Tom's Guide | Tom's Hardware | Tom's Games

Computing.Net > Forums > Security and Virus > Virus or Backdoor?

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Virus or Backdoor?

Reply to Message Icon

Name: saxofun
Date: February 23, 2004 at 11:44:21 Pacific
OS: Windows 2000 Pro
CPU/Ram: Intel 256 Mg
Comment:

Hi,

Since I have installed Kerio Personal Firewall 4.0, I have denied the UDP on port 53 in inbound and outbound.

Then, while surfing on the net, I am frequently receiving kerio's alerts (often by block of 8) telling me that Services and Controller App (c:\winnt\system32\services.exe) as been blocked in outbound on various ports (1039, 1799, 1807, 1892, 1926, 1905) but always at the same IP address 207.236.176.28:domain !!!

I even receive those alerts while opening a windows sessions!!!!

If it is just a backdoor, it's ok, I am blocking it.
But if it is a virus, I could eradicate it by erasing the files and/or keys that run this process. But which virus would it be?

My AntivirusKitPro12 doesn't detect any virus, but as it is a trial version, i am not sure it is fully reliable and I don't want to change it yet, as I am testing it...

What do you think of it? Could it be a virus? If so, which one?
Thanks for your help!



Sponsored Link
Ads by Google

Response Number 1
Name: Tank863
Date: February 23, 2004 at 18:22:11 Pacific
Reply:

The IP Address comes back to:

OrgName: Bell Canada
OrgID: LINX
Address:
City: Toronto
StateProv: ON
PostalCode: K1G-3J4
Country: CA

NetRange: 207.236.0.0 - 207.236.255.255
CIDR: 207.236.0.0/16
NetName: BELLGLOBAL-2
NetHandle: NET-207-236-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.BELLGLOBAL.COM
NameServer: NS2.BELLGLOBAL.COM
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1996-10-28
Updated: 2000-05-26

TechHandle: PD135-ARIN
TechName: Daoust, Philippe
TechPhone: +1-800-450-7771


OrgTechHandle: SYSAD1-ARIN
OrgTechName: Sys Admin
OrgTechPhone: +1-613-785-0886


# ARIN WHOIS database, last updated 2004-02-22 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

Is that your ISP? Is that your IP address?
You can check your own IP address by clicking Check your IP

What is services.exe?

Services - services.exe - Process Information

Process File: services or services.exe
Process Name: Windows Service Controller
Description: Application that is used only in Windows NT 4, 2000, and XP for starting, stopping, and interacting with system services.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

It is a needed service according to MS..

Tank863
What the heck is:

0
Reply to Message Icon

Related Posts

See More



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links
Ads by Google


Results for: Virus or Backdoor?
Backdoor Virus
    Summary: Thanks. And is there any way you can get a virus or backdoor trojan simply by clicking on a URL? ...
www.computing.net/answers/security/backdoor-virus/10889.html

Annoying virus or worm
    Summary: After mass infection of viruses and whatever (Jeefo the main infection)and reformatting of hard drive as well as FDISK /MBR to gain access to drive, still had to reformat a couple of times as XP becam...
www.computing.net/answers/security/annoying-virus-or-worm/6729.html

Cannot start-up XP - virus or not?
    Summary: Hi Folks, I need help. My brother was browsing some free music download site yesterday and the monitor of our home pc suddenly went garbled and turned into a multicoloured mess. On re-start, 2 horizon...
www.computing.net/answers/security/cannot-startup-xp-virus-or-not/19253.html