Hello, Last Tuesday I started receiving repeated attack warnings from my Norton Antivirus.
The websites and IP addresses the attacks were coming from varied, but the one message I kept receiving was
THE ATTACK WAS RESULTED FROM \DEVICE\HARDDISKVOLUME1\PROGRAMFILES\MOZILLAFIREFOX\FIREFOX.EXE
To get rid of the repeat warnings I ran my Norton Antivirus then downloaded and ran TDSSKILLER,SUPERAntiSpyware Free Edition and Malwarebytes Free Edition. All the programs found and removed suspicious programs.
Today being a bit cautious I did a few general Google Searches and it seems the constant attack warnings had stopped. But then I tried to enter one of my normal sites and it seemed the virus/trogen or whatever it is tried to re-direct me to a Fake App. Again the website and IP Address was different than before but once again I recieved this warning
THE ATTACK WAS RESULTED FROM \DEVICE\HARDDISKVOLUME1\PROGRAMFILES\MOZILLAFIREFOX\FIREFOX.EXE
Here's the more detailed Norton Report
Norton Report
Severity - High
Activity - An intrustion attempt by 64.111.211.154
Date & Time - 13 April 2011 12:19
Status - Block
Risk Name - Fake App Attack: Fake AV Redirect 10
Attacking Computer - 64.111.211.154, 80
Attacker URL - http://64.111.211.154/c.php?re=1&r=eNodVFvPsrwW_EEkD7S0lF68F54AEbWCCnKzw6kggqBARcKP3-a7WlnJZNbKzGTKGUIC6Azm_enfv1n5UxDA_w2qz1AB4Leryg-hKPPZN7rQW_YxdKt4tWxCH-VxXT0j6_RvRjEhicJBnCSRjmOq6yDKOAYp5hrAFP4PcJ1TjWgxzxKqJSjBWIu0H7mWJjTl6qxqvy-yQ3u9HvoBTvlJDjvp8LI7k19W42u38-LHznW6i4OdbGccl7d2e3x6d4kHwFZJTLzF9JzszxRqN74UnCmUfbZXylMqB0QO2zglfiZESjPCgXqrj4dKjdmrMmpUkXMzuN5WQ9LbWzdgIQVdG6zORbpJmoBc4_3LHCG0-2VtskfDEjCkiXFYd46oIyn4Bp4cl2eznshxugA_6ex1du02a7kUXmO9K7rUsuHN2iQQG7iIaNza3R1ZhhGLGinTO9-4l2oDImxcjPq8BSvTqdKID_V-Dy1ldTYCW0c4dBa4BaZ9BLfPOwepPDpC9ZxsRJU9WYzBq0LG5HFYh3j8rB4HA3yjVSRNY2Iv_NGUb01ZGesi2a_ODSHFfeNLwcCI6eZV6bsBawvMCsw_zFhOloknsdutyP7V3O_105p-0gzfS1usrcow79vd4hJtPt9bg4SzMR-yIwnVJrtL2esuoQa2rB4c0uY5bm4T8Puy-OlHo2oY26q5A5ZrFbvFKBzhunv4tVZEg84sZJZSMp6j67Y75mXvkUVJ2a7sokdo3eRv6pzvr-8Y7g6e4Qr97Rz093PXtjv-jWqInCPQlsn5tG8Pmrh8LnerlPShOq0XblioKVaUL4PS7gn8fbR5Xtv3Xm5eS7E5WdvIIfeNjSlvcMnMygrvfnj83A9viU6kp5JoA-eIy84SbZ-P5DOuf_6Pw5kxja0XBBwNJzTLUssUka0GhiN5ShYVL84OBEgU104mhT0-9S8TijzEH_SSWFlAKpRHkQZe_kuR2Ki859Mb6pQ6RNMr15f6b3g0AaoVoZC9NcjTlwOdjW9UL5MjvzNfU4PJHS394lbcQnor2YOoJ3crLuVjKUweyJGXh710QfQZvKfTL3AW9S7S-BlA6KR0EEXpjS-XXkMkR74kpWLxWdGr2uuM3SyGIW6w5H2FLBNOVT5MxGnsLM-8W-8_F2RpIWv6SlTr5bI7SKsX2W4p3J0zoT_Vp2SFWzWR17H8UaFcP9lPTSxlMd1tColyev4mpZynhp8ol6N8yj-Mt4o5TDcoWrk82dUrL-nN4DfXEhM9tXl1hHaKZMUorFUz0I-1BeK4ge-tLRYt7q3On7r3s0ssduBlDLEv29NBztfnMi7amcI_oP-p6A_-umam-A8C8AcU5Y_AWZlnOKd-N8T-9ddwY5VabpXc8Y9F-TcDFQINz0RBGlX-QyuzOoc-HWKzGkL_UKSm0cUwGW6Q9jPlIIqSDKlpBDOENICApvJEj7GSUPCrWyVWYwTh736EVaBqJNVwliAAIaIKh-r_AXFzzXs&u=f6985e30f47d9eb1380c380612023a63&cid=6b0f46186d8e358609783703950caf79&rc=0&pa=&ref1=&ref2=
Source Address - 64.111.211.154
Traffic Description - TCP, www-http
I have also attached the Norton Report
I'd be grateful if anyone has any suggestions as to how to fix this problem.
Thanks,
jloshea