Ok What could this Be?

Printable View

April 14th, 2004, 02:19 PM
Und3ertak3r

** Ok What could this Be? **

Story,

A friend phoned my up asking for tech help..(shoot the bastard).. His machine was hanging on shutdown.. the file KCfetaic.exe ..

OS: WinXP pro

A quick Google revealed nothing.. that don't mean much..

the i got him to d/l some of my regular tools.. Spybot and adaware were clean reports.. next CWShredder.. it errored half way through and closed out..

Next the HJT log.. had him email it to me..

while I perused the HJT log I had him restart in safemode and re-run the scanns including a AVG scann.. clean.

A scann of the registry for the file name.... no mention.. OK.. Rename the bugger

now .. lets ahve a look at the Firewall logs.. Zonealarm.. ouch every prog he was using in the last 2 hrs were being blocked.. ?? we are talking about even wrodpad..

Ok this file may be used by another prog and therefor won't have a registry entry.. so what prog.. I didn'tt get him to d/l a process viewer..

Location of the File.. c:\windows\system32\ ..0k we renamed it.. and moved it

Restarted in the machine in Normal mode.. Zonealarm was poping mad. " " program was trying to access the internet?? rechecked taskmon.. no strange entries.. shutdown the machine and restarted.. no problerm.. and no probs with ZA.. Had him run The Cleaner.. only files he had were Istbar.. nothing else ..

I had him go in and disable a number of unwanted services.. and email me a copy of the renamed file..

I will post a Ziped version of it here for those who wish to have a look.. a quick look using a hex editor nothing stands out.. the text "instructions" toward the end of the file could be a clue.

but not being into reverse engineering software.. have a lok if you like.. I will be putting it into my Crash Test Dummy in the next day or so to see what it does if anything..

Now don't get bitten..

Cheers
April 14th, 2004, 02:31 PM
owensleftfoot

The strings command under linux comes up with -
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
htonl
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
Sleep
TerminateProcess
TerminateThread
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
_itoa
__GetMainArgs
_sleep
_strcmpi
_stricmp
atoi
exit
memcpy
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL

Definitely something network related.
April 14th, 2004, 02:44 PM
SirDice

Dumped it in IDApro. Looks fishy. At first look it indeed uses WinSock and a few registrykeys. Unfortunately some of it is XOR'ed so I don't know what keys and/or what it actually does. I'll get back to you as soon as I know more.
April 14th, 2004, 03:58 PM
disturb

its some type of trojan or hijacker my computers alarm went off and it was trying to change alot of stuff like my home page.

but neither did my antivirus detect it nor my active anti spy scanners(scans memory)

im going to do some resarch

Ps sorry for my spelling
April 14th, 2004, 04:10 PM
Tiger Shark

Undies: Looking at the strings output and hearing what others experience when "playing" with it I would submit it to Symantec or whoever you prefer. It certainly doesn't appear kosher.
April 14th, 2004, 04:12 PM
disturb

now its trying to change my home page every 5 minutes

I atached the results to the file :borg:
April 14th, 2004, 06:56 PM
disturb

can some find out how to remove this thing it realy pissing me off it keeps on changeing my home page to about:blank and I am woried because it keeps on trying to turn my autocomplete on (i always have it off becouse password theft trojans use autocomplete)

can some one hury and find out how to remove it
:eek:

sorry for bad spelling
April 14th, 2004, 06:59 PM
phishphreek

No offense... but:

If you didn't know what you were doing... why did you open it in the first place?
Any on top of it all... you didn't even use a test box. :rolleyes:
Its not good to go opening all kinds of attachments... even if they were posted here by a respected member.

Do you have xp? If so, do a system restore... and pray that it works.

Or, wait till everyone else knows whats up. I'm sure they'll update their findings.
April 14th, 2004, 07:11 PM
Tiger Shark

ROFLMAO........

