False positives from NAV 2005 Worm Protection?

PeteC · 2005/05/29

Yesterday I spent some time updating a web site that I master on behalf of the owner using Terrapin FTP which I have used for years now, but probably for the first time with NAV 2005 loaded.

Norton kept on interrupting the FTP with worm alerts, examples ....

28/05/2005 13:26:08,Rule "Default Block ShockRave Trojan horse" blocked communication., "Rule " "Default Block ShockRave Trojan horse" " blocked communication. Local address: All local network adapters(1981). Process name is " "D:\Terrapin\ftp95.exe" ". "
28/05/2005 12:23:18,Rule "Default Block FTP99CMP Trojan horse" blocked communication., "Rule " "Default Block FTP99CMP Trojan horse" " blocked communication. Local address: All local network adapters(1492). Process name is " "D:\Terrapin\ftp95.exe" ". "
Click to expand...

I was somewhat mystified to see that the process name was the Terrapin executive.

I reloaded Terrapin to a different location and continued to receive the alerts, examples ....

28/05/2005 19:55:05,Rule "Default Block Phinneas Phucker Trojan horse" blocked communication., "Rule " "Default Block Phinneas Phucker Trojan horse" " blocked communication. Local address: All local network adapters(2801). Process name is " "C:\Program Files\Terrapin FTP\ftp95.exe" ". "
28/05/2005 19:54:43,Rule "Default Block SubSeven 2.1/2.2 Trojan horse" blocked communication., "Rule " "Default Block SubSeven 2.1/2.2 Trojan horse" " blocked communication. Local address: All local network adapters(2774). Process name is " "C:\Program Files\Terrapin FTP\ftp95.exe" ". "
Click to expand...

Are these real alerts or triggered by Terrapin or the FTP process?

noahdfear · 2005/05/31

Look like false alarms to me, Pete. Contact Symantec?

PeteC · 2005/06/01

Thanks Dave - nice to have confirmation of my thoughts on this Might well try Symantec - I'm still young enough to wait for a response

noahdfear · 2005/06/02

You bet, Pete!

Might well try Symantec - I'm still young enough to wait for a response
Click to expand...

ROFL!!! You sure?? Maybe I should try too, just in case!

I'd be happy to submit a copy of the file.

PeteC · 2005/06/02

Dave

Guess you've got enough on your hands - but thanks any way - I'll try and do it tonight. I'll keep you posted.

Log in or Sign up

False positives from NAV 2005 Worm Protection?

PeteC SuperGeek Staff Thread Starter

noahdfear Inactive

PeteC SuperGeek Staff Thread Starter

noahdfear Inactive

PeteC SuperGeek Staff Thread Starter

Share This Page

Log in or Sign up

False positives from NAV 2005 Worm Protection?

PeteC SuperGeek Staff Thread Starter

noahdfear Inactive

PeteC SuperGeek Staff Thread Starter

noahdfear Inactive

PeteC SuperGeek Staff Thread Starter

Share This Page

Useful Searches