[ news_security_news ]
WinCrash Trojan Horse Blocked When Accessing FTP
SecurityProNews
Staff Writer
2006-05-31
 Insider Reports RSS Feed
At WebProWorld, a discussion about Trojan Horse blocking is brewing. One member starts off by telling about Norton blocking one while they updated pages on their FTP.
The discussion begins with lacantina in the thread titled "WinCrash Trojan Horse blocked when accessing FTP". lacantina posts:
For the second time yesterday, while updating webpages on our ftp, I got a message from Norton saying "WinCrash Trojan Horse intrusion attempt blocked"
This has only happened while on our ftp, and it has only happened twice in about a month.
I read up about this trojan and it sounds very evil...so what's going on??
Should I contact our webhost, or what should I do to prevent other crap from getting into my machine via our ftp?
Thanks for your help!
In a later post lacantina writes:
I've contacted our webhost and am waiting for a response. However, could this have something to do with the ports ftp uses...maybe Norton 2006 erroneously detects the ftp itself as a trojan...?
Anyone else had this experience?
The biggest responses so far have come from Jabber_uk who writes:
Here's what you have to do:
1. Go to teh start menu, then control panel, then add remove programs, then click on Norton Anti Virus and click REMOVE. :-)
2. Download a FREE anti virus program like AVG FREE or AVAST FREE and you will then be able to remove the virus.
Sorry for Norton bashing but in my business I/we have dealt with many many PC's and the two most hated programs ever are AOL (1st place) and Norton (2nd).
Then later follows up with:
Is the Trojan running in memory? Is it running as a 'service'? What is the EXE name of the Trojan?
If you know these things, you can go to the RUN box off the Start menu and type in msconfig which opens the Microsoft Configuration Utility. This program allows you to enable/disable programs from starting up when Windows starts.
This process doesn't always work but you can usually stop the program itself from starting by clicking on the Startup tab and finding it in the list - deselect the tick box and reboot. If it is running as a service you can also stop the service from running at startup by clicking on the Services tab and deselecting the service there.
You could start Windows in Safe Mode and rename the file to stop it loading (if you know what it is called).
Running an online virus scanner might help like the one at Trend Micro (http://housecall.trendmicro.com/)
Do you have a firewall on the PC? If so, you can usually disable a specific program from connecting to the internet which might help as a workaround.
Oh and uninstall Norton and put a proper Virus scanning program on! :-) I promise I am not a conspiracy theorist.....
If you have anything to contribute to the conversation, please feel free to do so by visiting the thread and leaving your thoughts.
Tags: WinCrash, Trojan Horse
Add to Del.icio.us | DiggThis | Yahoo! My Web | Furl
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