Seriously, wtf did you think you were doing. You had been told that it was, (at an absolute minimum), "odd"..... You were told it wasn't recognized by the "standard" tools as anything special therefore there would be no automated removal tool. It doesn't seem like you were running regmon, filemon etc. so your could track what it did and reverse it yourself yet you still went and installed it on a "production" box.

No offense but I really have no sympathy.... Computer security isn't about blindly trying things to see what they do. It is about controlling the environment and logging and tracking events to determine what _exactly_ goes on so that it might be able to be reversed or mitigated. In extreme circumstances that might mean restoring the entire drive from a pre-made image, (such as on a "lab-rat" box that can be destroyed and rebuilt with no loss). Your "production" box isn't the place to be messing with things you don't understand.

I just hope others read this and don't make the same silly mistake you just did.... At least then your foolishness will have benefitted someone here......
April 14th, 2004, 08:05 PM
sumdumguy

LOL (@disturb) you gotta be kidding me. try running hijackthis now disturb and post your log.

I haven't had time to run it through my trojan scanners yet.. that box keeps on blue screening me.. I have bad memory in it and limp by.. but now on one of my kids boxes i ran it thorugh pestpatrol's advanced analyze a file feature and indeed it does want to connect to the net..

here's the output from pestpatrol

File: C:\UTIL\virustemp\Kcfepaic.exe
Size: 201,728 bytes
Pest: Not a known pest
MD5: 77930adafd715fc68860f615743f51b5
Running/Active?: No.
Creation Date: 04/13/2004
Last Write: 04/13/2004
DLLs Referenced: wsock32.dll
Text: .hqojh jx-E: -U:g/ WI A EC1VJ ox.p ox.ph /Dpi Dpi Dpi p3xop;xhp0x OF Q.U.LK,c OF.Z-R. XA2xg5E OF.Up .UpDG C6u E3Xo 1gPsu PSUA r.A6H 2J6o Fu r.B6O p1I 3Xa; ,I.UpX ;a WSAGetLastError WSAStartup WSAFDIsSet accept bind closesocket connect gethostbyname htonl htons inet addr ioctlsocket listen recv select send socket CoCreateInstance CLSIDFromString CoTaskMemFree CoInitialize CoUninitialize SysAllocString DeleteUrlCacheEntry FindFirstUrlCacheEntryA FindNextUrlCacheEntryA ExitProcess ExitThread ExpandEnvironmentStringsA FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileSize GetFileTime GetLocalTime GetModuleFileNameA GetModuleHandleA CloseHandle GetProcAddress GetSystemDirectoryA GetTempPathA GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetWindowsDirectoryA GlobalMemoryStatus CopyFileA InterlockedIncrement IsBadReadPtr IsBadWritePtr LoadLibraryA CreateDirectoryA LocalAlloc LocalFree OpenFile OpenMutexA OpenProcess PeekNamedPipe CreateFileA ReadFile RemoveDirectoryA RtlUnwind SetFileAttributesA SetFilePointer CreateMutexA Sleep TerminateProcess TerminateThread CreatePipe VirtualQuery A CreateProcessA WaitForSingleObject WideCharToMultiByte WinExec WriteFile lstrlenA lstrlenW CreateThread DeleteFileA GetWindowTextA GetWindowRect FindWindowA GetWindow IsWindowVisible GetClassNameA GetForegroundWindow LoadCursorA SetTimer KillTimer RegisterClassA GetMessageA CreateDesktopA SetThreadDesktop GetThreadDesktop TranslateMessage DispatchMessageA SendMessageA CharUpperBuffA OemToCharA PostQuitMessage ShowWindow CreateWindowExA DestroyWindow DefWindowProcA GetStockObject DeleteObject RegCreateKeyExA RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA GetSecurityInfo SetSecurityInfo SetEntriesInAclA itoa GetMainArgs sleep strcmpi stricmp atoi exit memcpy memset raise a rand signal sprintf srand sscanf strcat OLEAUT32.DLL WININET.DLL KERNEL32.DLL USER32.DLL ADVAPI32.DLL
File Type: .exe file.
Compression: No compression or unknown compression method.
Language: Unknown Language.
Notes: Connects to the Internet.
Caution: Use this automated file analysis with caution. Please do not substitute these results for good judgment.

