Incoming Worm when starting Fax Console

[CGB]

When I start my Fax Console (Microsoft Fax Console, ver. 5.1, build
2600.xpsp2.040919-1003:service pack 1) that came with my windows XP home
edition, SP1, I get two messages I would like clarified, one from Zone Alarm
(I click deny) and the other from my Norton antivirus (I click OK, I think
this means OK, I got the msg, not OK let it in!! ). It seems the fax
console may be functioning afterward, don't know, no incoming faxes to tell
if it's working. If I close the fax console and reopen, no warnings on
reopening but the warnings come each time I first start the fax console
after a re-boot of the computer.



Zone Alarm pops up and says:

Windows Explorer is trying to act as a server

Application: Explorer.exe

Source IP: 0.0.0.0: Port 1024



And, my Norton antivirus pops up and tells me a worm is trying to access my
system with the following message:



Default Block Netspy Trojan Horse

Date: 4/12/05

Time: 10:33 AM (or whatever time I am using the program)

Path: C:\windows\explorer.exe

Filename: Windows Explorer

Direction: Inbound

Local Address: all local network adapters

Local Port: 1024

Protocol: TCP



My computer is clean, according to scans by Norton antivirus, Adaware,
Spybot, CWShredder, all current programs with current updates.



Is this all a reflection of the fact that my computer, to receive faxes, has
to operate as a server? Where is the "worm" coming from?
Recommendations/explanations appreciated. I've sent and received faxes
before, months ago, but don't remember these warnings appearing.



Chet

 

[Guest]

Tell Norton to quarantine it.
My one suggestion is to get and install WindowsXP SP2 immediately. You
are leaving yourself wide open for this type of action.
Order Windows XP Service Pack 2 on CD
http://www.microsoft.com/windowsxp/downloads/updates/sp2/cdorder/en_us/default.mspx

 

[CGB]

Understand recommendaton re: SP2. Will do.
But, I really wonder if it is a worm. Norton is catching it but is it
perhaps a normal function of the Fax module? It would seem coincidental
that every time I start the fax module, the computer is getting attacked by
a worm.

Chet

 

[Russ Valentine [MVP-Outlook]]

Hard to say for sure, but Norton's AV and Internet Security programs are
notorious for disabling various Fax Service functions.

 

[CGB]

Thanks.
I have my suspicions re: whether it's for real. I'm not going to mess
around with it, but I wouldn't be surprised if it's a false positive.
The advice on SP2 is well taken, I've been waiting til they get to SP2b!
Chet

 

[Hal Hostetler [MVP-S/U]]

For the "Default Block Netspy Trojan" problem, see the following:

http://service1.symantec.com/SUPPOR...713afacbd4135e0a88256c77007e526f?OpenDocument
Error: "Rule Default Block Netspy Trojan Horse Matched" when you start the
computer

Zone Alarm may be having a similar issue.

Hal
--
Hal Hostetler, CPBE -- (e-mail address removed)
Senior Engineer/MIS -- MS MVP-S/U -- WA7BGX
http://www.kvoa.com -- "When News breaks, we fix it!"
KVOA Television, Tucson, AZ. NBC Channel 4
Still Cadillacin' - www.badnewsbluesband.com

 

[Mike Hall \(MS-MVP\)]

There will be no SP2b..

--
Mike Hall
MVP - Windows Shell/user

Thanks.
I have my suspicions re: whether it's for real. I'm not going to mess
around with it, but I wouldn't be surprised if it's a false positive.
The advice on SP2 is well taken, I've been waiting til they get to SP2b!
Chet

 

[CGB]

Yep, from reading the links, I think it is a false alarm. I'll tailor NAV
to ignore this and I'll set ZoneAlarm firewall to ask me permission to "act
as a server" when using the fax module.
Apparently I'm not the first to discover this problem!

Thanks.
Chet