HJT-log....rooted

This is what a log looks like that has been rooted. How many pieces of nastiness can you find in there?? And for the extra bonus, can you identify the rootkit involved? ;)


Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\srvany.exe
C:\WINNT\system32\srvany.exe
C:\WINNT\System32\svchost.exe
C:\winnt\system32\Shared\dllhost.exe
C:\WINNT\system32\srvany.exe
C:\winnt\system32\Shared\lsass.exe
C:\winnt\system32\firewall.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\srvany.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\system32\srvany.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mobsync.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\WINNT\system32\RevoTask.exe
C:\WINNT\system32\tlntsvr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINNT\system32\ctfmon.exe
C:\winnt\system32\dhcp\files\mdll.exe
C:\winnt\system32\dhcp\files\xscan.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINNT\system32\RevoTask.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Security Patches] WinLab32.exe
O4 - HKLM\..\Run: [timesettings] C:\PROGRA~1\Meow obj eq\byte mess gpl.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [Application] C:\winnt\system32\dhcp\files\hiddenrun.exe mdll.exe
O4 - HKLM\..\RunServices: [Security Patches] WinLab32.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: ICQ 4.1 (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...153.8308680556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab


No really, if you have any idea what rootkit this is from, please let me know. meeeeeeeeee and I have been looking all afternoon and not having alot of luck :D

Actually everything in there is malware as far as I can see.


This machine seems to be infected with adware, spyware, ZA, and Windows.

:rofl:

That makes Windows the rootkit right?

Congrats, groovicus, that might be the first HJT log of the one machine that contains all the spyware in the internet... did it take long for that to happen? :)

tlntsvr.exe..........Trojan
C:\WINNT\system32\services.exe...........related to above
Details Here: http://vil.nai.com/vil/content/v_99378.htm

It's a remote access threat, maybe part of your rootkit.

You also got a worm...WinLab32.exe
Details Here: http://uk.trendmicro-europe.com/ente...=WORM_SDBOT.GD

xscan.exe.......Hacktool
Details: xscan.exe

If this is a real machine and what people are saying is true, perhaps you may want to format? It may be quicker. BTW, it has Sasser, I believe. You can read the details at Symantec's site: http://securityresponse.symantec.com...oval.tool.html
Symantec Security Response - W32.Sasser Removal Tool

/edit - putting in all necessary words helps understanding. :D

Couple of things I noticed that don't look right. I'm on 2000 at work right now so I'm verifying what looks suspicious with my machine that's not infected with anything.

C:\WINNT\system32\srvany.exe - what is that and why are there multiple instances?
C:\WINNT\system32\firewall.exe - doesn't exist on my machine and I've never heard of that before so it sounds suspicious unless I'm completely wrong.
C:\WINNT\system32\RevoTask.exe - what is that? It's all over your machine.
C:\winnt\system32\dhcp\ - not sure, this exists on mine but mine is empty of anything. Might be legit but if so, that's the weirdest way I've ever seen DHCP being used...

Now for the registry stuff...

O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINNT\system32\RevoTask.exe - lose this
O4 - HKLM\..\Run: [Security Patches] WinLab32.exe - and this...it's the WORM_SDBOT.GD variant as found here
O4 - HKLM\..\Run: [timesettings] C:\PROGRA~1\Meow obj eq\byte mess gpl.exe - I have no idea what that could possibly mean/be/etc..lose it just in case unless you know what it is.

O4 - HKLM\..\Run: [Application] C:\winnt\system32\dhcp\files\hiddenrun.exe mdll.exe - there's that weird DHCP thing again...I don't buy that it's really dhcp because I've never known anything to be named "hiddenrun" and calling another executable at that. I'd lose it just in case because chances are, you're not serving out DHCP leases.

Lookup on 'hiddenrun.exe' revealed this thread here where it's shown as a method to hide execution of other scripts/etc. Bad news if you ask me...that's just like trojaning your ps/ls/find/top/etc programs in *nix to hide various bad things...

Hope this helps some...I'm no expert on the veritable thousands of windows exploits but I do know suspicious stuff when I see it. I'd go to another machine, download the latest NAV updates, download Ad-Aware and the latest reference file, as well as Spybot's S&D, and the SwatIt trojan-scanner, burn them all to a CD, then boot the infected machine up (unplugged from the network), install all that, reboot into safe mode, then scan the living hell outta it!

Ok here goes..


Pieces of Nasty!


