"Norton Internet Security" problem! Please help please!

**mirkec** · April 3rd, 2006, 02:48 PM

Yesterday I have discovered that I have become a Big Dog. That is absolutly great and I can not start to descriebe how good I feel!

But since that moment my computer has started to show me things that I don't like.

Every couple of minutes I get following warning:

Quote:

Security Alert

High Risk

Norton Internet Security has detected and blocked an intrusion attempt.

Time: 22:11
Date: 2.4.2006.
Intrusion: ICC Profile TagData Overflow.
Intruder: www.extremefitness.com(216.165.193.168)(http(80))
Risk Level: High
Protocol: TCP
Attacked IP: jgillick.nettripper.com.
Attacked Port: 4893.

I use Firefox as web browser and Norton Internet security 2005.

What is going on? Is it normal thing when You become a Big Dog?

Can You help me in any way or point me towards someone who could?

I have never had any problems whatsoever on the site so I'm quite woried about this.

For any help you can give me,

Thanks in advance

**pliny_2001** · April 3rd, 2006, 03:14 PM

I've never seen that, but (please don't throw things) I'm on a mac. But, due to lack of chatter on this over the past few years, I doubt if it's anything coming from EFF.

**bester** · April 3rd, 2006, 03:39 PM

Hi mirkec,
This want I found on symantec site:
http://www.symantec.com/avcenter/att...gs/s21196.html

Quote:

ICC Profile TagData Overflow

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Response

Microsoft has released patches to address this vulnerability in supported platforms.

I hope it help!!

**FitnessPhotos** · April 3rd, 2006, 03:42 PM

Well, that's odd. I offload image hosting onto extremefitness.com, but just the usual graphics used to generate a page. The error doesn't seem to indicate the actual image that it is complaining about - can you figure out what it doesn't like?

**mirkec** · April 3rd, 2006, 04:06 PM

Thanks for the replies!

Unfortunatly I can not give You any aditional information nor I can find what image causes the problem. Norton only shows what I have allready given. When I click for more information It opens default manual with general information about Norton itself.

Unfortunatly, there is nothing about

Quote:

jgillick.nettripper.com.

on Symantec pages.

I have to say that name sounds a bit sinnister.

**FitnessPhotos** · April 3rd, 2006, 04:12 PM

Can you give me a URL of an exact page you get this error with?

**bester** · April 3rd, 2006, 04:19 PM

I google it, and i discover that jgillick.nettripper.com refers to an extension of firefox. The url is no longer active. Check the extensions that you have installed for your firefox and if you found anything suspicious uninstall it.

Some thinks that I found for jgillick.nettripper.com

Quote:

Lorem Ipsum Content Generator http://jgillick.nettripper.com/ (http://jgillick.nettripper.com/)

Search for jgillick.nettripper.com

Quote:

http://extensionroom.mozdev.org/more-info/ttlo

Here it say that is a bandwidth tester:

Quote:

Bandwidth Tester

http://jgillick.nettripper.com/

The Bandwidth Tester extension allows you to test the speed of the Internet Connection you are using. So, instead of going to a website such as bandwidthplace.com to test the speed, just lauch Bandwidth Tester from the Tools menu.

and here is a

Quote:

SwitchProxy Tool - jgillick.nettripper.com/

Somethink suspicious is going on with this url!!!!

**mirkec** · April 3rd, 2006, 04:41 PM

I waiting for it to show again to see if I could find some aditional info to show You.

All plug ins and upgrades i have downloaded through that little blue ball that shows in upper right corner when there are updates available to download or on Mozilla's official page.

Thanks again for all the help You have given me!

**mirkec** · April 3rd, 2006, 06:39 PM

Here it comes again:

Quote:

Security Alert

High Risk

Norton Internet Security has detected and blocked an intrusion attempt.

Time: 0:19
Date: 4.4.2006.
Intrusion: ICC Profile TagData Overflow.
Intruder: www.extremefitness.com(216.165.193.168)(http(80))
Risk Level: High
Protocol: TCP
Attacked IP: local host.
Attacked Port: 4524.

but different then in my first post.

Should I allow access to this computer?

