I have Norton Internet Security Firewall. I keep getting alerts that ips where blocked attempting to use sub seven backdoor. I have heard of it before but not sure what it is...will look up.

Alert as follows:

Alert 8/27/2003 19:06:45 NDIS Filter Security alert displayed for rule Default Block Backdoor/SubSeven Trojan horse.
Remote computer (68.160.160.37, 3698)

Various Ips are listed as blocked for 30 minutes....
Ip's include 24.92.186.154;80224.156.13;68.160.160.37

I have had several Ips blocked like this. I think it may be a program I am running that doesn't have proper permissions set.

The port is 3698...I am searching for information on this port...some kinda telnet com port I think. May just people running random scans...dunno....

Any info or advice is appreciated.

I would make sure that my virus scan is totally up to date and run a full scan. If it comes back clear, then I would suspect that it is catching a SubSeven virus attempting to enter through that port and blocks it. Just my guess without reading into it much. I've heard of that alert being thrown up when disconnecting from a game server in UT but the port wouldn't be that port ever.

in norton i get reports everyday like that not sure which port, will take a little more notice next time (and you know it wont happen for days now) it just makes me glad i got a firewall installed its blocked so don't worry too much about it once you scanned and know its nothing on ur puter theres not a lot more you can do
Dark :evil: :evil: :roll: :twisted:

All these thing about sub seven and what not, just ignore them, YES there was something happening which shouldnt of had but norton says this every time for most of them, its good busyness to make ppl thing that there firewall is work very hard, if ya get what im sayin.

I gte it all the time, about every 2 seconds, :)

I wasn't really worried about a virus. I was just curious as to what programs might use that port and wondered if anyone had encountered it...sounds like Im not the only one.

From what I have been reading, it sounds like an actual subseven virus scan. It sounds like there has been an increase in subseven scans.

From what I can tell, this doesn't necessarily mean I hava the virus. Sounds like the scan was just searching to see if I did have it.

No worries I guess. Thanks for the input.