

I doubt it and most likely it's false. However, you can look around for yourself with the tools in the link to make a determination.

formatting link
Duane :)

Reply to
Duane Arnold

Not to worry. I've seen this also on my system with NPF 2003. Here's a link to Symantec's Knowledge Base that details how to make a rule for the application that's using the same port as the Bla Trojan without interfering with blocking the actual trojan:

formatting link

Reply to
Nomad

Terry confessed in news: snipped-for-privacy@news.tc.umn.edu:

A false alarm. No doubt a windows process acking RPC data.

That's the problem with these little monitors--they report normal activity malware they blocked and give nubees a false sense of security.

Run a full scan if you're worried. Also, get yourself one of these free plugin scanners like Adware SE if you don't have one.

-- ipgrunt

Reply to
IPGrunt

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.