iNi Killer Trojan

[justashooter 430]

I'm not a net guru, but I think there is a problem with a trojan on this site. After opening 20 or so pages on other sites this morning I opened a page on this site, and the firewall gave a pop-up warning that it had blocked the iNi Killer Trojan.

Some guru might explain how this works?

I am on a China IP in a residential hotel, if that makes any difference.

[justashooter 430]

running symantec client security

details:

protocol: TCP inbound

remote address: 202.109.80.181:6000

local address 61.54.66.XXX:9989

"a remote computer (202.109.80.181) attempted to connect to your computer on a port commonly used by a remote access trojan horse. the attempt was blocked."

[Captain Ewok 1,871]

Not on our end. However you may want to see if you have any spyware or other items installed. I suggest trying the free version of adaware to find these items .

[Captain Ewok 1,871]

The IP you listed is in China if this helps you:

inetnum: 202.109.0.0 - 202.109.127.255

netname: CHINANET-SH

descr: CHINANET Shanghai province network

descr: Data Communication Division

descr: China Telecom

country: CN

admin-c: CH93-AP

tech-c: XI5-AP

mnt-by: APNIC-HM

mnt-lower: MAINT-CHINANET-SH

status: ALLOCATED PORTABLE

changed: **********@apnic.net 20041210

source: APNIC

person: Chinanet Hostmaster

nic-hdl: CH93-AP

e-mail: *********@ns.chinanet.cn.net

address: No.31 ,jingrong street,beijing

address: 100032

phone: +86-10-58501724

fax-no: +86-10-58501724

country: CN

changed: ******@cndata.com 20070416

mnt-by: MAINT-CHINANET

source: APNIC

person: Wu Xiao Li

address: Room 805,61 North Si Chuan Road,Shanghai,200085,PRC

country: CN

phone: +86-21-63630562

fax-no: +86-21-63630566

e-mail: ********@mail.online.sh.cn

nic-hdl: XI5-AP

mnt-by: MAINT-CHINANET-SH

changed: ********@mail.online.sh.cn 20010510

source: APNIC

[justashooter 430]

thanks for doing the whosis. i have a few friends in shanghai. maybe i should have one of them stop by and straighten this guy out. could be he has some program that randomly attacks IP addresses. china's net is a mess.

[EZgoing378 0]

Sorry for this double post, I tried to use the editor on the previous post and failed miserably so this is what I hoped to say:

I get traffic like that all the time. Those are people that are just randomly scanning computers with well known trojan horses on them in places where those Trojan horses are likely to be accessible. It is called a port scan. If you want to read about port scans and other computer security GibsonResearchCorperation is a good place to go. Thank God for firewalls. I started getting so many port scans from people poking around in the dark, I silenced the warnings and just look at the log from time to time for threats that are rated high.

Mod, could you please remove my sorry attempts at using the editor. I apologize.