Printable View
It appears that my Sygate Personal Firewall has let in a hack that has modified my ntoskrnl.exe. I have not accepted the changes that it has made but my security log tells me it is trying to broadcast out everyday and considers it a major security breach. It is trying to go out on my UDP ports and it is using Net Bios. I have shut off printer sharing. Can anyone tell how to rid myself of the little devil.
Do you mean he/her is still in? He may have installed a trojan/backdoor on your system. If he was using NetBIOS and you turned off file and print sharing he shouldn't be using that. Get a free trial version of The Cleaner for trojans at http://www.moosoft.com
Open up dos and run netstat | more and look for a high port number, that's the port most trojans use. Remember: Password protect your C drive and other important folders. Hope I could help.
Thanks for your time~
What makes you say that ntoskrnl.exe has been modified?
Ammo
Everytime I start my computer I get a dialogue box that says "The NT Kernel System has changed since last time you used it. This could happen if you updated recently. Do you want to except the changes" I always say no because details show port 137 and 138 alternately, also noting that" Browsing request of Net Bios over TCP IP". This was all started when my firewall software said in its log that ntoskrnl.exe /outgoing/udp/ severity major/ - this is on the attack log. It also reports during the day application involved ntoskrnl.exe blocked( which is what I do daily on the first dialogue box . I can't figure it out. Huntx7 told me to run Cleaner to find out if it was a Trojan and my system showed no Trojans from the process.
What version of windows is that NT4/w2k/XP?
Has it always done that or it's a recent thing? (Since windows install or sygate pers. fw install?)
Have you run windows update recently? (In XP I believe it runs automatically).
As for the outbound connections 137 and 138 are indeed for nbt and could be legit? Does the log show the destination IP? You mentionned you turned of printer sharing. Does that mean file sharing is left on?
Ammo
Hey Ammo: The system is XP and I have not run an update within the last week. The ip that the exe is going to says it is my broadband connection "Cable Vision". Could my firewall be treating a communication to the cable company as an attack? I am pretting sure that file sharing is off also. There are no drive shared and I am assuming I would have to put something in the shared directory for anyone to get to it.
Well I have seen similar things in other host-based firewalls on XP systems. Take a look at this and tell me what you guys think.
Windows XP default install with TCP 445 open
http://soho.sygate.com/alerts/XP_def...CP445_open.htm
http://online.securityfocus.com/archive/1/256830
I think this might be it.
good luck,
nocilis
Nocilis: In the morning when I boot up I have had to wait an unusually long time before I can click a desktop icon to launch I.E. or Outlook. It could be that packets be sent are using all my ram. My security log always says it is outgoing only that is the breach but I deny the outgoing process every morning by not accepting the changes to the ntoskrnl.exe. I have not idea if someone has establish incoming. I do know that this is part of the detail when I backtrace the ip( which always shows up as my cable provider).
"To single out one record, look it up with "!xxx", where xxx is the
handle, shown in parenthesis following the name, which comes first."
How do I get rid of this record?
can you shut off file sharing? that would close up those ports. but keep in mind, if you got hacked you dont know what they did. best practices is to format.
Angry Bob: Thanks for the time. I have a good book on Windows XP and I am pretty sure I have shut off all file sharing.
I also performed a system restore on my xp system to a date
before I had my firewall alert. I was hoping that this
would replace the ntoskrnl.exe to an earlier version. The
system restore went through its process and after it did
it's auto reboot it said it was unable to restore my
system. I did this again and the same thing happened. Is
that a sign my system has truly been compromised? The people on the MS XP boards are not responding to my message that my system was unable to restore itself to a former date so I am not sure whether I was really hacked and part of the modification to the ntoskrnl.exe was not being able to restore back to former date.
i agree w/ AngryBob. if the system has truely been compromised....it's time to scrape and nuke..then lay down a nice fresh install.
does netstat show anything? look for high port numbers, usually thats a good indication. also, did you change all of your passwords? do that, and make sure to rename the administrator account. also look at the services your computer is running, and see if there is anything strange in there. usually if you have somehting the hackers will name it something that looks legit, so be carefull. really truly, if you cant figure it out wipe the hard drive and reinstall XP otherwise everytime something strange happens you are going to think...uhoh, its cause i got hacked. by the way, are you on DHCP or do you have a static ip?
Hey Bob and Jeb: I didn't do a full reinstall but a friend came over and made sure every port was closed and we did a reinstall of my firewall so that got rid of the breach alerts. He eliminated everything that was suspect when he surveyed the running items in Norton's Process Viewer. He also went onto to his server through telnet to check the back trace on the ip addresses in question. They all seemed to be either Microsoft, Cablevision and Doubleclick. The only remaining clich is there is is an annonymous logon on boot up but nothing in my machine is trying to broadcast out any longer. Is there a way to identify the annonymous logon? He didn't check it out completely but he will look into this week. He is speculating it is something that XP does when the system thinks single computer is a network.
Thanks for all the good advice.
It could be someone on your ISP (backtraces almost always show up as the ISP) or someone could be spoofing the packets.Quote:
Hass said...
I have not idea if someone has establish incoming. I do know that this is part of the detail when I backtrace the ip( which always shows up as my cable provider).
ntoskrnl.exe is the file that holds among some others possibley but i know for sure the boot screen. When you turn your computer on and it shows windows xp witht he little line moving around. You can make it show whatever you want when it boots up with a little help from Restorator. Are you the only user? could it be possible that you or someone else decided to change that boot screen to something custom? If so that is why it has been modified.
Do you by any chance have a backup of your ntoskrnl.exe? I think with XP you have a go-back feature for single files...
Or, you might be able to extract a copy of ntoskrnl from one of the XP install discs. Don't ask me which one, though. It might clear your problem...
"One day while logged on as root, I was experimenting with pipes, so I typed 'ls -l > /dev/hda'. The one thing I learned from that experiment was that I need to experiment with backing up more often :) "
Hi!
Try Tiny Personal Firewall to detect open ports & their apps. Is like $netstat -lnp in Linux.
You can detect some trojans, but if he/she changed the kernel, your game is over.
Good Hunting!
ByE!
Groby
try this tool : network monitor to check which port is open and where it wants to connect to the remote endpoint. www.leechsoftware.comQuote:
Originally posted here by hass
It appears that my Sygate Personal Firewall has let in a hack that has modified my ntoskrnl.exe. I have not accepted the changes that it has made but my security log tells me it is trying to broadcast out everyday and considers it a major security breach. It is trying to go out on my UDP ports and it is using Net Bios. I have shut off printer sharing. Can anyone tell how to rid myself of the little devil.
Re: original post...
You say you have printer sharing off, but do you also have
file-sharing turned off?