Whats Going On? Virus?

[Chris Dryson]

This is starting to get annoying can anyone explain what is going in or how
to cure it? I am running Windows XP SP2 Home, on an internal network (with 2
other machines) through a Dell router to a cable modem. I have ZoneAlarm
(the freebie version as the Pro licence has expired) and Norton Antivirus.
Symptoms are:

1. Every so often zonealarm tells me
"Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port 445]"
(Which seems to correspond to a plausible local site here in Cambridge UK
which I may well have visited once)

2. The same address appears on "My Network places" and generates the
zonealarm message if I click on it.

3. If I try and do a full system scan with Norton Antivirus it hangs at
D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on c97.e2bn.net

I'm also disturbed to note that although I keep turning my Windows Firewall
on (Via control panel/windows firewall) I keep discovering that it is turned
off....

Help anyone?

 

[Jim]

This is starting to get annoying can anyone explain what is going in or
how to cure it? I am running Windows XP SP2 Home, on an internal network
(with 2 other machines) through a Dell router to a cable modem. I have
ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
Antivirus. Symptoms are:

1. Every so often zonealarm tells me
"Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
445]"
(Which seems to correspond to a plausible local site here in Cambridge UK
which I may well have visited once)

It may be plausible, but someone may be using it as a waystation.

2. The same address appears on "My Network places" and generates the
zonealarm message if I click on it. A bad sign

3. If I try and do a full system scan with Norton Antivirus it hangs at
D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
c97.e2bn.net Another bad sign

I'm also disturbed to note that although I keep turning my Windows
Firewall on (Via control panel/windows firewall) I keep discovering that
it is turned off....

It should be turned off if you are also using ZoneAlarm.

Help anyone?

Check your system with at least Adaware and Spybot. It seems most likely
that you have a virus.
Jim

 

[Yves Leclerc]

Spybot and AD Aware do not do viruses. These take care of "spywares". The
program "c97.e2bn.net" seems to be behaving like a "spyware"/"trojan" and
"phoning" home.

This is starting to get annoying can anyone explain what is going in or
how to cure it? I am running Windows XP SP2 Home, on an internal network
(with 2 other machines) through a Dell router to a cable modem. I have
ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
Antivirus. Symptoms are:

1. Every so often zonealarm tells me
"Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
445]"
(Which seems to correspond to a plausible local site here in Cambridge UK
which I may well have visited once)

It may be plausible, but someone may be using it as a waystation.

2. The same address appears on "My Network places" and generates the
zonealarm message if I click on it. A bad sign

3. If I try and do a full system scan with Norton Antivirus it hangs at
D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
c97.e2bn.net Another bad sign

I'm also disturbed to note that although I keep turning my Windows
Firewall on (Via control panel/windows firewall) I keep discovering that
it is turned off....

It should be turned off if you are also using ZoneAlarm.

Help anyone?

Check your system with at least Adaware and Spybot. It seems most likely
that you have a virus.
Jim

 

[LQQkIE YONDER]

This is starting to get annoying can anyone explain what is going in or
how to cure it? I am running Windows XP SP2 Home, on an internal network
(with 2 other machines) through a Dell router to a cable modem. I have
ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
Antivirus. Symptoms are:

1. Every so often zonealarm tells me
"Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
445]"
(Which seems to correspond to a plausible local site here in Cambridge UK
which I may well have visited once)

It may be plausible, but someone may be using it as a waystation.

2. The same address appears on "My Network places" and generates the
zonealarm message if I click on it.

A bad sign

3. If I try and do a full system scan with Norton Antivirus it hangs at
D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
c97.e2bn.net

Another bad sign

I'm also disturbed to note that although I keep turning my Windows
Firewall on (Via control panel/windows firewall) I keep discovering that
it is turned off....

It should be turned off if you are also using ZoneAlarm.

Help anyone?

Check your system with at least Adaware and Spybot. It seems most likely
that you have a virus.
Jim

Go to bleepingcomputer.com and go to the Hijack This section of the
forum board. It's been a big help to me.

 

[Chris Dryson]

FWIW a colleague points out that it is behaving as if there is a remote
network disk mounted at c97.e2bn.net....