Norton Internet Worm Protection has detected and blocked an intrusion attempt

[SandiF]

Earlier I've been doing some web work, uploading files, etc. I use Ipswitch WS_FTP for my ftp manager, was logged into my domain host server and ftp'ing files. Then I started getting this pop-up message:

Norton Internet Worm Protection has detected and blocked an intrusion attempt.

Security rule: Default Block RASmin Trojan horse
Path C:WINDOWSSystem32alg.exe

There's more details to the message, such as the IP address and Port number, which were for the host domain name I was logged into. Now, I cannot access none of the host server for any of the domain names I maintain ... just keep getting the same message about Internet Worm Protect intrusion attempt! [img]/forums/images/graemlins/confused.gif[/img]

I shut-down the pc, run Norton. Of course, Norton always find my RASAdmin.exe and the .dll file that I use to remote access into work as threats during the virus scan, but it did not find this "RASmin Trojan horse" that it's blocking each time I try using the WS_FTP ftp manager.

I have some files I need to upload like now for a website and cannot do it because I cannot access not a single one of the domains host servers I maintain.

Mi feel so frustrated. Hope unnu can mek head or tail outta wey mi just write and can gimme the workable solution.

[SandiF]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Mi nuh do no adware scan yet... gonna do it now and let you know if any results. mi just waan to access to the host servers so mi can upload my files.

Mi gwine retire from these website work.

[Dr.Dudd]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Try spyware doctor professional(the free copy)

[SandiF]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Dr.Dudd, I'm so reluctant to download and install another spyware. I'm using Spybot, just ran it, and also ran Lavasoft Ad-AdWare. Retried the ftp manager, but still getting the Norton message.

I'm so tempted to rename the file C:WindowsSyste32alg.exe but it seem to be a critical file. The file may have been corrupted, but I don't know how much more I should check for beyond virus scan, spyware scan, adware scan.

Application Layer Gateway service is a component of of Windows OS. It is required if you use a 3rd party firewall or Internet Connection Sharing (ICS) to connect to the internet. Do not end this program in task manager - you will lose all internet connectivity until next restart or login.

[Dr.Dudd]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Originally posted by SandiF:
[qb] Dr.Dudd, I'm so reluctant to download and install another spyware. I'm using Spybot, just ran it, and also ran Lavasoft Ad-AdWare. Retried the ftp manager, but still getting the Norton message.

I'm so tempted to rename the file C:WindowsSyste32alg.exe but it seem to be a critical file. The file may have been corrupted, but I don't know how much more I should check for beyond virus scan, spyware scan, adware scan.

Application Layer Gateway service is a component of of Windows OS. It is required if you use a 3rd party firewall or Internet Connection Sharing (ICS) to connect to the internet. Do not end this program in task manager - you will lose all internet connectivity until next restart or login.

[/qb]

I have those and many paid copies of those spyware,but the Doctor beats them all. It even block many backweb programs that was put on by the manufacturers of my machines. these i've been trying ti block for soo long. All I do is never buy these again,because all the paid up omes are soon by passed by new spy tools

If you want to know if it is a critical file gi to Mictosoft windows updates and search for it,amd if yiu fimf it judt download it and it will ask you if you want to replace the otiginal copy, click yes. That is what I do whenever any of my windoes files are corrupted.

[grandma2]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

SandiF dont knoh if yu solve dis already, but yu waan see J-kid did hhelp me wid somting like dat, yu have to delete dat file out of your restore

correct mi fi mi wrong J-kid or Rebycman

disable restore
go to that file path name in restore, delete that file
restart puter
enable restore
restart

[SandiF]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Mi still have the said problem [img]/forums/images/graemlins/mad.gif[/img]
I tried downloading Spyware doctor which Dr.D recommended but the thing was 3/4 way through the download, then it stuck... wasn't going anywhere beyond that.

The only way I can login to any remote connection is by going into Norton 'Options' and disable Internet Work Protection.

[Rebycman]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Its possible that file was corrupted but I get the feeling its Norton that is causing the problems. Before you do anything rash try scanning your PC with another virus scanner (AVG has a free version, try www.grisoft.com).

If you don't use Windows Firewall or ICS (Internet Connection Sharing - an ancient and outdated service) then you can remove alg.exe from loading without problems. I would suggest you leave it until you can sort out what exactly is going on.

I hate to hack on Norton but I've had nothing but problems with their software in the last 4 years. If you need a software firewall you may want to try ZoneAlarm (again free for home users). From the description you give it sure sounds like Norton is being over aggressive and throwing up paranoid alerts....but again it is possible alg.exe was corrupted.

Post what ya find out and I'll take a look.

Regards,

-Reby

[SandiF]

Re: Norton Internet Worm Protection has detected and blocked an intrusion attempt

Reby, yes, it's one of the two. I renamed the alg.exe to alg.exe.not and the system auto-created a new one. :scratchinghead: I've never seen that before.

The only way I could use the ftp manager was by disabling the "Internet Worm Track" in Norton. However, yesterday I re-tried using the WS_FTP manager, and I was able to login to every one of my domain name host servers! I do not have the foggiest what may have 'corrected' itself, but I suspect that this problem is likely to resurface.

Dr. Dudd, I tried downloading Spyware Doctor Pro, and heaven forbid the download got to 75% complete and stuck at that point.

Thank you all for taking the time to help!