C:\winnt\system32\firewall.exe
C:\WINNT\system32\tlntsvr.exe <-- May be part of the kit NASTY
C:\winnt\system32\dhcp\files\mdll.exe
C:\winnt\system32\dhcp\files\xscan.exe <--Also part of kit
O4 - HKLM\..\Run: [Security Patches] WinLab32.exe <-- more the IRC batch
O4 - HKLM\..\Run: [timesettings] C:\PROGRA~1\Meow obj eq\byte mess gpl.exe <-- says it all
O4 - HKLM\..\Run: [Application] C:\winnt\system32\dhcp\files\hiddenrun.exe mdll.exe <-- bye bye
O4 - HKLM\..\RunServices: [Security Patches] WinLab32.exe <-- blah blah
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 <-- prolly get rid of this anyway



things I thought at first
C:\WINNT\system32\RevoTask.exe <--

Quote:

---

This is the Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it; but changes to speaker setup and sound modification (Bass/Treble etc) will not be available.

---

here

C:\WINNT\system32\srvany.exe <--

Quote:

---

Application that is associated with Microsoft Windows NT 4, 2000, and XP Resource Kits and is used to run normal Windows applications as services.

---

here

C:\Program Files\Java\jre1.5.0\bin\jusched.exe <--

Quote:

---

checks the Sun site to see if newer Java versions are available.

---

Now while some of these look nasty there is a lot of things that are running because of programs you have chosen to run. Looks like the answer to your question is that IRC BOT bug that found its way in and propagated itself everywhere

Edit: grammer and such

Just FYI this line is LOP, a fairly common peice of malware, and nothing to be overly concerned with. It's the rest of the "ick" that's worrisome.

O4 - HKLM\..\Run: [timesettings] C:\PROGRA~1\Meow obj eq\byte mess gpl.exe

I'd be looking a bit futher than the hijackthis log to.

I'd be looking for any of the pstools aps that may have been uploaded. Or similar.

This is more a question than anything. Does hijackthis show hidden process and registry entries?? I ask because i came across the following:

Luckily many crackers are careless and portions of their rootkit can be detected. The trojaned files above often have configuration files that list which programs to hide and which to display. Often they forget to hide the configuration files themselves. Since /dev is the default location for many of these configuration files, looking in there for anything that is a normal file is often a good idea.

A rootkit, however, cannot affect processes that have _root_ in their names. In other words, when a system administrator, is analyzing the system log using Regedit.exe, he cannot see hidden entries, but just by changing its name to _root_regedit.exe, it will be enough for him to see all of them as well as hidden keys and registry entries. This is true for all programs – for example, Task Manager

Full artice here: http://www.windowsecurity.com/articl...vironment.html

It is naive to imagine you can tell what things are from their names. Does a Windows rootkit need to start up extra processes to be effective? No. Can it it hide entirely from this type of tools? Yes.

If a machine has definitely been compromised, there is never any valid course of action which doesn't involve a reformat (and very careful restore from backups)

Slarty

Unlikely, yes. Naive, no. You give people more credit than I do....I assume the skiddies are too lazy to make sure everything is properly hidden. ;)

I have seen rootkits where modules are visible so that the person who put it there in the first place could find it again...

Quote:

---

If a machine has definitely been compromised, there is never any valid course of action which doesn't involve a reformat (and very careful restore from backups)

---

Ditto, that was the advice given.

There are two types of "rootkit'. There is a kernel-mode rootkit and a non-kernel-mode rootkit. A non-kernel rootkit subverts individual utilities such as netstat, cmd etc. in such a way that certain things are ignored. So a subverted netstat would contain code that says

"IF listen_port = 12345 THEN NoPrint"

or cmd has a line of code that says

"IF dir_name = "Hackers stuff" THEN NoPrint".

So when you use the subverted tools they won't show you the things that would make you sit up and say "WTF is that?????" The same is done with Task Manager to hide processes etc..... It's quite insidious and why one must use trusted tools from trusted media that is read only, (hardware read only, not software), when you conduct a forensic investigation).

A kernel mode rootkit is even worse. The kernel itself is subverted. This means that anything can be hidden from any utility you want to run. Thus, in most cases, even trusted tools from trusted media are useless because they rely upon kernel functions to give them information.

In either case you are pretty much screwed if you have been rooted that deeply since the chances of being alerted to the compromise are slim to none even for high end users.

Even looking at the Task Manager is a waste of space in many compromises since each process listed there is made up of several "threads". The threads are not reported there and it isn't too far from trivial for a good coder to be able to attach a thread to a running process in such a way that it becomes hidden within it. There's a tool to list the running threads within each process but Google is down right now or I'd list it....... Sorry, memory failing..... It's either a sysinternals utility or a foundstone IIRC.

Hah.... so, there's PStat.exe for windows XP and PSList from sysinternals, (memory, memory, memory :rolleyes: )