after I get back from my tax accountant.. I'll see what other scanners say..
and maybe try w32dasm..

edit : ooops.. I hadn't looked at disturb's picture.. looks like he had the same idea as me.. sorry
April 14th, 2004, 08:43 PM
nebulus200

Wish I had more time to play with this, but ran an 'od -c' on the binary (was hoping to catch a look at what data was being passed to the particular calls, like gethostbyname, etc...

Might look around in there and see if you can kind a packed address that it is trying to connect to...

Quote:

0167100 W S A F D I s S e t \0 \0 5 \0 a c
0167120 c e p t \0 \0 \0 \0 6 \0 b i n d \0 \0
0167140 7 \0 c l o s e s o c k e t \0 \0 \0
0167160 8 \0 c o n n e c t \0 \0 \0 ; \0 g e
0167200 t h o s t b y n a m e \0 E \0 h t
0167220 o n l \0 F \0 h t o n s \0 G \0 i n
0167240 e t _ a d d r \0 J \0 i o c t l s
0167260 o c k e t \0 \0 \0 K \0 l i s t e n
0167300 \0 \0 \0 \0 O \0 r e c v \0 \0 T \0 s e
0167320 l e c t \0 \0 \0 \0 U \0 s e n d \0 \0
0167340 Z \0 s o c k e t \0 \0 \0 \0 j \0 C o

Anyone brave enough to try pulling this up in a debugger? I'd be real curious to know what
was at those memory blocks...I get the feeling it may be some kind of a trojan, or even a worm ... dunno, like I said, wish I had more time to play with it :(

EDIT: Since I don't really have time to mess with it, I submitted to securityresponse@symantec. I will post any feedback I get from them.

/nebulus
April 14th, 2004, 09:49 PM
meeeeeee

Hey all - this 100% sounds like the newer version of the CWS trojan. Try to kill it by running CWShredder in safe mode. The file name is random I believe and will mutate if overly harassed. Here's what the experts are recomending:

1) Boot into safe mode
2) Run HijackThis but don't check anything to be fixed yet
3) Run CWShredder (make sure you have the newest version!!)
4) In HijackThis select the offending file and "fix" it.

Your problem should have cleared up by then. Good luck!
April 14th, 2004, 10:09 PM
nihil

Otherwise Disturb,

Boot into safe mode and go into the "immunise" bit of SpyBot S&D............check the boxes to protect your hompage and IE settings.

It just might work?

Cheers
April 14th, 2004, 10:38 PM
Und3ertak3r

Quote:

next CWShredder.. it errored half way through and closed out..

we tried CWShredder after renaming the file.. and no detection..

here is a copy of his HJT log BEFORE we moved and renamed the file:

Logfile of HijackThis v1.97.7
Scan saved at 8:06:58 PM, on 14/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Telstra\Toolbar\bpumTray.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ScannerU\AM32.exe
C:\Program Files\keyexp\KEYEXP.EXE
C:\Program Files\WallpaperToy\Wallpapertoy.Exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Downloads\HijackThis.exe
C:\Program Files\MSN Messenger\msnmsgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kingsofchaos.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kingsofchaos.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.kingsofchaos.com
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.kingsofchaos.com/"); (C:\Documents and Settings\XX-RENAMED-XX\Application Data\Mozilla\Profiles\default\mtl86eg6.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\XX-RENAMED-XX\Application Data\Mozilla\Profiles\default\mtl86eg6.slt\prefs.js)
O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [BigPond Toolbar] "C:\Program Files\Telstra\Toolbar\bpumTray.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: Keyboard Express 2000.lnk = C:\Program Files\keyexp\KEYEXP.EXE
O4 - Startup: Wallpaper Changer.lnk = C:\Program Files\WallpaperToy\Wallpapertoy.Exe
O4 - Global Startup: Action Manager 32.lnk = C:\Program Files\ScannerU\AM32.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/game...ts/y/et1_x.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...034.0635532407
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab

NOTE: Changed the UserNAme to XX-RENAMED-XX:

It seems that Flashget has the Istbar parasites, not sure about the Av he is using as well..

