port 6667 activity

hmmm something went wrong when I posted... Oh well, here goes again. So I got a win2k server set up on the internet as a mail server and it patches itself about once a week (ms patches). The other day I notice the traffic has just about doubled. I did a netstat -a to see connections and I see a connection originating from my machine (port 1039 standard, I know) to port 6667 on someone's IP address. So I ran a full scan with NAV and found nothing, then I went and downloaded the cleaner by moosoft and ran that and it picked up nothing. The Cleaner also comes with a component that maps processes to ports and the one above didn't even show up. Then I checked the run keys in the registry and didn't find anything suspicious looking. Anybody have any idea what's goin on I know IRC listens on port 6667 and I saw some stuff on google about people using 6667 for DoS attacks, but I checked a few and looked for the files they said were found on the attacking machines. Alas I found nothing.

Thanks for your help
Greg

I deleted all 'previous' posts... heh... now this thread makes sense again :)

Why don't you give us the ip and we'll have a look .

BTW Negative : Get your roots sorted out and get that Belgian flag back in place :(

do a netstat with no flags and see what irc server

do a search on your computer for mIRC.ini

get fport from foundstone.com and run it from dos. this will map each port to the app using it See what app is using 1029

let us know what you find

The number "6667" definately sets an alarm off in my head....I remember reading about some trojan/worm/somethin-er-other that uses port 6667. I'll look, but I'm posting it just in case it triggers any memories from anyone else. I'll edit the post if I find anything. *goez lookin*

If it's not just an IRC server running, it can be *any* of these oldies but goodies:
Dark FTP
ScheduleAgent
SubSeven
DefCon 8
Trinity
WinSatan

Either get your hands on TCPView (my personal favorite process explorer) or as suggested, Fport will do the same thing without the pretty GUI.

You can get TCPView here:
http://www.webattack.com/get/tcpview.shtml

Hope this helps.

--TH13

i was going to suggest the pstool kit from systernals.com but its difficult for one to know what prosesses to kill until you see which ones are connecting to the net. usually process listers dont map to port.

the problem is mIRC serve-u and the others aren't trojans so NAV will not pick them up and the names of the exe's are changed so you dont recognize then amoung the processes. They can be installed by worms like muma or the newest one that exploits RPC or installed manually by someone whose broken into your machine

Quote:

---

usually process listers dont map to port.

---

Yep, most don't but TCPView is one of the few that does. :)

very cool thehorse13 thanks allot!

if this guy ever replys, we can throw (not through) a ton of stuff on there! :-)



TCPview comes from systernals as well...what a bunch of buds they are

its a gui but at least i can maintain my esoteric aire by calling it from the run box LoL

Yeah, I'm hoping that he'll post the output from one of the viewers we have suggested. ;)

just got back home...guess i didn't miss much

hi... i'm a newbie here. this problem posted by you is kinda interesting. i'm know too little about computer security, but i guess any of you would like to read this interesting article about an attack on a website using so called irc "zombies" that i accidently read. Part of it written like this


"Wicked's" response was to team up with two other hackers, all of whom tend and manage large fleets of "IRC Attack Bots". They launched a concerted and extended "packet attack" against grc.com. In the slang that I learned while monitoring their many conversations, they "packeted" us. They did this, not using any tool they had written, and not possessing the ability to create such a tool themselves, but using a powerful "IRC Bot" that had been passed around extensively. Neither Wicked nor his friends know who wrote it or even where it came from.

the url is at http://grc.com/dos/grcdos.htm

There are a few trojans/virusses out there that make their presence known through IRC.
If you are infected by them they (the malware) connects to an IRC server and just sits there. This will at least give the spreader(s) of the malware an IP address so they (the spreaders) will know who's infected. Some trojans will also accept and execute commands given through IRC.

Hook up a sniffer and look at the traffic. This will give you alot of clues as to what's actually happening.

Beware that the 6667 port *might* be a source port. In this case it *may* be normal traffic.
You should be able to tell what's what when you hook up the sniffer.

Thanks for your help everyone, a sniffer was my next idea but I'll do fport first. I'll be back in the office tonight, will let you all know what I find, thanks again.

Greg

Ok, here's what I've found so far....

Tcpview listed this
system.exe:2096 TCP my.ip.client.dsl.net:1039 218.22.2.153:6667 ESTABLISHED

System.exe was located in c:\winnt\system32

The only info I could find on this was here
http://www.sophos.com/virusinfo/anal...ushtro122.html

however the server.exe that it says is put in the winnt directory isn't there.

