Norton Internet Worm Protection

OldDog2006 · 07-28-2006, 10:44 PM

Norton Internet Worm protection keeps popping up alerts that it has "blocked an intruder" and gives me the number of the intruder - i.e.64.222.22.41(4120). Is there anyway I can find out who these "intruders" are and where they are originating from ???

At least 10 - 20 intrusions a day are blocked. I have a suspicion that a relative of mine has may be behind at least some of these, is that possible ???

Also, every 4 months or so my computer is "infected" with viruses even though I have a firewall and run: Norton Anti-Virus 2006 (live update, check for new virus definitions and run a full system scan a.m. and p.m.), Yahoo Anti-Spy, AdAware and Spybot religiously EVERY day.

I really am literally an "old dog" learning new tricks every day where the computer is concerned so any help you can provide would be greatly appreciated!:

dorts · 07-29-2006, 12:19 AM

Hi,

Most likely you have spyware/malware/trojans on your computer.

Here is some info of the Ip address. http://www.dnsstuff.com/tools/ipall....n=64.222.22.41

Please follow the instructions here and post a HijackThis Log in the HijackThis Logs forum.

OldDog2006 · 07-29-2006, 09:09 AM

Thanks for the reply, but this is all Greek to me. My concern was not about how to remove the worm, virus, etc. I've taken the computer to my local service center and they've done that already.

My desire is to track down where these are coming from by the IP addresses which Norton gives as the "attackers" in their alerts. Is there any service I can use to trace these IP addresses to their sources?

BBF2530 · 07-29-2006, 09:43 PM

Hi OldDog2006. First, to answer your questions:

Yes, you can try to find who the "intruders" are. Is it worth the time or effort, no.

Is it possible that it is relatives of yours? Yes, it is possible. However, it is not very probable.

Please forgive my bluntness, but you are not an employee of the FBI, NSA, CIA, or other highly classified government organization (or are you,

), so what are you worried about? As you said, you are an old dog, learning new tricks, so ignore this stuff, and just sleep easier at night.
Your computer, like any connected system, will be "probed" constantly.

When you say you have been infected by viruses, I have the feeling that you are misinterpreting the warnings from your AntiVirus software. My thoughts are, it is telling you it blocked/repaired/deleted a virus/worm/trojan. This is not the same as being infected.

OldDog, I may be even older than you, so take my advice. How does the old saying go? Don't sweat the small stuff? You have a better chance of hitting the lottery, than of having someone (relative or not) hacking into your computer. These probes are just part of being on the Internet.

Relax, and good luck.

ohlab · 10-16-2006, 11:28 PM

I have AOL, and use the AOL Safety & Security System, but keep getting the message "Norton Internet Worm Protection" duplicate firewall. I have no Norton on my computer anymore. How can I get rid of this message?

**PanamaGal** · 10-21-2006, 01:50 AM

I think Norton is more the worm than most worms. You may have to remove the Symantec registry keys to get rid of the message.

JohnthePilot · 10-21-2006, 06:16 AM

Hi Old Dog,
From another "Old Dog", if you are really worried about these, you could try McAfee Personal Firewall. I get several hundred attempts a day to "attack" my machine. McAfee lets you trace these as shown below.

This shows the attacks over a six minute period

This shows graphically where the attack originated

This shows the originator of the attack - often quite harmless. My own ISP frequently pings my machine as a security check.

This gives a more detailed account of the originator

I just ignore them, happy in the knowledge that my firewall is blocking them.
Hope this helps to put your mind at rest.
Regrds,
Pilot.

