Member Avatar for joshuadt

Hellow, I have just got ahold of mcafee after being without a virus scanner/firewall after my norton messed up and wouldnt let me uninstall and I couldnt have both because of a conflict untill I found out the problem and got rid of norton compleetly. Well I did a virus scan and 2 trojans came up mcafee got rid of them. Then I opened up the firewall and saw "Test my firewall" and it took me to HackerWatch.com I looked at the "Top port activity" thing and

[IMG]http://img137.exs.cx/img137/219/untitled1gd.jpg[/IMG]

does this mean I got the virus or something?

Thanks ALOT in advance :D

  • 2 Contributors
  • 1 Reply
  • 226 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by steosaur(oWn)

Dani AI

Generated

Quick answer for : a HackerWatch page that lists "Kuang2" or shows ICMP/top-port activity is not, by itself, definitive proof that a local machine is infected. Kuang2 is a historical backdoor trojan that is commonly associated with TCP port 17300 and has been observed spreading via P2P/sharing networks; those web pages and port‑activity feeds often report what remote scanners are seeing on the public Internet rather than doing a deep scan of your PC. SANS Internet Storm Center — Port 17300. (isc.sans.edu) SpeedGuide port list (17300). (speedguide.net)

Complementary checks (in addition to the steps suggested): verify locally whether anything is actually listening on the Kuang2 port and which process owns it. From an elevated Command Prompt you can run the netstat output and then map PIDs to processes, or use Sysinternals TCPView to see live socket ownership. Example quick checks:

netstat -ano | find "17300"
tasklist /FI "PID eq <pid>"

Or run TCPView for a realtime view (it shows process names next to endpoints). TCPView — Sysinternals / Microsoft. (learn.microsoft.com)

If you do find a listener or active 17300 sessions: immediately isolate the box (disconnect network), save the netstat/TCPView output, and clean from a known-clean environment. Booting from a reputable rescue image and scanning offline (for example, Kaspersky Rescue Disk) is a reliable next step; for suspicious binaries, check them against multi‑engine services such as VirusTotal before trusting a single scanner. If removal is uncertain, back up data and consider a full reinstall. Kaspersky Rescue Disk download/support. (kaspersky.com) VirusTotal upload/scan. (virustotal.com)

Practical closure: if McAfee already removed items and local port/process checks show nothing unusual, the system is likely clean — but because backdoors can expose files and run remote commands, change any passwords you used on that machine after cleaning and monitor accounts. If help is needed, post the netstat/TCPView output or a HijackThis log (don’t delete anything first) so responders can triangulate evidence; ’s initial advice on scanning and startup inspection is a good starting point. [SANS ISC — behavioural notes on Kuang2 client capabilities]. (isc.sans.edu)

Member Avatar for steosaur(oWn)

I think that's just a general anouncement from that web site saying that the most common problem is the ICMP port and Kuang2 the virus. If you have the latest versio of McAfee and the latest DAT files, you should be all right. If you want to make sure you don't have any viruses follow these steps:

Reboot in safe mode by pressing F8 when the computer is restarting.

step1: run adaware SE in my signature

step2: click start--run--type "regedit"--and check the run folders at the end of these paths for suspicious looking keys (like somethine with kuang2 in the name,etc.) if your not sure about a key type it in google to find out what it is. (don't delete anything you're not sure of)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

step3: open the c:\documents and settings\(user name)\local settings(if you cant see this folder then click tools-folder options-view tab-check show hidden files [tools is at the top with "file", "edit", etc.])\temp <--clear out this folder and also the temp internet folder.

step4: open c:\program files\windows\system32 and select the view as "details" so you can see the date they were modified. Arrange them by date and look at the more recent ones for any signs of kuang2 or anything that looks like a virus or a suspicious .dll, like I said earlier if your not sure what it is type it in google.

step5: make sure you got all the windows updates, you have a up to date virus scanner, and I suggest a firewall like ZoneAlarm (pay attention you only need the free firewall) (but I think you said you already have a firewall anyway) [http://www.zonelabs.com/store/content/promotions/zap4/zap_trial.jsp]

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.