**PythonPower** · April 4th, 2006, 01:40 AM

http://216.165.193.168/

is that look familiar? LOL. something is connecting to you that link. the ip isin the link you provided andsomething that is on your pc is trying to connect to it. thats whats going on.

**iba2dat** · April 4th, 2006, 08:58 AM

It's likely PP has sent an internet virus via a link he's pasted in the lounge.

**FitnessPhotos** · April 4th, 2006, 09:26 AM

Well, thats my image for sure (and my server ip); nothing wrong with it, so not sure why it's causing an error.....

**HotOne** · April 4th, 2006, 12:46 PM

it's the NSA...

**mirkec** · April 4th, 2006, 06:32 PM

Me back again!

Quote:

Well, thats my image for sure (and my server ip); nothing wrong with it, so not sure why it's causing an error.....

FP, if this is Your IP and and Your image, than I won't worrie about it any more. Everything works well (Norton blockes intrusions) here so I'll just think of it as my PC's special perk or something like that.

btw. While I was writing This it poped again and norton automaticly shuts down my connection to the site for 30 minutes (at least it says so). My only solution is to allow it in "my trusted zone" to prevent it from blocking my acces to this site.

FP, is that O.K. with You?

I won't do it untill You say that it is O.K.

**mavgrad99** · April 4th, 2006, 06:38 PM

turn on your popup blocker and turn off your porn blocker, that should fix the problem.

**PythonPower** · April 5th, 2006, 02:54 AM

Quote:

Originally Posted by iba2dat

It's likely PP has sent an internet virus via a link he's pasted in the lounge.

riiiiight....lol

**PLover007** · April 5th, 2006, 11:52 AM

This is all so very weird. Could it be a late April joke posted on the 3th instead of the usual 1st, just to make things more complicate ??

**Unkl** · April 6th, 2006, 01:53 AM

Quote:

Originally Posted by PLover007

This is all so very weird. Could it be a late April joke posted on the 3th instead of the usual 1st, just to make things more complicate ??

No he PM'd me about this prior to Apr 3 but since I don't have the puter skills like PP and the ilk, I recommended a post in this forum as I was sure that Biff would see, have a better idea and respond back and others with the skills could be also be of assistance.

In the past I've had something from my ISP similar in nature but managed my way around it, I think it's some kind of detection problem with NAV that needs to be reconfigured, but then again I am just a rilla, and fine, rare specimen at that.

**PythonPower** · April 6th, 2006, 03:13 AM

Quote:

Originally Posted by mirkec

Yesterday I have discovered that I have become a Big Dog. That is absolutly great and I can not start to descriebe how good I feel!

But since that moment my computer has started to show me things that I don't like.

Every couple of minutes I get following warning:

I use Firefox as web browser and Norton Internet security 2005.

What is going on? Is it normal thing when You become a Big Dog?

Can You help me in any way or point me towards someone who could?

I have never had any problems whatsoever on the site so I'm quite woried about this.

For any help you can give me,

Thanks in advance

i think you may wanna reload your norton as well...because on second glance, that message you are getting doesnt make sense. sometimes its database goes wack, it reaks out too.

for example in your situation:

Time: 0:19
Date: 4.4.2006.
Intrusion: ICC Profile TagData Overflow.
Intruder: www.extremefitness.com(216.165.193.168)(http(80))
Risk Level: High
Protocol: TCP
Attacked IP: local host.
Attacked Port: 4524.

now the "supposed" intruder's website that is supposedly trying to flood your data is
extremefitness.com, whose ip is 216.165.193.168 and is connecting through regular port 80 and not the secure ssl

next you look at the attacked port, its showing 4524!

wtf? one one hand its saying its 80 which is common because 80 is the most comon used by default http port. 4524 is an unassigned port which in theory could be targeted for an attack, but in this situaiton more than likely its a false alert and your program is just having a hiccup from it.

i say uninstall norton and reinstall it. and of course i hope you keep it, your pc, av, firewall upto date. if it still bugs you, just go ahea and allow it. you will be fine

**Darren0901** · April 6th, 2006, 11:29 PM

I don't want to start a Norton/Symantec debate, but I find that Norton is a not so nice to work with kind of program. PP has some good advice.

If you are still having troubles with it after the re-install, allow it [always] then keep an eye your Task Manager / Process to see if anything suspicious is going on.