Sign in with
Sign up | Sign in
Your question

Incoming Worm when starting Fax Console

Last response: in Windows XP
Share
Anonymous
April 12, 2005 3:16:07 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

When I start my Fax Console (Microsoft Fax Console, ver. 5.1, build
2600.xpsp2.040919-1003:service pack 1) that came with my windows XP home
edition, SP1, I get two messages I would like clarified, one from Zone Alarm
(I click deny) and the other from my Norton antivirus (I click OK, I think
this means OK, I got the msg, not OK let it in!! ). It seems the fax
console may be functioning afterward, don't know, no incoming faxes to tell
if it's working. If I close the fax console and reopen, no warnings on
reopening but the warnings come each time I first start the fax console
after a re-boot of the computer.



Zone Alarm pops up and says:

Windows Explorer is trying to act as a server

Application: Explorer.exe

Source IP: 0.0.0.0: Port 1024



And, my Norton antivirus pops up and tells me a worm is trying to access my
system with the following message:



Default Block Netspy Trojan Horse

Date: 4/12/05

Time: 10:33 AM (or whatever time I am using the program)

Path: C:\windows\explorer.exe

Filename: Windows Explorer

Direction: Inbound

Local Address: all local network adapters

Local Port: 1024

Protocol: TCP



My computer is clean, according to scans by Norton antivirus, Adaware,
Spybot, CWShredder, all current programs with current updates.



Is this all a reflection of the fact that my computer, to receive faxes, has
to operate as a server? Where is the "worm" coming from?
Recommendations/explanations appreciated. I've sent and received faxes
before, months ago, but don't remember these warnings appearing.



Chet
April 12, 2005 4:36:01 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

Tell Norton to quarantine it.
My one suggestion is to get and install WindowsXP SP2 immediately. You
are leaving yourself wide open for this type of action.
Order Windows XP Service Pack 2 on CD
http://www.microsoft.com/windowsxp/downloads/updates/sp...

"CGB" wrote:

> When I start my Fax Console (Microsoft Fax Console, ver. 5.1, build
> 2600.xpsp2.040919-1003:service pack 1) that came with my windows XP home
> edition, SP1, I get two messages I would like clarified, one from Zone Alarm
> (I click deny) and the other from my Norton antivirus (I click OK, I think
> this means OK, I got the msg, not OK let it in!! ). It seems the fax
> console may be functioning afterward, don't know, no incoming faxes to tell
> if it's working. If I close the fax console and reopen, no warnings on
> reopening but the warnings come each time I first start the fax console
> after a re-boot of the computer.
>
>
>
> Zone Alarm pops up and says:
>
> Windows Explorer is trying to act as a server
>
> Application: Explorer.exe
>
> Source IP: 0.0.0.0: Port 1024
>
>
>
> And, my Norton antivirus pops up and tells me a worm is trying to access my
> system with the following message:
>
>
>
> Default Block Netspy Trojan Horse
>
> Date: 4/12/05
>
> Time: 10:33 AM (or whatever time I am using the program)
>
> Path: C:\windows\explorer.exe
>
> Filename: Windows Explorer
>
> Direction: Inbound
>
> Local Address: all local network adapters
>
> Local Port: 1024
>
> Protocol: TCP
>
>
>
> My computer is clean, according to scans by Norton antivirus, Adaware,
> Spybot, CWShredder, all current programs with current updates.
>
>
>
> Is this all a reflection of the fact that my computer, to receive faxes, has
> to operate as a server? Where is the "worm" coming from?
> Recommendations/explanations appreciated. I've sent and received faxes
> before, months ago, but don't remember these warnings appearing.
>
>
>
> Chet
>
>
>
Anonymous
April 12, 2005 9:00:02 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

For the "Default Block Netspy Trojan" problem, see the following:

http://service1.symantec.com/SUPPORT/nip.nsf/4a29389c21...
Error: "Rule Default Block Netspy Trojan Horse Matched" when you start the
computer

Zone Alarm may be having a similar issue.

Hal
--
Hal Hostetler, CPBE -- hhh@kvoa.com
Senior Engineer/MIS -- MS MVP-S/U -- WA7BGX
http://www.kvoa.com -- "When News breaks, we fix it!"
KVOA Television, Tucson, AZ. NBC Channel 4
Still Cadillacin' - www.badnewsbluesband.com

