boom.badpenguin.com and svshost

Hello ... I thought I'd start here as I am definately a security newbie. I am a sys-admin whose had the luxery of focussing on performance over the years, and ignoring security in my profession. But I've just spent a hellish 3 weeks trying to kill a trojan on my home system, and thought I'd see if anyone has anymore info.

I appear to have killed it, but it manifested itself as an executable in windows\system32 called svshost.exe (though it ran in task mgr as svChost.exe, same as the windows services one). My firewall (thank you zone alarm, lol) kept blocking in and out attempts from an ip that resolved to boom.badpenguin.com. I'm curious if anyone has any info about this domain or svshost.exe.

As, for me, it seems to be cured. svshost is no longer running, and zone alarm has no unusual traffic through it. But still, i'm curious for more info.

Cheers,
Elron

I just went through my Zone Alarm logs, and thge IP address was 66.98.168.220 ... boom.badpenguin.com no longer resolves, lol ... guess they figured advertising was bad, lol.

Any info would be appreciated.

Elron

A quick google search says that it is the Worm.P2P.Spybot.gen Virus. You got it from an infected file or P2P file sharing.

I'd recommend googling for these things in the future as any good AV software could have corrected the issue in a matter of minutes instead of weeks

Hmm ... well, I run AVG on a regular basis with updates, and it missed it. As did TrojanHunter. The only indication I even HAD a trojan was that Zone Alarm caught the traffic, and after about 3 hours of being unable to connect, it would blow my internet settings so my browser no longer connected.

So an anti-virus is NOT always an effective means of catching a trojan.

Not really sure what type of information your looking for, but that IP belongs to an ISP in Houston.

Quote:

---

OrgName: Everyones Internet, Inc.
OrgID: EVRY
Address: 2600 Southwest Freeway
Address: Suite 500
City: Houston
StateProv: TX
PostalCode: 77098
Country: US

NetRange: 66.98.128.0 - 66.98.239.255
CIDR: 66.98.128.0/18, 66.98.192.0/19, 66.98.224.0/20
NetName: EVRY-BLK-14
NetHandle: NET-66-98-128-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.EV1.NET
NameServer: NS2.EV1.NET
Comment:
RegDate: 2003-07-02
Updated: 2003-08-26

TechHandle: RW172-ARIN
TechName: Williams, Randy
TechPhone: +1-713-400-5400
TechEmail: [email protected]

OrgAbuseHandle: ABUSE477-ARIN
OrgAbuseName: ABUSE
OrgAbusePhone: +1-713-400-5400
OrgAbuseEmail: [email protected]

OrgNOCHandle: NOC1445-ARIN
OrgNOCName: NOC
OrgNOCPhone: +1-713-400-5400
OrgNOCEmail: [email protected]

OrgTechHandle: RW172-ARIN
OrgTechName: Williams, Randy
OrgTechPhone: +1-713-400-5400
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2003-12-24 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

OrgName: Everyones Internet, Inc.
OrgID: EVRY
Address: 2600 Southwest Freeway
Address: Suite 500
City: Houston
StateProv: TX
PostalCode: 77098
Country: US
Comment:
RegDate:
Updated: 2003-12-08

AbuseHandle: ABUSE477-ARIN
AbuseName: ABUSE
AbusePhone: +1-713-400-5400
AbuseEmail: [email protected]

AdminHandle: RW172-ARIN
AdminName: Williams, Randy
AdminPhone: +1-713-400-5400
AdminEmail: [email protected]

NOCHandle: NOC1445-ARIN
NOCName: NOC
NOCPhone: +1-713-400-5400
NOCEmail: [email protected]

TechHandle: RW172-ARIN
TechName: Williams, Randy
TechPhone: +1-713-400-5400
TechEmail: [email protected]

---

Cheers:

That'll do fine ... refresh my memory please ... how do you get that listing?