HE Claims that it is a week since any new software has been installled.. If that log was mine there would be a few removals, I never liked Incredimail after Yaha walked straight past AVG and NAV (5 machines), and yet machines I tested that were using OL or OLEXP the email scann stopped the bug..

HAve also submitted the file to Symantec..

It seemed just renaming the file in safemode was enough to stop activity..

And please PLEASE If you decide to play with these files,:
DONT do it on a production Machine (ie one that it will take dayes to recover and or you don't want to lose valuable data)
DO so on a TEst machine that is not connected to a Network.
And if something goes wrong.. you are prepared for the worst

NExt time I do this sort of a post I will remember to post the above warning..

Work is calling..

Cheers guys.. and thanks to those who have had a look
April 14th, 2004, 10:46 PM
sumdumguy

well, I did run it through what I had for scanners and nothing comes up.. I tried w32dasm, and when I try and open it.. w32dasm shuts down but it very well could be related to the problems I have with this box..

meeeeeee, you've seen evidence (or posts somewhere) with CWS's install/run files being random ? hmmmm.. well, it does look like it should be submitted to a number of places.
I think I may take a fresh hard drive, install an os.. put registryprot on it and then try running the file to see what entries it tries to throw in the registry.. maybe let it infect a bit as well.

as far as I know, these are the known sites that are connected with CWS.. so Und3ertak3r, or disturb.. see if any of these are found in the registry/ IE's start page.

193.125.201.50, 1stpagehere.com, 66.250.130.194, adulthyperlinks.com, allhyperlinks.com, approvedlinks.com, bannedhost.net, bestcrawler.com, cantfind.com, carsands.com, cool-web-search.com, coolfreepage.com, coolwebsearch., coolwwwsearch., couldnotfind.com, defaultsearch.net, dev.ntcor.com, drvvv.com, ewebsearch.net, findloss.com, findwhat.com, firstbookmark.net, freebookmark.net, freebookmarks.net, global-finder.com, globesearch.com, gratis-porn-movie.com, hardloved.com, itseasy.us, jethomepage.com, jetseeker.com, kazaa-lite.ws, martfinder.com, mature50.com, mommykiss.com, mywebsearch.net, noblindlinks.com, nocensor.com, ok-search.com, pedo.ws, runsearch.com, search-2003.com, search.xrenoder.com, searchdesire.com, searchnow.ws, searchv.com, searchxp.com, sharempeg.com, sixroads.com, slawsearch.com, slotch.com, stopxxxpics.com, super-spider.com, super-websearch.com, the-exit.com, the-huns-yellow-pages.com, topsearcher.com, unipages.cc, web-search.tk, white-pages.ws, youfindall.com, youfindall.net, yourbookmarks.info, and yourbookmarks.ws

edit : we posted at around the same time..

kingsofchaos.com.... huh ? that's just a game.. so it's not a hijacker ?
April 14th, 2004, 10:53 PM
Tiger Shark

Undies:

Quote:

NExt time I do this sort of a post I will remember to post the above warning..

I'm going to make a "Catch comment" here......

Bollocks, (that's my own unique interpretation.... ;)), let them learn!!!! You don't go up and slap a Lion in the face simply because "it's just a big pussy cat" do you? If they are here to learn security then they will learn more from the mistakes they make than they will listening to old farts reminiscing about how (l)user A screwed up their system by some little piece of stupidity. Pain, (in the format c: category), taught me a lot of what I know..... There's a lot of good advice here about how to "play" with "funny stuff'..... they should probably read more before they start messing with stuff the clearly don't understand.....

