questionable IP on log files...

A friend of mine got his computer hacked (or so he thinks) a week or 2 ago, so we have been doing hordes or research to ensure our computers are now trojan/virus free. Since that time I have been checking my log files (router log and zone alarm log) for anything unusual. I have an entry in my router log that says its an outbound active trojan (ass sniffer it's called according to linksys site).

there have been 15 outbound transmissions from my main computer to IP 65.29.202.xxx (would rather not expose the IP unless I know its a trojan for sure) in the past few days... they have been using all kinds of ports on my machine to send packets (mostly in the 1000-2400 range of ports) but have been consistently connecting to the remote machine on port 2330.

Now if I was to look into this further to see who's IP this is and where this trojan is stored to ensure I'm not just being paranoid, where could I start?

I run netstat frequently, but everything looks pretty normal, nothing unusual listening (although I might not know if something was amiss). I downloaded fport and use that to trace open ports to a program.

any other ideas?

almost forgot, im running windows 2000, service pack 3.

That domain is registered as follows:

OrgName: Road Runner
OrgID: RRMA

NetRange: 65.28.0.0 - 65.31.255.255

Have you implemented Access Lists on your router? If not, I would recommend this.
I would also get some Trojan Cleaning software just to be sure. Search the forums, you will find a heap of recommended software which will do the trick.

On a side note, have you been doing any FTPing (or vice-versa) to any Addresses within this IP range?

Since you are using ZoneAlarm all you have to do is block any transamission to or from that adress. Next download PestPatrol for a free trial. Use it to scan your hard drive and remove any pests (Trojans, RATS, Spyware, etc). If youre not impressed let it lapse, if you are impressed buy it. Also scan your system using your virus scanning program. That should leave you with a clean system at least for a while. I'll be glad to help if you need any more.

Mayhem

First you need to get a trojan cleaner and run it. Also, you said you're running zone alarm. If you are running the standard version (not Pro) you should make sure you have the latest version. Then you might try going to program control and select medium (you need pro to go to high). Then click on programs tab and set every permission on each program to "ask." This will ask you before performing an outbound transmission. Read the alerts carefully and if you don't recognize the program or know what it is doing, check the "remember this" box (or whatever it's called) and select no.

If you're running ZA Pro, go to advanced settings and shut down every port incoming and outgoing unless you need it for normal operation. Also, you might like to get ZoneLog (free) to help analyze your ZA logs.

i sugest to get a IP Hider (computer nerds best friend)

I thought ass sniffer was an old ip sniffer for mostly chat rooms? Does this mean the tool was used from your machine?

Thanks for all the responses guys,
Lets see....
Soggy, no ftping that I can recall to that IP range. If I had, there would be a port 21 in there somewhere I would think, which there is not. How did u find out where the domain is registered?

Mayhem, Since I noticed this I have blocked that IP on ZA. Thanks for the suggestion, that anti-pest program sounds like the ticket.

Gandalf, I am running the ZA pro version. I would set all programs to ask for permission to access the internet, but many of them may be used for normal operation and I just don't recognize that fact. For instance.. MStask.exe is always listening on port 1025. I did many searches on it and it seems like a legit M$ program so I let it be. My computer listens on ports 130, 135, etc... when I run fport, it tells me they are system programs. If I could tell somehow which programs are normal win 2000 pro programs needed for normal operation, I would be able to recognize the phony ones.

pak, according to a site I looked at ass sniffer is a trojan that uses chat rooms, but it seems like it uses IM chat programs most, like icq, AIM, yahoo, irc. etc.... I'm on icq a lot, so this would make perfect sense.

So, if I find out that this is a trojan, is there a way I can find out who is registered to this IP address so I can report him or at least let him know that I'm on to him? Would I have to contact his ISP to find that out?

find out who ip ranges belong to at.,..

http://www.arin.net/whois

if the address is european, it will tell you and you can get more info at

http://www.ripe.net

and asian

http://www.apnic.net

Hi Phite. One place you could look up information of this nature (names/orgs) that have registered IPs/IP ranges is with a whois search on something like ARIN or you could download a tool like Sam Spade which comes with alot of neat little tools for free. They also have a whois lookup on their site. You should be able to get contact information for whatever purpose, including notification of abuse. For detecting and removing trojans, you can download a 30-day trial of The Cleaner and register it afterwards if you are happy. I hear that people are usually pretty impressed with The Cleaner. I hope that helps a bit.


t2k2


Edit: Sorry to repeat, but IchNiSan saved his post 2 min before me! ;)

Just a handy reference document. Try shutting almost everything, then slowly opening up as a valid request is made to ZA Pro.

FYI,

The domain lookup I used can be found here:

http://www.alertsite.com/

I asked the FTP question because, although FTP does use port 21 to CONNECT, data is not transferred on this port (it used ports >1024 for data), and depending on whether it is Active or Passive FTP, will determine the direction of these high ports.

What a screwed up protocol!!!

You can read about it here:

http://www.slacksite.com/other/ftp.html

Good link Soggy Bottom.

Quote:

---

I asked the FTP question because, although FTP does use port 21 to CONNECT, data is not transferred on this port (it used ports >1024 for data), and depending on whether it is Active or Passive FTP, will determine the direction of these high ports.

---

Here, I think you may also mean that in Active FTP, port 20 is used for Data - as specified by your link. Passive uses the ports greater than 1024. At least, I think that's part of what you meant. I just didn't read it that way. ;)

Who is your ISP? Sometimes you will see inbound traffic from your provider. Also, what are the source and destination ports?

phite if it is a trojan you can notify the isp at [email protected]

thanks for all the responses guys, as I look more and more at my log files, I see more stuff that looks questionable and peaks my interest. Also, lately I have found some very unusual traffic that will have to be looked into. I think with all the good links you guys have provided, I should be able to do the research.

Something unusual happened yesterday though, I saw a whole bunch of traffic outbound from my computer going to a few different IP addresses but on ports that kept going up.. (ie.. outbound to 66.94.xx.xxx on port 1066, then outbound to 209.54.xxx.xxx on port 1067, etc. etc..). My Link Logger was going nuts with all the traffic, so I did a netstat and an fport to find out what was going on, I had a whole bunch of 1000 number ports open ("established"), like 12 or 15 open ports in total, not including the "listening" ones (I had already closed all IM programs and anything else that would open a port). At this point I got a bit nervous and hit the Zonealarm "stop all internet traffic". I gave it a minute and did a netstat again and still had maybe 5 ports open. I ran netstat to see who these destination IP's belonged to, and I saw "gamespy" quite a bit, for those of you that don't know, gamespy is a program that many online games use to connect to their game servers and keep track of online players. I have used them in the past but when I upgraded to 2000 pro, I deleted the gamespy directory. When I ran an fport to see which program had these ports open, I saw "PC-illin" which is my antivirus software. I have run "the cleaner" and it did not locate any trojans.

Anyway, the main question here is how can I have ports open (in the "established" mode), after I told zonealarm to shut down all traffic?

phite, I have never used ZA at home before, but if it works the same as Outpost does with respect to denying all internet traffic, then it would mean that it is now blocking any new connections from occurring. The reason why you saw a decrease in active ports after doing this could have been due to the sessions either timing out or ending normally. Afterwards, however, they should not have been able to establish any new sessions when you enabled the "block all traffic" setting.


t2k2

Ok, that makes more sense, but that also means that if a trojan has an established connection/port with the hacker at the destination IP, then I can't shut it down (aside from shutting the computer down or unplugging the cat5 cable)? There must be a way to manually close ports.

How long does it take sessions to time out (I assume they time out due to inactivity)?