Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Angel Of Death]

Is it normal for windows defender and windows firewall to be disabled about half way through the installer?

[Reudh]

Yes, if it's windows firewall etc. it's disabled.
I haven't recently installed Comodo on a new PC so i don't know, but it should be alright.

[Angel Of Death]

Comodo scan showed up nothing. Am I safe?

[Stargrasper]

No tool is foolproof.  If it shows nothing, then it means there's nothing obvious, not nothing there.  It sounds like you're in a position where you should be vigilant in monitoring your system.

[Svarte Troner]

Those meddling Dutchmen...

[Virex]

Hey normaly it reports my connection as originating from Lelys... You saw nothing!

[nenjin]

Are you using a router? You might want to check your router settings, make sure the firmware is up to date, ect....

[Virex]

If you're a router you could just outright ban those IPs too, though that won't plug any leaks that he may have used to make a connection.

[Angel Of Death]

2012/01/05 01:44:30 +1030   ACOMP   A.Dude   IP-BLOCK   94.100.30.166 (Type: outgoing, Port: 57542, Process: iexplore.exe)
2012/01/05 13:12:40 +1030   ACOMP   A.Dude   MESSAGE   Starting protection
2012/01/05 13:12:43 +1030   ACOMP   A.Dude   MESSAGE   Protection started successfully
2012/01/05 13:12:46 +1030   ACOMP   A.Dude   MESSAGE   Starting IP protection
2012/01/05 13:12:47 +1030   ACOMP   A.Dude   MESSAGE   IP Protection started successfully
2012/01/05 14:16:49 +1030   ACOMP   A.Dude   IP-BLOCK   77.247.179.135 (Type: outgoing, Port: 51155, Process: iexplore.exe)
2012/01/05 14:16:49 +1030   ACOMP   A.Dude   IP-BLOCK   77.247.179.135 (Type: outgoing, Port: 51161, Process: iexplore.exe)
2012/01/05 15:07:07 +1030   ACOMP   A.Dude   IP-BLOCK   91.197.128.225 (Type: outgoing, Port: 52407, Process: iexplore.exe)

Again. I only have Youtube, B12 and Whalesdev up. What should I do?

[alway]

Try using Wireshark, and when it detects and blocks something, search that IP in the data you collected; won't give anything definitive probably, but it would at least be interesting to see what's coming in and may help determine the nature of what's going on.

My guess would be you have some sort of torrent or something, as the retry times when the attempts failed appear automated and the times aren't the sort of even on-the-hour time I would expect from a fully automated system like a botnet; though I may be wrong, as that's pretty far from my area of expertise.

As for non-academic tips... Try closing all internet explorer windows and open up task manager. Check to see if iexplore.exe is in the processes list; if it is, you have a virus masquerading as internet explorer; if not, it's probably just some internet explorer quirk which may or may not be anything malicious.

[Angel Of Death]

Will Wireshark fuck around and conflict with my virus scanners?

[alway]

Before you do that, try the other advice I added at the bottom of my post; wireshark is more a curiosity thing than actually helpful. If you don't have a, iexplore.exe virus, it's probably harmless, but worth peeking at with wireshark to potentially figure out what is going on. if only to satisfy curiosity.

[Reudh]

Oh, that reminds me. Update your computer to the latest to patch all the holes they've found so far, assuming you're on a windows PC.

[Stargrasper]

While you can't remove IE, you can disable it from the control panel.  Try that.  Assuming that's where the vulnerability is, that could handle it.

http://www.howtogeek.com/howto/2734/uninstall-disable-delete-internet-explorer-8-from-windows-7/

[Angel Of Death]

It appears as if the alerts are coming from Whalesdev. It only seemed like it was from B12 because my scanner was terminating Whalesdev.