Thats my story.... and I'm sticking to it.....
April 14th, 2004, 10:58 PM
AxessTerminated

sounds like a worm to me. that string set reveals a few things:
send - possibly to send itself
socket - to open a Windows socket
CoCreateInstance - create another instance of itself
GetSystemDirectoryA - why would it want system directory and temp directory? infection?
GetTempPathA
OpenMutexA - creates a mutex everytime it runs, like MSBlaster, so as not to waste time reinfecting a mchine. if it has the mutex, move on.
Sleep - wait to check if theres an available internet connection
wsock32.dll - needed for internet connection
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
All of the registry keys are to assist in starting the prog upon system boot.
It looks like a typical worm, but with a couple of treats for your pleasure. I believe there may be a trojan attached, and malicious intent for your data. Submit it to Symantec, and someone should open this in a debugger, I have a test box to mess with tonight, so I can dig around a bit. It doesn't have internet, so it shouldn't be too bad.
April 14th, 2004, 10:59 PM
sumdumguy

(to tiger and others about the warning)

yeah.. but he DID warn everyone in his first post.. that was enough in my book..
April 14th, 2004, 11:25 PM
disturb

Quote:

[i] as far as I know, these are the known sites that are connected with CWS.. so Und3ertak3r, or disturb.. see if any of these are found in the registry/ IE's start page.

193.125.201.50, 1stpagehere.com, 66.250.130.194, adulthyperlinks.com, allhyperlinks.com, approvedlinks.com, bannedhost.net, bestcrawler.com, cantfind.com, carsands.com, cool-web-search.com, coolfreepage.com, coolwebsearch., coolwwwsearch., couldnotfind.com, defaultsearch.net, dev.ntcor.com, drvvv.com, ewebsearch.net, findloss.com, findwhat.com, firstbookmark.net, freebookmark.net, freebookmarks.net, global-finder.com, globesearch.com, gratis-porn-movie.com, hardloved.com, itseasy.us, jethomepage.com, jetseeker.com, kazaa-lite.ws, martfinder.com, mature50.com, mommykiss.com, mywebsearch.net, noblindlinks.com, nocensor.com, ok-search.com, pedo.ws, runsearch.com, search-2003.com, search.xrenoder.com, searchdesire.com, searchnow.ws, searchv.com, searchxp.com, sharempeg.com, sixroads.com, slawsearch.com, slotch.com, stopxxxpics.com, super-spider.com, super-websearch.com, the-exit.com, the-huns-yellow-pages.com, topsearcher.com, unipages.cc, web-search.tk, white-pages.ws, youfindall.com, youfindall.net, yourbookmarks.info, and yourbookmarks.ws

kingsofchaos.com.... huh ? that's just a game.. so it's not a hijacker ?
[/B]

I dont know what i was thinking opening that :brickwall

now im realy going to sound stupid :how do i do this
April 14th, 2004, 11:40 PM
Tiger Shark

Disturb: This is the basis of your problem.... You ran something with no monitor on it that was probably going to do "bad" things and now you don't know what to do.....

At this point you need to use regedit to search for every individual string sumdum put up there and if they come up examine the entry and chose to delete it or not....

Your problem... sorry... silly move in the first place.....
April 15th, 2004, 12:08 AM
disturb

this is the log from hijack this
April 15th, 2004, 02:59 AM
sumdumguy

thing is tiger.. it's not a hijacker.. and it's not CWS..
and undies log didn't even show that file as running..
now hijckthis can't see hidden files unless windows explorer is set to view them.. so i think that's why is wasn't visable..

same thing in your log, disturb.. I don't see the file (that undertaker said) running..

these lines show evidence of mutated names..

