What uses port 1090?

[Fat Tone]

Norton web site tells me it could be used by trojans. ne1?
TIA

Tony.

[KeiFront]

http://www.neohapsis.com/neolabs/neo-ports/neo-ports.html

1090 tcp Xtreme [trojan] Xtreme
1090 tcp ff-fms FF Fieldbus Message Specification
1090 udp ff-fms FF Fieldbus Message Specification

about the possilble trojan

http://www.glocksoft.com/trojan_list/Xtreme.htm

[Fat Tone]

Thanks. Just because a port is open, does that mean a trojan is definately there? NAV found nothing.

T.

PS know of any free s/w to tell? The Glocksoft s/w aint!

[KeiFront]

Yes another program could use that port to transport data, but be sure to check if NAV can find this trojan. Can't find much info about this trojan (i'm at work for the moment not at home ) but maybe you could check if you got the file Xtreme.exe on your HD.

[Fat Tone]

Thanks KeiFront. Well, that file isn't anywhere to be seen, my virus definitions are up to date, but although the Norton web site warns you about it, it is NOT included in the definitions!
According to DU Meter, something is leaking data on a regular basis, so I'm starting to shut processes down to see which.

T.

[Fat Tone]

well it seems all the traffic was local (!) according to the stats for the WAN side of the router. Phew!. Just need to find the router manual now to Telnet in and close that port.

Cheers for the advice.

T.

[Fat Tone]

Whats with these guys?

Yesterday they scared the shit out of me. Today, they say:
"The Symantec Security Check has determined that the Internet Protocol (IP) address used by your computer to connect to the Internet cannot be scanned. This is usually a result of being behind a firewall, proxy server, or using Network Address Translation (NAT) to share IP addresses. Unfortunately we will be unable to run the Network Vulnerability Scan, the NetBIOS Availability Scan, and the Active Trojan Horse Scan on this computer.
Select Continue to complete the remaining scans that do not need an IP address. "

[KeiFront]

At home now

Scan your computer at this place http://scan.sygatetech.com/pretrojanscan.html it scans for trojans and it can recognize Xtreme. I'm sure it will detect it if your infected .

You can also try the normal scans http://scan.sygatetech.com/ I like the scans that are listed there, they are easely to understand

You can also try the scans at http://www.dslreports.com/tools or the scans at shieldsup http://grc.com/default.htm don't like the scans at shieldsup but this is just a personal opinion.

It's possible that you have to open some ports on your firewall (if you are using one) to be able to scan your computer, be sure to close them again after the scan .

[Jammrock]

SSL for your web browser defaults to port 1090.

Jammrock

[KeiFront]

Doesn't SSL uses port 443 (https)?

[Fat Tone]

Thanks for the links, KeiFront!

I passed every single test on every single page! no mention of 1090 anywhere! I guess the RT314 is doing its job nicely

Thanks again.

Tony.

[Gurm]

Whoa, I just used that link.

MY GOD, I HAVE TROJANS!

THEY'RE EVERY-****ING-WHERE!

I have one on port 25, and another on port 113, and another on port 5000, and another on port 6969, and another on...

Oh, wait. Those are my services. Silly ****ing me.

MORONS.

GRC's Shields Up is even worse - it doesn't even SEE the open ports!

- Gurm

[dZeus]

well that first link was reasonably good for the fact that it could detect open ports just found out that I forgot to take out finger and telnet service. But as you said it's silly that it doesn't take into account that you might have services running on those ports completely intentional

[xortam]

Gee Gurm ... aren't you worried about the service on port 6969? Sounds like it goes down a lot.

[Greebe]

it's port 9696 that ya have to be worried about!