Tracking a Trojan horse.

[wellard]

Very occasionally the wonderful Norton / Symantec anti virus saves my computer from a virus automatically. This morning however it gave me a warning that someone was trying to contact a Trojan horse on my computer. So I decided to do the visual tracking option and it actually produced a physical / real business address and postcode from the IP code! Maybe this place just forwards things like this on.
Has anyone ever chased up a spammer or virus spreader before? If so what happened? I sent the details to the Internet provider though I doubt I will hear from them again.

Interesting, I haven't had Norton tell me that yet... kind of cool., actually.
Ziroc may be able to give you more info on tracking people or companies via their IP address, every once in a while somebody does something really dumb here - like advertise i-pods - and he gets all kind of info on them from their ip info.
Were you able to determine if you actually had the trojan, or do you think it was just a blind probe?

[wellard]

LOL good question Absynth! I have just done a update and virus check and found nothing.

The IP address given was from Canberra about 200KM away.

[Bozos of Bones]

I always trace whoever tries to violate my security. Backtrace results can include everthing from subnet mask, contact number to the name of his mother-in-law. ISPs are not generally known to prusue on any information their users provide them, so about the only thing you can do is block that IP with your firewall.

[Stormymystic]

I had one come up from Brazil once....

[T-D-C]

Basically if they have a fixed IP it will pinpoint their location or the location of their network or ISP.

However one thing to remember is that most often the PC the trojan is comming from is unaware that they have the trojan and it is self replicating. Most often this will happen to PC's that don't have any virus protection.

The other way it could happen is that the person sending you the trojan could be using a proxy to hide there real IP address.

All you can do is report it to the ISP and see where they take it.

[Variol (Farseer) Elmwood]

I downloaded the free version of AVG Virus scan on the weekend. It found some stuff like Trojan horses, but it wouldn't fix it. I think that's how they get you to buy it. Is there a demo or something I can run that will actually remove the problem?

[wellard]

Thank TDC (remembers your involvement in all this )

Well I reported it like I said, and you would be right about the proxy of course but it would be fun to find out if anybody had actually knocked on the front door of one of these gallah's [img]graemlins/heee.gif[/img]

[T-D-C]

Originally posted by wellard: Thank TDC (remembers your involvement in all this ) Well I reported it like I said, and you would be right about the proxy of course but it would be fun to find out if anybody had actually knocked on the front door of one of these gallah's [img]graemlins/heee.gif[/img]

I ahve seen a few cases where the PC in question was infected and the user was unaware that there PC was sending out viruses to other people on the network.

The ISP received a report. Contacted the customer and shut off their interenet access until they got some Antivirus software on their PC.

So sometimes the system does work

[LennonCook]

Originally posted by Variol (Farseer) Elmwood: I downloaded the free version of AVG Virus scan on the weekend. It found some stuff like Trojan horses, but it wouldn't fix it. I think that's how they get you to buy it. Is there a demo or something I can run that will actually remove the problem?

I had nothing but trouble for the few hours I tried AVG. Then I got avast!, and I recommend it highly. I've been using for a week with no problems, and the first scan I ran (on the first day) picked up two viruses that both AVG and Norton had missed. It is as free as AVG (and, if AVG can't clean things, even more free), and lacks the extensive bloat that seems to plague the major ones (Norton, PC-Cillan, McAffee, etc).