Windows XP trojan horses and hacker attacks

Joined
Feb 5, 2003
Messages
127
Reaction score
0
I have just checked my computers security at Norton Security Check - Symantec and it stated that I was at threat from trojan horses and vulnerable to hackers.

I am running Zone Alarm - freebie and Norton Anti Virus 2001 V7.

Is there any reason why with this system up and running on Win 98SE I am at risk.

Could the test be getting done on my ISP rather than my computer? I beleive Freeserve use proxys even if you don't set one on your browser.
 

Ian

Administrator
Joined
Feb 23, 2002
Messages
19,873
Reaction score
1,499
Do you know the details that the website gave you about the problems?

If you have ZoneAlarm, not much can get past that when properly configured.
 
Joined
Feb 5, 2003
Messages
127
Reaction score
0
Hi Ian thank you for the quick response here is the results that are causing concern


More about your Hacker Exposure Check results

The Hacker Exposure Check tests whether ports commonly used by Internet applications are open, closed, or stealth
Understanding your results:

An open port responds to port probes and acknowledges the port's availability. Open ports are dangerous because they're an easy and attractive means of entry for hackers.


A closed port is visible but not open to attack. Although this is a safe state, a hacker can use closed ports to detect the existence of your computer and potentially target it for attack.

A stealth port is safest of all. Stealth means your computer doesn't respond to port probes and you are virtually invisible to hackers scanning the Internet for potential targets. Although this is a very safe result, a stealth port may cause performance problems for some Internet applications.


Your Results:
Port Description Status

ICMP Ping Ping. Ping is a network troubleshooting utility. It asks your computer to acknowledge its existence. If your computer responds positively to a ping, hackers are more likely to target your computer. OPEN


21 FTP (File Transfer Protocol). FTP is used to transfer files between your computer and other computers. Port 21 should be open only if you're running an FTP server. STEALTH


22 SSH. TCP connections to this port might indicate a search for SSH, which has a few exploitable features. SSH is a secure replacement for Telnet. The most common uses of SSH are to securely login and copy files from a server. STEALTH


23 Telnet. Telnet can be used to log into your computer from a terminal anywhere in the world. This port should be open only if you're running a Telnet server. OPEN


25 SMTP (Simple Mail Transfer Protocol). A protocol for host-to-host mail transport. This port should be open only if you're running a mail server. STEALTH


79 Finger. Finger is an Internet utility that allows someone to obtain information about you, including your full name, logon status, and other profile information. STEALTH


80 HTTP (Hypertext Transfer Protocol). HTTP is used to transfer Web pages over the Internet. Port 80 should be open only if you're running a Web server. OPEN


110 POP3 (Post Office Protocol). Internet mail servers and mail filter applications use this port. This port should be open only if you're running a mail server. STEALTH


113 Ident / Authentication. This service is required by some mail, news, or relay chat servers to allow access. A stealth result on this port could cause performance problems.
STEALTH

119 NNTP (Network News Transfer Protocol). A service used by News servers to distribute Usenet articles to newsreader applications and between other servers. STEALTH


135 Location service (loc-srv). This port is used to direct RPC (Remove Procedure Calls) services to the appropriate dynamically mapped ports. Hackers can use this to determine which port is used by several Windows services. This port should not be visible from the Internet. STEALTH


139 NetBIOS. NetBIOS is used for Windows File & Print sharing. If port 139 is open, your computer is open to sharing files over the Internet. Other components of NetBIOS can expose your computer name, workgroup, user name, and other information. To learn more about preventing connections to your NetBIOS ports, see: NetBIOS Information and Configuration Instructions STEALTH


143 IMAP (Internet Message Access Protocol). IMAP is a sophisticated protocol for electronic mail delivery. This port should be open only if you're running an IMAP server. STEALTH


443 HTTP over TLS/SSL. A protocol for providing secure HTTP communication. It should be open only if you're running a Web server. STEALTH


445 Windows NT / 2000 SMB. A standard used to exchange Server Message Blocks, and can be exploited in multiple ways, including gaining your passwords. STEALTH


1080 SOCKS. This protocol allows computers access to the Internet through a firewall. It is used when one IP address is shared among several computers. Generally this protocol only allows access out to the Internet. However, it is frequently configured incorrectly to allow hackers to pass traffic inwards through the firewall. STEALTH


1723 PPTP (Point-to-Point Tunneling Protocol). This service is used for virtual private networking connections. STEALTH


5000 UPnP (Universal Plug and Play). This service is used to communicate with any UPnP devices attached to your network. STEALTH


5631 pcAnywhere. This port is used by Symantec pcAnywhere when in host mode. CLOSED
 
Joined
Dec 7, 2003
Messages
1,281
Reaction score
0
newbuilder,

if your using zone labs firewall and then you run a symantec test do you not think it's likely that symantec are going to try and make other firewall apss look bad??

just a thought!

looking at your results below the only one's i would be concerned about is the telnet and ping ports, some ports need to be open for your computer to function correctly for example you wouldn't be able to view webpage without the http port (usually port 80) open, but this doesn't mean it can't be monitored. going with what ian said zone alarm is generally as good as any other firewall for home single pc use (not networked) as long as the firewall is configured correctly.

James
 
Joined
Feb 5, 2003
Messages
127
Reaction score
0
I have Zalarm configured as high on trusted and internet and automatic configuratioon of programs.

When doing the test on my brothers computer with NAV2004 and ZA Pro the test show no security issues.

The adapter subnet for the PPP Adapter is set to internet and NOT trusted. is this correct?
 
Joined
Dec 7, 2003
Messages
1,281
Reaction score
0
depends

and when i say configured, imean the port settings, and i'm not sure how indepth the free version is.

i'm sure someone else in here will!
 

muckshifter

I'm not weird, I'm a limited edition.
Moderator
Joined
Mar 5, 2002
Messages
25,739
Reaction score
1,204
Norton is trying to scare you into buying their product ... your safe with ZA free.

Go to SheildsUp and test your system there. ;)
 
Joined
Feb 5, 2003
Messages
127
Reaction score
0
Thanks Muckshifter, I passed alltests on that site- stealthed them- now who do I believe? mmmmmmm
 

Ian

Administrator
Joined
Feb 23, 2002
Messages
19,873
Reaction score
1,499
I'd got for ShieldsUp ;) That is a really good site!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top