Anyway, I've stopped the process and removed the registry key that went with it, the connection did go away. So I'm guessing it wasn't the one sophos is talking about, might have just changed the name of an irc client or something not sure. Anyway, I'll prolly get a sniffer and start it up on a test server just to see what it's doing.

Thanks for your help
Greg

Just for fun I dumped the IP address into SamSpade. Here is what the outcome is:

08/05/03 22:09:37 IP block 218.22.2.153
Trying 218.22.2.153 at ARIN
Trying 218.22.2 at ARIN

OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU

NetRange: 218.0.0.0 - 218.255.255.255
CIDR: 218.0.0.0/8
NetName: APNIC4
NetHandle: NET-218-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS.RIPE.NET
NameServer: RS2.ARIN.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/info/faq/abuse
Comment:
RegDate: 2000-12-07
Updated: 2002-09-11

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3100
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2003-08-04 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

Quote:

---

Backdoor.IRC.Flood.F is (**NOT THE SAME AS THE Backdoor.IRC.Cirebot THAT UND3RTAK3R WARNED US ABOUT**) a Backdoor Trojan Horse that will attempt to connect to an IRC server on port 6667. Once the Trojan is connected to the IRC server, it waits for commands from its creator.

---

So horse, you may be in danger of having this trojan

http://securityresponse.symantec.com...c.flood.f.html


May want to check the URL out.

BD]Hobbit

if you query apnic directly:

whois -h whois.apnic.net 218.22.2.153 ...
% [whois.apnic.net node-2]
% How to use this server http://www.apnic.net/db/
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 218.22.0.0 - 218.23.255.255
netname: CHINANET-AH
descr: CHINANET Anhui province network
descr: Data Communication Division
descr: China Telecom
country: CN
admin-c: CH93-AP
tech-c: JW89-AP
mnt-by: MAINT-CHINANET
mnt-lower: MAINT-CHINANET-AH
changed: [email protected] 20010528
status: ALLOCATED PORTABLE
source: APNIC

person: Chinanet Hostmaster
address: No.31 ,jingrong street,beijing
address: 100032
country: CN
phone: +86-10-66027112
fax-no: +86-10-66027334
e-mail: [email protected]
e-mail: [email protected]
nic-hdl: CH93-AP
mnt-by: MAINT-CHINANET
changed: [email protected] 20021016
source: APNIC

person: Jinneng Wang
address: 17/F, Postal Building No.120 Changjiang
address: Middle Road, Hefei, Anhui, China
country: CN
phone: +86-551-2659073
fax-no: +86-551-2659287
e-mail: [email protected]
nic-hdl: JW89-AP
mnt-by: MAINT-NEW
changed: [email protected] 19990818
source: APNIC


yet another reason to drop all packets from Asia

this is probably just where the irc is located. if you set up a sniffer then start system.exe and see what it sends, what room etc...if your curious or better still count your self luck you caught it. put up a firewall and keep your defs current.

Quote:

---

System.exe was located in c:\winnt\system32

---

It is really generic for someone to make system.exe and through it into a system folder, and quite a few virii and trojans do it. As for port 6667, that most likely is IRC but without a sniffer you would be unable to tell if it was IRC or the trojan sending information over it; it could also be both.

If you do want to find out more about exactly what this file was doing, you could replace it with a sniffer system or program installed either in between this machine and the internet (using snort) or also just a local packet sniffer on the same computer (analogX's packetmon would do fine).

Quote:

---

So horse, you may be in danger of having this trojan

---

BDHobbit, I think you're confused. I don't have a problem, I'm involved in trying to find one. ;)

waytallgel is the person who has the issue.

Its a graveyard IRC server in Korea. You got own3d. Best to run all your scrubbies and check your system, & change your pwds.

-Maestr0

Quote:

---

Originally posted here by Tedob1
yet another reason to drop all packets from Asia

---

Then I guess I won't be able to see my friends at AO anymore? :( Oh well...

Peace always,
<jdenny>

most hack attacks world wide come from the us. thats a fact. Bur id say 90 of the **** that happens in the US comes from SE Asis and wanadoo. spam and email server hacks codered nimda porn, the list goes on. At home and on my corp network asia among a few other areas are dropped incomming. If you dont have biz world wide its only prudent. with what the records show if i lived in another place id be blocking north america, but i dont and only have my oun server logs to judge by. i guess people feel theres less of a chance of geting in serius trouble if you do it in someone elses country.