"CGB" <nospam@nospam.net> wrote in message
news:ueiSJK3PFHA.2604@TK2MSFTNGP10.phx.gbl...
> When I start my Fax Console (Microsoft Fax Console, ver. 5.1, build
> 2600.xpsp2.040919-1003:service pack 1) that came with my windows XP home
> edition, SP1, I get two messages I would like clarified, one from Zone
> Alarm
> (I click deny) and the other from my Norton antivirus (I click OK, I think
> this means OK, I got the msg, not OK let it in!! ). It seems the fax
> console may be functioning afterward, don't know, no incoming faxes to
> tell
> if it's working. If I close the fax console and reopen, no warnings on
> reopening but the warnings come each time I first start the fax console
> after a re-boot of the computer.
>
>
>
> Zone Alarm pops up and says:
>
> Windows Explorer is trying to act as a server
>
> Application: Explorer.exe
>
> Source IP: 0.0.0.0: Port 1024
>
>
>
> And, my Norton antivirus pops up and tells me a worm is trying to access
> my
> system with the following message:
>
>
>
> Default Block Netspy Trojan Horse
>
> Date: 4/12/05
>
> Time: 10:33 AM (or whatever time I am using the program)
>
> Path: C:\windows\explorer.exe
>
> Filename: Windows Explorer
>
> Direction: Inbound
>
> Local Address: all local network adapters
>
> Local Port: 1024
>
> Protocol: TCP
>
>
>
> My computer is clean, according to scans by Norton antivirus, Adaware,
> Spybot, CWShredder, all current programs with current updates.
>
>
>
> Is this all a reflection of the fact that my computer, to receive faxes,
> has
> to operate as a server? Where is the "worm" coming from?
> Recommendations/explanations appreciated. I've sent and received faxes
> before, months ago, but don't remember these warnings appearing.
>
>
>
> Chet
>
>
Related resources
Anonymous
April 12, 2005 9:17:29 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

Understand recommendaton re: SP2. Will do.
But, I really wonder if it is a worm. Norton is catching it but is it
perhaps a normal function of the Fax module? It would seem coincidental
that every time I start the fax module, the computer is getting attacked by
a worm.

Chet

"Byte" <Byte@discussions.microsoft.com> wrote in message
news:199854D5-3729-4164-8EB9-B2211DD96532@microsoft.com...
> Tell Norton to quarantine it.
> My one suggestion is to get and install WindowsXP SP2 immediately. You
> are leaving yourself wide open for this type of action.
> Order Windows XP Service Pack 2 on CD
>
http://www.microsoft.com/windowsxp/downloads/updates/sp...
>
> "CGB" wrote:
>
> > When I start my Fax Console (Microsoft Fax Console, ver. 5.1, build
> > 2600.xpsp2.040919-1003:service pack 1) that came with my windows XP home
> > edition, SP1, I get two messages I would like clarified, one from Zone
Alarm
> > (I click deny) and the other from my Norton antivirus (I click OK, I
think
> > this means OK, I got the msg, not OK let it in!! ). It seems the fax
> > console may be functioning afterward, don't know, no incoming faxes to
tell
> > if it's working. If I close the fax console and reopen, no warnings on
> > reopening but the warnings come each time I first start the fax console
> > after a re-boot of the computer.
> >
> >
> >
> > Zone Alarm pops up and says:
> >
> > Windows Explorer is trying to act as a server
> >
> > Application: Explorer.exe
> >
> > Source IP: 0.0.0.0: Port 1024
> >
> >
> >
> > And, my Norton antivirus pops up and tells me a worm is trying to access
my
> > system with the following message:
> >
> >
> >
> > Default Block Netspy Trojan Horse
> >
> > Date: 4/12/05
> >
> > Time: 10:33 AM (or whatever time I am using the program)
> >
> > Path: C:\windows\explorer.exe
> >
> > Filename: Windows Explorer
> >
> > Direction: Inbound
> >
> > Local Address: all local network adapters
> >
> > Local Port: 1024
> >
> > Protocol: TCP
> >
> >
> >
> > My computer is clean, according to scans by Norton antivirus, Adaware,
> > Spybot, CWShredder, all current programs with current updates.
> >
> >
> >
> > Is this all a reflection of the fact that my computer, to receive faxes,
has
> > to operate as a server? Where is the "worm" coming from?
> > Recommendations/explanations appreciated. I've sent and received faxes
> > before, months ago, but don't remember these warnings appearing.
> >
> >
> >
> > Chet
> >
> >
> >
Anonymous
April 12, 2005 9:17:30 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