There are many different ways to get this info. For this one, I went HERE


Cheers:

Excellent ... thank you ... can you also tell me why I should have Generic Host Process for Win32 Services listening to ports 3002, 3004, and 5000? As far as I know, I should have NO servers running here ... I am on Win XP Home, btw.

you can whois the ip from following websites to get the above information

http://www.phaster.com/find_info_net_traffic.html

http://www.securityspace.com/swhois/whois.html

Quote:

---

Originally posted here by Elron
Excellent ... thank you ... can you also tell me why I should have Generic Host Process for Win32 Services listening to ports 3002, 3004, and 5000? As far as I know, I should have NO servers running here ... I am on Win XP Home, btw.

---

Here is some quick info on Generic Host Process & svshost. If your looking for more info. hit google.


Cheers:

Right ... thanx again ... useful info. Still didn't give me a reason for 3002, 3004, and 5000 to be active. Not overly concerned, since this machine is behind a 3com router which shows as stealthed on those ports, so they aren't listening beyond my house. Still, curious what they might be ... the only google info I can find on 3002 relates to a program, xic, i have never heard of ... for backend management of things ... hmmmm ... curious

Quote:

---

Originally posted here by Elron
Hmm ... well, I run AVG on a regular basis with updates, and it missed it. As did TrojanHunter. The only indication I even HAD a trojan was that Zone Alarm caught the traffic, and after about 3 hours of being unable to connect, it would blow my internet settings so my browser no longer connected.

So an anti-virus is NOT always an effective means of catching a trojan.

---

I just did a search through AVG's virus encyclopedia and they don't seem to have this virus listed when it is listed on McAfee and Trends website. I have no experience with AVG directly, but perhaps they are not as current with their .dat files as the other major players in AV scanning? They do have a general listing in their encyclopedia for the generic "spybot" virus type, but it is not as detailed as some of their listings, take lovsan for example.

Trend has had .dat files that would detect/clean this particular nasty since June of last year.

Have you always had a firewall on your system? Given that Worm.P2P.Spybot.gen can give a remote attacker complete control over your system perhaps other things have been installed which accounts for those strange ports you are seeing.

Most people around here will always recommend a complete system rebuild after you have been infected for any length of time. Just to be sure that everything is cleaned up properly.

Righty ... well, my specific config here is 2 computers, Win XP Home on both, connecting through a 3com router (fully stealthed) to a cable-based broadband. Thats the way its always been. However, I have run P2P share programs like Kazaa and the like, and the other computer has as well. This may be where the stuff came from. I have noticed AVG is better at viruses than it is at trojans and spyware. Still, a variety of stuff, from Ad-aware through Trojan Hunter missed the svshost one. The ONLY indication was the odd logs from Zone Alarm.

I may very well do a rebuild. Its been awhile, and I have always been a firm believer in rebuilding my windows systems regularly for performance and other reasons, so ite probably worth it anyway. Just a pain backing up the damn 40gb disk before-hand, grrrr.

Thanx for ALL the help ... much obliged.
Elron

mohaughn> Differnet companies use different naming conventions. worm/spybot on AVG is mostlikely the same thing...

That one worm is called:
Worm.P2P.SpyBot.gen [KAV]
W32/Spybot-Fam [Sophos]
W32/Spybot.worm.gen [McAfee]
WORM_SPYBOT.GEN [Trend]
Win32.Spybot.gen [CA]


btw... this one also connects to IRC, so your Firewall logs should have shown an IRC connection. Maybe that is how it was trying to connect to boom.badpenguin.com.

And don't just delete svshost.exe as that is a real system file.

Oh yeah, and as Elron pointed out... AVG is for virsues. It does some trojans/spyware, but thats what tauscan and adaware are for.

Thanx for the info Soulman ... I have a 24/7 IRC connection running anyway ... online gamer, lol. So it's not likely I would've noticed it based on that. Although, now you mention, I did also block some 6667 ports to the badpenguin (nice name eh? LMAO) a while back, so it likely cycles through the ports it uses as well. I have removed the svshost.exe file i found in system32 (well quarentined it) ... no ill effects found as yet. Are you thinking of svChost.exe, which is still there?

svshost.exe is the trojan. The system process is svchost.exe which is used to load processes dynamically from .dll's.

-Maestr0

http://www.antionline.com/showthread...134#post692134

Righty ... thats what I thought too ... svshost.exe will be toast shortly i think ... no point keeping the thing in a vile, unless someone esle wants to have a look at it before it goes.