WinCrash Trojan Horse blocked when accessing FTP ?

[lacantina]

hey everyone,

For the second time yesterday, while updating webpages on our ftp, I got a message from Norton saying "WinCrash Trojan Horse intrusion attempt blocked"

This has only happened while on our ftp, and it has only happened twice in about a month.

I read up about this trojan and it sounds very evil...so what's going on??

Should I contact our webhost, or what should I do to prevent other crap from getting into my machine via our ftp?

Thanks for your help!

lacantina

[MuNKyonline]

Have you tried running a full scan to make sure it's not on your system? If not, boot into safemode and run a scan to make sure it's not on your pc. If the scan comes up clean i'd then contact your webhost.

[lacantina]

Yep, scanned my machine and it's clean. This is something coming from "outside".

I've contacted our webhost and am waiting for a response. However, could this have something to do with the ports ftp uses...maybe Norton 2006 erroneously detects the ftp itself as a trojan...?

Anyone else had this experience?

Thanks!

[MuNKyonline]

It may just be a problem with Norton. I found this:

http://www.ftpplanet.com/ubb/Forum1/HTML/003236.html

It may help. If not buy McAfee VirusScan 2006 =)

[Jabber_uk]

Here's what you have to do:

1. Go to teh start menu, then control panel, then add remove programs, then click on Norton Anti Virus and click REMOVE. :-)

2. Download a FREE anti virus program like AVG FREE or AVAST FREE and you will then be able to remove the virus.

Sorry for Norton bashing but in my business I/we have dealt with many many PC's and the two most hated programs ever are AOL (1st place) and Norton (2nd).

[lacantina]

Haha...what's all this Norton bashing?? Knock on wood, it's always worked great for us...and I just upgraded to the 2006 version which is pretty good....

Anymore thoughts on the trojan intrusion via our ftp? Has this happened to anyone else?

[Jabber_uk]

Is the Trojan running in memory? Is it running as a 'service'? What is the EXE name of the Trojan?

If you know these things, you can go to the RUN box off the Start menu and type in msconfig which opens the Microsoft Configuration Utility. This program allows you to enable/disable programs from starting up when Windows starts.

This process doesn't always work but you can usually stop the program itself from starting by clicking on the Startup tab and finding it in the list - deselect the tick box and reboot. If it is running as a service you can also stop the service from running at startup by clicking on the Services tab and deselecting the service there.

You could start Windows in Safe Mode and rename the file to stop it loading (if you know what it is called).

Running an online virus scanner might help like the one at Trend Micro (http://housecall.trendmicro.com/)

Do you have a firewall on the PC? If so, you can usually disable a specific program from connecting to the internet which might help as a workaround.

Oh and uninstall Norton and put a proper Virus scanning program on! :-) I promise I am not a conspiracy theorist.....