07-28-2006, 10:44 PM	#1 (permalink)
OldDog2006 Registered User Join Date: Jul 2006 Posts: 2 OS: XP	Norton Internet Worm Protection Norton Internet Worm protection keeps popping up alerts that it has "blocked an intruder" and gives me the number of the intruder - i.e.64.222.22.41(4120). Is there anyway I can find out who these "intruders" are and where they are originating from ??? At least 10 - 20 intrusions a day are blocked. I have a suspicion that a relative of mine has may be behind at least some of these, is that possible ??? Also, every 4 months or so my computer is "infected" with viruses even though I have a firewall and run: Norton Anti-Virus 2006 (live update, check for new virus definitions and run a full system scan a.m. and p.m.), Yahoo Anti-Spy, AdAware and Spybot religiously EVERY day. I really am literally an "old dog" learning new tricks every day where the computer is concerned so any help you can provide would be greatly appreciated!:

07-29-2006, 12:19 AM	#2 (permalink)
dorts Analyst, Security Team Join Date: Mar 2006 Location: Singapore Posts: 1,599 OS: Windows XP SP2 My System	Hi, Most likely you have spyware/malware/trojans on your computer. Here is some info of the Ip address. http://www.dnsstuff.com/tools/ipall....n=64.222.22.41 Please follow the instructions here and post a HijackThis Log in the HijackThis Logs forum. __________________ If you think TSF have helped you, please kindly donate to TSF and help keep this site free to all.

07-29-2006, 09:09 AM	#3 (permalink)
OldDog2006 Registered User Join Date: Jul 2006 Posts: 2 OS: XP	Norton Internet Worm Protection Thanks for the reply, but this is all Greek to me. My concern was not about how to remove the worm, virus, etc. I've taken the computer to my local service center and they've done that already. My desire is to track down where these are coming from by the IP addresses which Norton gives as the "attackers" in their alerts. Is there any service I can use to trace these IP addresses to their sources?

07-29-2006, 09:43 PM	#4 (permalink)
BBF2530 Registered User Join Date: Apr 2006 Posts: 86 OS: XP Home SP2	Old Dog Hi OldDog2006. First, to answer your questions: Yes, you can try to find who the "intruders" are. Is it worth the time or effort, no. Is it possible that it is relatives of yours? Yes, it is possible. However, it is not very probable. Please forgive my bluntness, but you are not an employee of the FBI, NSA, CIA, or other highly classified government organization (or are you, ), so what are you worried about? As you said, you are an old dog, learning new tricks, so ignore this stuff, and just sleep easier at night. Your computer, like any connected system, will be "probed" constantly. When you say you have been infected by viruses, I have the feeling that you are misinterpreting the warnings from your AntiVirus software. My thoughts are, it is telling you it blocked/repaired/deleted a virus/worm/trojan. This is not the same as being infected. OldDog, I may be even older than you, so take my advice. How does the old saying go? Don't sweat the small stuff? You have a better chance of hitting the lottery, than of having someone (relative or not) hacking into your computer. These probes are just part of being on the Internet. Relax, and good luck.

10-16-2006, 11:28 PM	#5 (permalink)
ohlab Registered User Join Date: Mar 2005 Posts: 1 OS: WindowsXP Home	AOL shows "Norton Internet Worm Protection" still active I have AOL, and use the AOL Safety & Security System, but keep getting the message "Norton Internet Worm Protection" duplicate firewall. I have no Norton on my computer anymore. How can I get rid of this message? __________________ Anita Central California

10-21-2006, 01:50 AM	#6 (permalink)
PanamaGal Mentor Hardware Team Join Date: Jun 2006 Location: Panama Posts: 1,240 OS: WinXP Pro SP2; Windows Server 2003; Windows Vista Ultimate; Vista Business	I think Norton is more the worm than most worms. You may have to remove the Symantec registry keys to get rid of the message. __________________ It is hard to fail, but it is worse never to have tried to succeed.

10-21-2006, 06:16 AM	#7 (permalink)
JohnthePilot Manager, TSF Articles Join Date: Mar 2006 Location: Cheltenham, near Wales. Posts: 30,889 OS: XP Home SP3, PCLinux, Vista Home Premium SP1 My System Blog Entries: 1	Hi Old Dog, From another "Old Dog", if you are really worried about these, you could try McAfee Personal Firewall. I get several hundred attempts a day to "attack" my machine. McAfee lets you trace these as shown below. This shows the attacks over a six minute period This shows graphically where the attack originated This shows the originator of the attack - often quite harmless. My own ISP frequently pings my machine as a security check. This gives a more detailed account of the originator I just ignore them, happy in the knowledge that my firewall is blocking them. Hope this helps to put your mind at rest. Regrds, Pilot.