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\upnPtDFsHISV.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\igDwsThbSdrq.exe

you know what I would do ? in safe mode.. use your windows/ find files and folders
in the date tab, search for all files found created at.. and pick your time frame.
all the files will probably be small so you can use the advanced tab to limit size to
let's say.. less than 100k.. or even 50k

examine and write down all files that look suspicious.. google them on another box
if you have one.. rename them.. change the extention on them.. move them off
onto a floppy if you want to save and examine. record what you did and found.

a quick look at your log.. it pretty much looks clean.. you do have wildtangent
but that ain't too big a deal..

you certainly can delete these two files from the cleaner directory
upnPtDFsHISV.exe
igDwsThbSdrq.exe

make note of their size.. see if there are any other files like that in the cleaner directory.
do your work in safe mode.. if windows says they can't be deleted.. try changing the files attributes if they are set to hidden or system files.
April 15th, 2004, 03:07 AM
PM8228

Would someone like me to be brave and IDA Pro this sucker?

-Cheers-
April 15th, 2004, 04:07 AM
disturb

Quote:

[i]
you certainly can delete these two files from the cleaner directory
upnPtDFsHISV.exe
igDwsThbSdrq.exe

make note of their size.. see if there are any other files like that in the cleaner directory.
do your work in safe mode.. if windows says they can't be deleted.. try changing the files attributes if they are set to hidden or system files. [/B]

no those arent the bad guys those are the two programs that let my know what that file did

it looks mutated because there running in stealth mode (so no trojan can kill them) the name and size change every 5 minutes.those two programs are my body gaurds
April 15th, 2004, 04:29 AM
sumdumguy

oh yeah.. my bad.. I've never use the active stuff from thecleaner.. and didn't realize that the names change.. I guess you learn something new everyday.. hehe.. I googled them, found nothing and assumed they shouldn't be there..

so.. then hijackthis doesn't see anything in the startup/run area.. did you set windows explorer to show hidden files ? did you try searching around your drive for newly created/accessed files ?
April 15th, 2004, 09:06 AM
SirDice

Quote:

Originally posted here by PM8228
Would someone like me to be brave and IDA Pro this sucker?

I'm already working on it. As far as I know right now the .text and .data segments are XOR'ed with different values then it jumps to an address inside the .text segment. Unfortunately I cannot seem to get the correct XOR values so I don't know what exactly is does after the decode.
April 15th, 2004, 10:21 AM
Scriptersx

If some one has a space comp n hub maybe you could try see what its spitting out to the net, to determin if its a trojan or not
April 15th, 2004, 12:37 PM
SirDice

Well, I finally got my decoder working :) It looks alot like spyware to me. With the option of getting instructions from a website. Most of the registry strings I found referred to Internet Explorer regkeys. I didn't find anything relating to the Run keys.

URL for instructions/logging:

http://ussrforeva.com/wcmd.txt
http://ussrforeva.com/ppslog.php
http://ussrforeva.com/piplog.php?%s:...%02d:%02d:%02d

strings referring to the name of the probable coder:
TT coded by HT commercial version
_timofei_tokarev_rulez4ever

Some files that maybe interesting:
clctk.dat
tt32.dat
Rtdx1????.dat (???? probably a random number)

If anyone is interested I can create a .LST file containing a slightly sanatized disassembly.
April 15th, 2004, 01:04 PM
PM8228

Quote:

If anyone is interested I can create a .LST file containing a slightly sanatized disassembly.

*Raises hand.

-Cheers-
April 15th, 2004, 02:25 PM
nebulus200

Hey got this back from Symantec:

Quote:

We have analyzed your submission. The following is a report of our
findings for each file you have submitted:

filename: C:\Documents and Settings\Administrator\Desktop\Kcfepaic.exe
machine: XXXXXXXX
result: This file is infected with Backdoor.Berbew.C

Developer notes:
C:\Documents and Settings\Administrator\Desktop\Kcfepaic.exe is non-repairable threat. NAV with the latest beta definition detects this. Please delete this file and replace it if neccessary. Please follow the instruction at the end of this email message to install the latest beta definitions.

