Firewall blocking inbound traffic from "Trojans", but MBAM does find any

[mjm1]

This is the firewall I use:

http://www.softpedia...wall-Plus.shtml

Give it a try.

Do you have Malwarebytes Pro installed??

MrC

No, but after I get to the bottom of this firewall attack business, I will take a hard look at getting it. I am not happy with Symantec not catching anything, even after full scans. I do realize one can't catch everything -

Seems Symantec firewall has a default rule blocking all of these oddball ports associated with these trojans. Will try to contact them about it.

I'll take a look at your firewall as well. Thanks!

[MrCharlie]

OK, a little clean up to do.

Please Uninstall ComboFix:

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

------------------------------------

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

--------------------------------

Your Java is one update short.

JavaVersion: 1.6.0_30 <--should be 31

In your control panel > Java > Update Tab > Update Now

--------------------------------

I would also suggest you clear out all your temp files and cookies.

You can use OTL to get the temp files:

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following

  
  :Commands
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [resethosts]
  

  
  

• Then click the Run Fix button at the top
  
• Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  
• Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
  

---------------------------

For cookies see link below:

http://support.microsoft.com/kb/278835

-----------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[mjm1]

Ok, done. Firewall got another hit from "Deepthroat" a little while ago, but the attacks/hits/pings seem to be slowing down.

Thanks for all your help, and will report back if/when I find something out, or have questions.

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!