Netspy Trojan Horse

[Bessy Lou]

XP Professional with Norton Internet Security 2003 on home-network with two computers presently online. Problem: Norton keeps displaying warning: A computer with the IP address 127.0.0.1 attempted to connect to your computer using Default Block Netspy Trojan horse. Program: C:\WINDOWS\Explorer.EXE, TCP (Inbound), Remote Address: 127.0.0.1:3013, Local Address: All local network adapters: 1024; Visual tracking reports: The IP address 127.0.0.1 belongs to a computer on your local network, therefore there is no public network or domain information.

I am not sure when, exactly, I started getting this warning. Within the last several days - not going on for long (ok, too long for me). I don't have a computer on my local network with that address, so I don't know how to handle this. I do have a all-in-one printer/scanner/copier/fax that I tried to set up to fax out through the computer and don't know how to check if this machine got assigned an IP Address.

I did do a complete scan of both computers with NAV from computer and online; and used PestPatrol scan also. Nothing showed up on either scans. Can anyone help me? Thanks in advance.

[Azn_tweaker]

did u try running other AV programs?

[ultrasolve]

The address 127.0.0.1 is the loopback address on your computer.

It's possible that this message is coming up because of the failed fax setup.

Your firewall is picking it up as Trojan activity because of the port is is using port 3013.

The way these fax systems work is to install a virtual printer, from which they send and receive, because this is a virtual device it will use the loopback address of 127.0.0.1

[ESALADUANE]

See this from Symantec.

"This problem typically occurs on computers that run Windows XP when the program Fax Service is enabled. Unchecking the "Default Block Netspy Trojan horse" rule in your firewall will fix it without creating a security hole."

http://service1.symantec.com/SUPPORT...= bar_sch_nam

[Bessy Lou]

Wow! I am learning all sorts of things here. I love forums -- the combined knowledge is awesome. Thank you for the input ultrasolve and ESALADUANE (and Azn_tweaker too). What you guys brought up makes sense. I feel pretty comfortable with Norton Internet Security and Pest Patrol -- I couldn't imagine why Norton would say there was problems but not find anything when I scanned.

I should have been more vigilant this last week on my computer -- I was lax. Yesterday I rolled the computer back to a week earlier using the System Restore feature in XP and haven't had the warnings anymore. However, I realize that I didn't learn anything from restoring! I'll read up on installing the fax at Norton's site.

Again, Thank You!!! ~ Bessy Lou