Filewall Alert on Bla Trojan Horse?

Question

Hi,I have Symantec Firewall running on a WinXP Pro workstation with Service Pack 2.  Just got this alert message and not sure what it meant.Alert message:Rule "Default Block Bla Trojan horse" blocked (COMPUTER(xx.xx.xx.xxx),1042).Inbound UDP packet.Local address,service is (localhost,1042).Remote address,service is (COMPUTER(xx.xx.xx.xxx),1042).Process name is "N/A".I did a complete virus scan using Norton AntiVirus and it didn't find anything.  I ran SpyBot also and the machine was clean.  Should I be concerned about this alert?  What might have caused this flag?Thanks in advance for your help!Terry

Terry · Accepted Answer

I'd like to add that it seemed like the traffic was from my computer to my computer (same IP address).  Is this a false alarm or is there a trojan horse program running on my machine?Thanks!Terry

Duane Arnold · Answer

*blocked*  worry about it?Duane :)

Duane Arnold · Answer

Terry  wrote innews:     I doubt it and most likely it's false. However, you can look around for yourself with the tools in the link to make a determination. :)

Nomad · Answer

Not to worry. I've seen this also on my system with NPF 2003. Here's a link to Symantec's Knowledge Base that details how to make a rule for the application that's using the same port as the Bla Trojan without interfering with blocking the actual trojan:

formatting link

IPGrunt · Answer

Terry  confessed in news:    A false alarm. No doubt a windows process acking RPC data.That's the problem with these little monitors--they report normal activity malware they blocked and give nubees a false sense of security.Run a full scan if you're worried. Also, get yourself one of these free plugin scanners like Adware SE if you don't have one.-- ipgrunt

Filewall Alert on Bla Trojan Horse?

Join the Discussion

Didn't find your answer?