This thread's last reply is from May 17, 2008, 6:18 PM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
suspicious that I had a virus(It is slow and ie browser taking time to open this should not be the case because I'm using vaio vgn s5vp and I don't have much on it) in my system, I used HJT, Avg with my pc on safe mode and ran online Kaspersky scan and still found nulla. I got System Info for Windows Ver 1.65 and found a hidden running process naming it's self System with 4PIDs.
this was sitting on port 445 microsoft-ds, 139netbios-ssn,137netbios-ns and 138 netbios-dgm. it's properties are nkrnlpa.exe+0x1ac528.
It's behavior looks suspicious looking at what is going out through those ports. should I be concerned, I have nothing important on this partition. which tools can I use to pinpoint the problem. I have tried regseeker but knocks off my pc everytime I lookup nkrnlpa.exe registory and an error massage pops up.
You may have already read up on >port 445<. As the Shields Up site advises, you do NOT want port 445 exposed to the Internet and any NAT router or personal firewall should be able to block port 445 from the outside world without trouble.
true, but my concerned is to track the source. perhaps rootout the probem. tell me if I am naive?
somehow closing the ports does make me feel safe, this was not a philosophical question and u gave a good advice Vino Rosso thanx. ye I read about port 445 and I feel sometimes offence is the best defence. correct me if I'm wrong.
Does your firewall log provide any detailed information?
no, I am using Kaspersky internet security 6.0.
If you want to monitor network traffic, try this program:
http://www.ethereal.com/
Have a good read how to understand its logs, and how to use it. It is cost free, open source,
Make sure that the Windows Messenger service is stopped, and its startup desposition set to disabled. You can use the Services applet for this chore.
Other than that, what you are looking at is the Windows kernel. It needs TCP and UDP 135, 136, 137, 139 and 445 for Netbios name resolution with Windows Networking, and 445 for RPC calls.
. Disable Windows File and Printer sharing if not used. The selection box is under Network Connections, your existing LAN or Wireless connection, right-click, Properties.
. Windows Messenger service has nothing to do with the Messenger IM client. Under SP2 its default status should be set to disabled.
. It is fine if Windows Networking sits on these ports for internal traffic. It is not fine if it sits on these ports for WAN side traffic. The default XP firewall would have made the appropriate choices. Check your firewall settings and block any non-LAN local subnet traffic on the effected ports.
(Your kernel choices are HAL dependent and made during installation. Ntoskrnl.exe will either be the single processor example, as in your case, or the multiple processor version. The latter would appear as ntoskrnmpa).
OT query
Detail for member Bill Castner says:-
Joined: Mon 11 Dec, 2006 7:47 am
Posts: 202
Location: Chevy Chase, MD
I can only find
one post -
this one!
Where have all the others gone please? TIA
Dave
All of his other post are within the hidden university rooms that normal members don't have access to.
"EagleAmerican" wrote:All of his other post are within the hidden university rooms that normal members don't have access to.
Why is that? Is there something to hide
Dave
http://www.malwareremoval.com/university.php
Everything inside the university is for trainees and staff and would just confuse a normal user and could even be dangerous to them. If you would like to learn to help victims of malware, you can apply by clicking the link up top.
