Norton 360

[vondratt]

I have an invisible  rogue start up process running on my PC (running Windows XP build 3) that is not detected by Norton. This process alerts a website "aubnb.com" to come and intrude my PC. While Norton does catch the intrusion and prevents it, I have not been able to identify the process which sends out the invite, which is once at 6 minutes after startup. Scans with Malwarebytes, Norton 2010, Windows Defender cannot find this process. The only way I have been able to stop the invitation from going out is to create a rule in my router to not allow any computer on my network from accessing the aubnb.com website. Oddly, the router log detects and stops the out going signal but the norton log on the PC has no event logged at the same time stamp. The process is apparently bypassing both Norton and Windows XP.

Are there any programs or tools to track down this invader?

Nick

[floplot Norton Fighter]

Hello vondratt

Welcome to the Norton Users Discussion Forum

Perhaps a log from HiJackThis will show something that may be helpful in finding the culprit. What version of N360 are you running now?

Please download HiJackThis from http://free.antivirus.com/hijackthis/ Choose the executable and save it on your desktop. Run the file and select the first option on the main menu "Do a system scan and save a log file". When this is finished, Notepad will open with the log file in it. Save the log file and attach it to a post here via the Add Attachments Please don't attempt to fix anything that it shows until someone checks out the log. Thanks.

Please come back and post the log and maybe this will be of some help in finding the culprit.

[SendOfJive Norton Fighter]

---

vondratt wrote:

Are there any programs or tools to track down this invader?

---

TCPView, a free program from Microsoft/Sysinternals will show the connection and the process that initiates it.

http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

A companion application, ProcessExplorer, will let you dig a little deeper.

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

And here is a good article on how to use these to do the sort of sleuthing you want to do:

http://ask-leo.com/how_do_i_see_whats_happening_on_my_machines_network_connection.html

[vondratt]

Thanks for the hint. I forgot about hijackthis. Will try it tonight and let you know what I find.