HTTP Neosploit Toolkit Activity blocked by Norton, but says source is my computer!

[TJX]

I was browsing a forum on IE8 when I got an intrusion attempt alert for something called "HTTP Neosploit Toolkit Activity". It shows my computer as the the Attacking Computer and the source address to that of my internal I.P. (192.168.199). The Attacker URL and destination address was something completely different from the website I was browsing - kasefe.info/page/best.php (74.118.192.209, 80).

Norton 360 was able to block it and said I required no further actions. But should I be concerned that it shows myself as the attacking computer?

Ran an MBAM scan and found nothing -

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4216

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/19/2010 5:49:17 PM

mbam-log-2010-06-19 (17-49-17).txt

Scan type: Quick scan

Objects scanned: 135832

Time elapsed: 15 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Am I safe?

One other thing I'd like to note, so fare there has been no performance problems with my computer nor am I being redirected to malicious websites when clicking on search engine links like Google. I have not had any alerts since that day.

[crysty2k5]

That site is infected:

http://safeweb.norton.com/report/show?name=kasefe.info

http://www.malwareurl.com/listing.php?domain=kasefe.info

Download

Malwarebytes Anti-Malware 1.46

Update/Run Malwarebytes

Double Click the Malwarebytes Anti-Malware icon to run the application.

• Click on the update tab then click on Check for updates.
  
• If an update is found, it will download and install the latest version.
  
• Once the update has loaded, go to the Scanner tab and select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

[TJX]

Malwarebytes was already updated to 1.46 since my first post. Ran another update, then ran a full scan. No malicious files found.

Database version: 4239

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/25/2010 5:03:25 PM

mbam-log-2010-06-25 (17-03-25).txt

Scan type: Full scan (C:\|F:\|)

Objects scanned: 332257

Time elapsed: 2 hour(s), 16 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[crysty2k5]

Yap.

Run a full scan with Norton. Make sure that Norton and Windows is up-to-date

[TJX]

Done and done. No threats found. So am I clean? How did the threat come from my computer in the first place?

Someone on the Norton forums suggested that I might have a rootkit, but I am not experiencing anything like a rootkit infection like google redirects or strange pop ups. What do you think?

[crysty2k5]

Let's see...

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Unplug your network cable/modem or deactivate the Wi-Fi connection.
  
• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Plug in you network cable/modem or activate the Wi-Fi connection. Please include the C:\ComboFix.txt in your next reply.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!