Symantec Security Response has determined that the sample(s) that you provided are infected with a virus, worm, or Trojan. We have created beta definitions that will detect this threat. Please follow the instruction at the end of this email message to download and install the latest beta definitions.
April 15th, 2004, 02:46 PM
Tiger Shark

I have received the same stuff back from Symantec before.

Quote:

NAV with the latest beta definition detects this.

I take this to mean that this is a new threat.... Or do Symantec expect people to be using the beta definitions all the time?????
April 15th, 2004, 02:50 PM
SirDice

Ah.

Quote:

Backdoor.Berbew is a Backdoor Trojan Horse that is downloaded from the Internet by Trojan.Download.Berbew. The Backdoor Trojan steals passwords and delivers them in the form of URL requests to the Web site of the Trojan's creator. Port numbers 7714 and 8546 may be opened for listening (the port numbers may vary).

That explains the html-forms and the WNetEnumCachedPasswords I found inside.
Interresting code, it'll keep me busy for a while ;)
April 15th, 2004, 02:54 PM
nebulus200

Quote:

Originally posted here by Tiger Shark
I have received the same stuff back from Symantec before.

I take this to mean that this is a new threat.... Or do Symantec expect people to be using the beta definitions all the time?????

Think this says it all:

Quote:

We have created beta definitions that will detect this threat.

So I would take that to mean it is new :)
April 15th, 2004, 03:03 PM
Und3ertak3r

Dambed.. I may have to change my deoderant.... haven't recieved a reply..yet..

may also have a name with sophos.. this is for earlier versions..

http://www.sophos.com/virusinfo/anal...ojwebberd.html

cheers
April 15th, 2004, 03:21 PM
disturb

I knew that it was a password stealing trojan thats why it was turning auto complete on so that it Could get cached passwords

I got it off my computer

and it was worth opening the file I learned alot
April 15th, 2004, 03:37 PM
disturb

http://vil.nai.com/vil/content/v_100488.htm

theirs alot of information on the trojan
April 24th, 2004, 09:18 AM
Und3ertak3r

a little over a week later:

NAV now detects it..
AVG..???? says clean
trend micro..???? was still in the cue being analysed 2 days ago

And I noticed that NAV have listed a D version .. info here

http://securityresponse.symantec.com....berbew.d.html

Can't find jack for the c version we found....yet..

Cheers
April 25th, 2004, 08:35 AM
nihil

Just for information, e-trust EZ armor detects it as:

Win32.webber.trojan

And won't let you download it

Cheers
April 25th, 2004, 03:23 PM
ammo

Interesting thread!

Might be interesting to find out what kind of network traffic it sends out and receive and perhaps make a snort sig out of it... (Although I don't have time; studying for finals...)

Ammo
April 26th, 2004, 12:07 AM
Und3ertak3r

Yep Johnno,

this is the list of AKA's from CA..

http://www3.ca.com/threatinfo/virusi....aspx?ID=35848

Quote:

Also known as: Downloader-DI (McAfee), Trojan.Downloader.Berbew (Symantec), Troj/Downloader.DI!38c6 (MessageLabs), W32/Heloc.A@m (F-Secure), W32/Heloc@mm (MessageLabs), Win32/Webber.10.Trojan , Win32/Webber.D.Dowlnoader.Trojan, Win32.Webber.E , Win32/Webber.ELoan.Downloader.Trojan, Win32/Webber.HookDLL.Variant, Win32/Webber.Trojan, TrojanProxy.Win32.Webber.10 (Kaspersky)

So the AKA's are Berbew, webber, Heloc, Padodor ............................................. missed any?

Cheers

** Ok What could this Be? **

Ok What could this Be?