Whats Going On? Virus?

[Guest]

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

This is starting to get annoying can anyone explain what is going in or how
to cure it? I am running Windows XP SP2 Home, on an internal network (with 2
other machines) through a Dell router to a cable modem. I have ZoneAlarm
(the freebie version as the Pro licence has expired) and Norton Antivirus.
Symptoms are:

1. Every so often zonealarm tells me
"Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port 445]"
(Which seems to correspond to a plausible local site here in Cambridge UK
which I may well have visited once)

2. The same address appears on "My Network places" and generates the
zonealarm message if I click on it.

3. If I try and do a full system scan with Norton Antivirus it hangs at
D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on c97.e2bn.net

I'm also disturbed to note that although I keep turning my Windows Firewall
on (Via control panel/windows firewall) I keep discovering that it is turned
off....

Help anyone?

 

[Jim]

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

"Chris Dryson" <chris.dryson@NOTTHISBITntlworld.com> wrote in message
news:1126217401.17648.0@sabbath.news.uk.clara.net...
> This is starting to get annoying can anyone explain what is going in or
> how to cure it? I am running Windows XP SP2 Home, on an internal network
> (with 2 other machines) through a Dell router to a cable modem. I have
> ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
> Antivirus. Symptoms are:
>
> 1. Every so often zonealarm tells me
> "Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
> 445]"
> (Which seems to correspond to a plausible local site here in Cambridge UK
> which I may well have visited once)
It may be plausible, but someone may be using it as a waystation.
>
> 2. The same address appears on "My Network places" and generates the
> zonealarm message if I click on it.
A bad sign
>
> 3. If I try and do a full system scan with Norton Antivirus it hangs at
> D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
> c97.e2bn.net
Another bad sign
>
> I'm also disturbed to note that although I keep turning my Windows
> Firewall on (Via control panel/windows firewall) I keep discovering that
> it is turned off....
It should be turned off if you are also using ZoneAlarm.
>
> Help anyone?
>
Check your system with at least Adaware and Spybot. It seems most likely
that you have a virus.
Jim

 

[Guest]

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Spybot and AD Aware do not do viruses. These take care of "spywares". The
program "c97.e2bn.net" seems to be behaving like a "spyware"/"trojan" and
"phoning" home.


"Jim" <j.n@nospam.com> wrote in message
news:jbiUe.1799$eQ7.225@newssvr21.news.prodigy.com...
>
> "Chris Dryson" <chris.dryson@NOTTHISBITntlworld.com> wrote in message
> news:1126217401.17648.0@sabbath.news.uk.clara.net...
>> This is starting to get annoying can anyone explain what is going in or
>> how to cure it? I am running Windows XP SP2 Home, on an internal network
>> (with 2 other machines) through a Dell router to a cable modem. I have
>> ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
>> Antivirus. Symptoms are:
>>
>> 1. Every so often zonealarm tells me
>> "Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
>> 445]"
>> (Which seems to correspond to a plausible local site here in Cambridge UK
>> which I may well have visited once)
> It may be plausible, but someone may be using it as a waystation.
>>
>> 2. The same address appears on "My Network places" and generates the
>> zonealarm message if I click on it.
> A bad sign
>>
>> 3. If I try and do a full system scan with Norton Antivirus it hangs at
>> D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
>> c97.e2bn.net
> Another bad sign
>>
>> I'm also disturbed to note that although I keep turning my Windows
>> Firewall on (Via control panel/windows firewall) I keep discovering that
>> it is turned off....
> It should be turned off if you are also using ZoneAlarm.
>>
>> Help anyone?
>>
> Check your system with at least Adaware and Spybot. It seems most likely
> that you have a virus.
> Jim
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Jim wrote:
> "Chris Dryson" <chris.dryson@NOTTHISBITntlworld.com> wrote in message
> news:1126217401.17648.0@sabbath.news.uk.clara.net...
>
>>This is starting to get annoying can anyone explain what is going in or
>>how to cure it? I am running Windows XP SP2 Home, on an internal network
>>(with 2 other machines) through a Dell router to a cable modem. I have
>>ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
>>Antivirus. Symptoms are:
>>
>>1. Every so often zonealarm tells me
>>"Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
>>445]"
>>(Which seems to correspond to a plausible local site here in Cambridge UK
>>which I may well have visited once)
>
> It may be plausible, but someone may be using it as a waystation.
>
>>2. The same address appears on "My Network places" and generates the
>>zonealarm message if I click on it.
>
> A bad sign
>
>>3. If I try and do a full system scan with Norton Antivirus it hangs at
>>D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
>>c97.e2bn.net
>
> Another bad sign
>
>>I'm also disturbed to note that although I keep turning my Windows
>>Firewall on (Via control panel/windows firewall) I keep discovering that
>>it is turned off....
>
> It should be turned off if you are also using ZoneAlarm.
>
>>Help anyone?
>>
>
> Check your system with at least Adaware and Spybot. It seems most likely
> that you have a virus.
> Jim
>
>

Go to bleepingcomputer.com and go to the Hijack This section of the
forum board. It's been a big help to me.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

FWIW a colleague points out that it is behaving as if there is a remote
network disk mounted at c97.e2bn.net....



"Chris Dryson" <chris.dryson@NOTTHISBITntlworld.com> wrote in message
news:1126217401.17648.0@sabbath.news.uk.clara.net...
> This is starting to get annoying can anyone explain what is going in or
> how to cure it? I am running Windows XP SP2 Home, on an internal network
> (with 2 other machines) through a Dell router to a cable modem. I have
> ZoneAlarm (the freebie version as the Pro licence has expired) and Norton
> Antivirus. Symptoms are:
>
> 1. Every so often zonealarm tells me
> "Firewall has blocked access to c97.e2bn.net [193.19.98.150] [TCP Port
> 445]"
> (Which seems to correspond to a plausible local site here in Cambridge UK
> which I may well have visited once)
>
> 2. The same address appears on "My Network places" and generates the
> zonealarm message if I click on it.
>
> 3. If I try and do a full system scan with Norton Antivirus it hangs at
> D:\Documents and Settings\Chris\NetHood\...\target.lnk e2bn on
> c97.e2bn.net
>
> I'm also disturbed to note that although I keep turning my Windows
> Firewall on (Via control panel/windows firewall) I keep discovering that
> it is turned off....
>
> Help anyone?
>