Hard to say for sure, but Norton's AV and Internet Security programs are
notorious for disabling various Fax Service functions.
--
Russ Valentine
[MVP-Outlook]
"CGB" <nospam@nospam.net> wrote in message
news:o djHFU6PFHA.2468@tk2msftngp13.phx.gbl...
> Understand recommendaton re: SP2. Will do.
> But, I really wonder if it is a worm. Norton is catching it but is it
> perhaps a normal function of the Fax module? It would seem coincidental
> that every time I start the fax module, the computer is getting attacked
> by
> a worm.
>
> Chet
>
> "Byte" <Byte@discussions.microsoft.com> wrote in message
> news:199854D5-3729-4164-8EB9-B2211DD96532@microsoft.com...
>> Tell Norton to quarantine it.
>> My one suggestion is to get and install WindowsXP SP2 immediately. You
>> are leaving yourself wide open for this type of action.
>> Order Windows XP Service Pack 2 on CD
>>
> http://www.microsoft.com/windowsxp/downloads/updates/sp...
>>
>> "CGB" wrote:
>>
>> > When I start my Fax Console (Microsoft Fax Console, ver. 5.1, build
>> > 2600.xpsp2.040919-1003:service pack 1) that came with my windows XP
>> > home
>> > edition, SP1, I get two messages I would like clarified, one from Zone
> Alarm
>> > (I click deny) and the other from my Norton antivirus (I click OK, I
> think
>> > this means OK, I got the msg, not OK let it in!! ). It seems the fax
>> > console may be functioning afterward, don't know, no incoming faxes to
> tell
>> > if it's working. If I close the fax console and reopen, no warnings on
>> > reopening but the warnings come each time I first start the fax console
>> > after a re-boot of the computer.
>> >
>> >
>> >
>> > Zone Alarm pops up and says:
>> >
>> > Windows Explorer is trying to act as a server
>> >
>> > Application: Explorer.exe
>> >
>> > Source IP: 0.0.0.0: Port 1024
>> >
>> >
>> >
>> > And, my Norton antivirus pops up and tells me a worm is trying to
>> > access
> my
>> > system with the following message:
>> >
>> >
>> >
>> > Default Block Netspy Trojan Horse
>> >
>> > Date: 4/12/05
>> >
>> > Time: 10:33 AM (or whatever time I am using the program)
>> >
>> > Path: C:\windows\explorer.exe
>> >
>> > Filename: Windows Explorer
>> >
>> > Direction: Inbound
>> >
>> > Local Address: all local network adapters
>> >
>> > Local Port: 1024
>> >
>> > Protocol: TCP
>> >
>> >
>> >
>> > My computer is clean, according to scans by Norton antivirus, Adaware,
>> > Spybot, CWShredder, all current programs with current updates.
>> >
>> >
>> >
>> > Is this all a reflection of the fact that my computer, to receive
>> > faxes,
> has
>> > to operate as a server? Where is the "worm" coming from?
>> > Recommendations/explanations appreciated. I've sent and received faxes
>> > before, months ago, but don't remember these warnings appearing.
>> >
>> >
>> >
>> > Chet
>> >
>> >
>> >
>
>
Anonymous
April 12, 2005 10:18:58 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

Thanks.
I have my suspicions re: whether it's for real. I'm not going to mess
around with it, but I wouldn't be surprised if it's a false positive.
The advice on SP2 is well taken, I've been waiting til they get to SP2b!
Chet

"Russ Valentine [MVP-Outlook]" <russval@gmail.com> wrote in message
news:%23FDg4a6PFHA.580@TK2MSFTNGP15.phx.gbl...
> Hard to say for sure, but Norton's AV and Internet Security programs are
> notorious for disabling various Fax Service functions.
> --
> Russ Valentine
> [MVP-Outlook]
Anonymous
April 13, 2005 12:21:55 AM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

There will be no SP2b..

--
Mike Hall
MVP - Windows Shell/user

http://dts-l.org/goodpost.htm





"CGB" <nospam@nospam.net> wrote in message
news:%238FNc26PFHA.2356@TK2MSFTNGP14.phx.gbl...
> Thanks.
> I have my suspicions re: whether it's for real. I'm not going to mess
> around with it, but I wouldn't be surprised if it's a false positive.
> The advice on SP2 is well taken, I've been waiting til they get to SP2b!
> Chet
>
> "Russ Valentine [MVP-Outlook]" <russval@gmail.com> wrote in message
> news:%23FDg4a6PFHA.580@TK2MSFTNGP15.phx.gbl...
>> Hard to say for sure, but Norton's AV and Internet Security programs are
>> notorious for disabling various Fax Service functions.
>> --
>> Russ Valentine
>> [MVP-Outlook]
>
>
Anonymous
April 13, 2005 4:11:19 PM

Archived from groups: microsoft.public.windowsxp.print_fax (More info?)

Yep, from reading the links, I think it is a false alarm. I'll tailor NAV
to ignore this and I'll set ZoneAlarm firewall to ask me permission to "act
as a server" when using the fax module.
Apparently I'm not the first to discover this problem!

Thanks.
Chet

"Hal Hostetler [MVP-S/U]" <hhh@kvoa.com> wrote in message
news:uC7vIv7PFHA.648@TK2MSFTNGP14.phx.gbl...
> For the "Default Block Netspy Trojan" problem, see the following:
>
>
http://service1.symantec.com/SUPPORT/nip.nsf/4a29389c21...
> Error: "Rule Default Block Netspy Trojan Horse Matched" when you start the
> computer
>
> Zone Alarm may be having a similar issue.
>
> Hal
> --
> Hal Hostetler, CPBE -- hhh@kvoa.com
> Senior Engineer/MIS -- MS MVP-S/U -- WA7BGX
> http://www.kvoa.com -- "When News breaks, we fix it!"
> KVOA Television, Tucson, AZ. NBC Channel 4
> Still Cadillacin' - www.badnewsbluesband.com
>
!