Google Answers Logo
View Question
 
Q: Trojan Computer attacks ( Answered 4 out of 5 stars,   1 Comment )
Question  
Subject: Trojan Computer attacks
Category: Computers > Security
Asked by: whighamchem-ga
List Price: $10.00
Posted: 21 Sep 2003 12:18 PDT
Expires: 21 Oct 2003 12:18 PDT
Question ID: 258848
I have Norton Firewall and Antivirus.  I am getting frequent messages
that indicate a Trojan attack by Backdoor/Subseven.  The inclusion
window gives an IP address such as 80.48.133.194 with a sugestion that
I identify this by "Visual Tracking".  How do I do that?  What does
this mean?
Answer  
Subject: Re: Trojan Computer attacks
Answered By: sublime1-ga on 21 Sep 2003 13:11 PDT
Rated:4 out of 5 stars
 
whighamchem...

If you have Norton Firewall 2003, it comes with a feature
which allows you to trace the address geographically, on
a map, as noted in this review on PCWorld:

"A related new function, Visual Tracking, identifies the
 geographic location of suspected intruders, based on their
 IP addresses."
http://www.pcworld.com/news/article/0,aid,104931,00.asp

Another review on the UK site, ITReviews, notes how this
can be helpful in reporting an attacker to their ISP:

"Linked to the firewall is Norton's Intrusion Detection,
 which can be set to inform you of attacks on your PC.
 Although they should be blocked by the firewall, you may
 want to take action against an attacker, by reporting
 their IP address to their ISP. This is helped by a
 function called Visual Tracking, which can zero in on
 the geographical location of a given address and show
 you it on a map of the world."
http://www.itreviews.co.uk/software/s188.htm


As for using this feature, an article on BroadbandReports
indicates that when you activate the feature (I couldn't
find documentation on line as to how to do so, but it must
be available to you in the program's help file), it opens
a browser window and connects to a Norton website which
performs a 'traceroute' function on the IP address of the
attacker. The forum members seem to agree that the Norton
site is often slow and unresponsive, producing a blank
page more often than a map. The website uses a java program,
so you have to have java enabled in your browser, but even
so, many people get the blank page rather than a map.

One forum member suggests using NeoTrace, which performs 
the same function. I have this program, and can perform
a visual tracking on the address if you'd like, but be
aware that some addresses do not resolve to a geographic
location. More on the page:
http://www.broadbandreports.com/forum/remark,6164420~root=sware~mode=flat


You can also utilize a site like SamSpade.org to do a
traceroute for you. Just plug the IP address into the
box next to the button that says 'Traceroute', and click:
http://www.samspade.org/


Even if you do nothing, your firewall will still block
the attacks, so there's nothing to worry about. The
mosquito will eventually give up banging into the 
screen door and go away. If you choose to follow up
by reporting the attacker to his Internet Service
Provider, there are alternatives to the feature
offered by Norton.

Please do not rate this answer until you are satisfied that
the answer cannot be improved upon by means of a dialog
established through the "Request for Clarification" process.

sublime1-ga


Searches done, via Google:

"visual tracking
://www.google.com/search?q=%22visual+tracking

"visual tracking" trojan
://www.google.com/search?q=%22visual+tracking%22+trojan

"visual tracking" "Norton firewall"
://www.google.com/search?q=%22visual+tracking%22+%22Norton+firewall%22

"Norton Firewall 2003" documentation
://www.google.com/search?q=%22Norton+Firewall+2003%22+documentation

"Norton Firewall 2003 documentation"
://www.google.com/search?q=%22Norton+Firewall+2003+documentation%22

"Norton Firewall 2003" "visual tracking"
://www.google.com/search?q=%22Norton+Firewall+2003%22+%22visual+tracking%22
whighamchem-ga rated this answer:4 out of 5 stars
Very good on Visual Tracking.  Nothing said about backdoor/subseven.

Comments  
Subject: Re: Trojan Computer attacks
From: sublime1-ga on 22 Sep 2003 17:59 PDT
 
whighamchem...

Your question did not include any queries regarding backdoor/subseven,
only this statement of fact:

"I am getting frequent messages that indicate a Trojan attack by
Backdoor/Subseven."

I did indicate that, since your firewall is still working, there
is no reason for concern, regardless of the nature of the attack.

In the future, realize that you can request clarification if there
is any information you feel is needed in addition to what is given
in the answer. This is done before rating, and thus expiring, the
question. A user's guide to assist you with this is available here:
http://www.christopherwu.net/google_answers/answer_guide.html

Best regards...

sublime1-ga

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy