Help me investigate trojan from 206.58.237.248

A while ago, I started noticing strange behavior in Internet Explorer. Whenever I did a search with Google, my search results would be modified to include extra links that I know Google would not return. When using View Source, as I suspected, the extra links were not in the HTML source.

I ran my AV and several spyware programs, which weren't able to detect anything wrong. So then I started to look for suspicious processes running and found one - kbdus.exe (probably random filename). I found the program in my System directory, and determined it to be the Win32/SillyDl trojan. I then did a search with another AV program that detects this trojan, eTrust, and found a copy of SillyDl.AT in my Temporary Internet Files called 77_156_i.abc.

I checked the date that this file was created and searched my computer for other files created on the same date. I found two files, both called "update", in my Temporary Internet Files. When reading these files, the contents of the first one is "none" and the other reads "dl=http://206.58.237.248/content/77_156_i.abc". Apparently, the DNS for this IP corresponds to update.requestlookup.net.

I guessing it's some kind of rogue search engine. However, I am suspicious that SillyDl is not the only trojan on my computer and it may have dropped some other trojans, backdoors or spyware into my system. I'd like to find out what. I'd also like to know exactly how this trojan got on my system. I assume it was some Windows/IE exploit, but I system should have all the recent MS patches on it.

Anyone familiar with this, or have any suggestions?

here is what symantec says about this virus (which they call download.trojan):

http://securityresponse.symantec.com...ad.trojan.html

just as a reccomendation to you, i would switch to using firefox and also i would make sure your virus protection is updated...

Yeah, my virus protection was updated when I did the scan.

According to Symantec:

Quote:

---

Download.Trojan does the following:

Goes to a specific Web or FTP site that its author created and attempts to download new Trojans, viruses, worms, or their components.
After the Trojan downloads the files, it executes them.

---

What I'd like to know is what it downloaded and executed on my system.

You're right, you've probably got bigger problems, I'd advise that you do a harder clean of your system. It will eliminate the possibility of any malware that is known to the vendors. After that, if you still have problems, let us know and we can help you out.

Follow this doc:
http://www.antionline.com/attachment...achmentid=4913

Make sure you follow the steps accurately, especially when it explains updating.

[off topic]
If anyone has any problems with me practically whoring this link, let me know. I've noticed myself linking it a lot more, I don't want anyone to think it's spamming. I think it's a good walkthrough, and I have had a lot of success with the non-malware literate. If anyone has any edit ideas for it, I'll be glad to make those changes.
[/offtopic]

Well, as I mentioned in the first post, I've done pretty much everything in that list. I hacen't tried scanning my system in Safe Mode yet, but I somehow doubt it'll turn up anything new. Still, I'll give it a shot.

The reason safe mode is different from booting up normally, is because it forces Windows to boot up bare bones. The reason malware is able to escape scanners, is because it is running code to avoid them. By booting up in safe mode, or going even further and using a boot disc, you are able to scan the files when they aren't being executed. There is a chance that you're infections are not handled by the vendors, I do see that happening more and more often (especially w/ hijackers).

We will be able to handle whatever malware you have, it's just that we don't want to spend our time working on something that is handled by a malware signature. It's safer to let a scanner do it, than to have us work on it manually.

Good luck, malware rarely escapes safe mode!

Yeah, I know.

Even in Safe Mode with the latest definitions, I don't think I've found what I'm looking for.

Search & Destroy found nothing. AdAware found a CAB file with SyncroAdX.dll in it, but I don't think this is infecting my system. My AV found Worm/Rbot.LD.1 (in prompt[1].htm) and JS/MediaTickets.B (in mtrslib2[1].js) but I've looked at both of these, and I don't think that they infected my system either.

what are you using as a virus scanning program??

Switching to firefox, though a good idea won't fix this in my opinion. We have been noticing a lot of the download.trojan coming through emails actually embedded in the messages. Get some decent AV and spyware removal. ClamAV on linux picks this up and cleans it out great.

Quote:

---

ClamAV on linux picks this up and cleans it out great.

---

Wouldn't that suggest that he use Linux then instead of Windows? Given that he is a home user (general assumption on my part based on the first post) this may not be a practical option. Perhaps it would be better to suggest using a non-IE based browser and an email program that users can disable HTML rendering in emails received (I would imagine Thunderbird or Eudora having these capabilities) amongst the other standard programs (AV, spyware, process listers, hijack listers, etc) that would be needed.

As for detecting trojans, one of the ol' standbys might help TheCleaner. I have found that it finds many trojans that AVs tend to miss.

Quote:

---

Switching to firefox, though a good idea won't fix this in my opinion

---

Switching alone won't fix anything, although a browser switch would be helpful along with regular updates.

markml: Can you post a "Hijack This" log?
http://www.spywareinfo.com/~merijn/downloads.html

First of all, I do not use any email clients with HTML renderers (like Outlook Express for instance). I am also familiar with the security epidemic in IE. These days, I usually disable scripting when I am at all uncertain about the integrity of a website. Not perfect, I know. But I'm not really looking for a Firefox VS IE sermon. I understand the pitfalls and advantages of IE compared to Mozilla.

What I am interested in, as mentioned in my initial post, is determining the nature of the specific outbreak I have discovered on my system. Oh yeah, I should mention that ever since I disabled the kbdus.exe process and deleted its registry key, the symptoms of Google being redirected have not shown up again. This does not mean that my system is clean. And to tell you the truth, I am not positive that it's the Download.Trojan mentioned above, because my AV, AntiVir, was never able to detect anything wrong with it. Neither were Trend Micro or eTrust, which detected the 77_156_i.abc file as SillyDl. I only conjectured that it might be the same after manually inspecting it and noticing the string "http://www.gloogle.com" inside of it, which is apparently a site that SillyDl tries to connect to.

As such I am not convinced that my system is clean, since A. kbdus.exe has not been positively identified, B. Download.Trojan/SillyDl seems to have the main purpose of downloading other trojans, which have not been identified, C. My research has not identified any trojan matching the specific symptoms I mentioned as being on my system, D. I do not know how my system was infected in the first place. It is not enough for me to conjecture that it might have been a malicious script in IE. I'd like to know the exact exploit used to know whether it has been patched or not since I've been infected.

I can try TheCleaner and maybe even ClamAV, if I want to bother mounting my Win2K partition in Linux. But it's ultimately hit-and-miss whether these scanners identify things that the others don't, and if they don't, I will not be satisfied. I am far more interested in knowledge that is specifically useful to my situation. Knowledge is power. More so than AV, which just gives a false sense of security to many users. I think it is a fairly good hypothesis that the trojan was downloaded from 206.58.237.248, at least if it is in fact SillyDl. But I do not have expert knowledge about this trojan, nor have I disassembled it to understand its inner workings.

But I have the same inclinations as you guys -- I do not want to cover territory that has already been covered. As such, I came here to ask if anyone else has knowledge, specific to my situation, that would be helpful. Thanks!

HiJackThis Log:
Logfile of HijackThis v1.97.7
Scan saved at 10:09:47 PM, on 10/27/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\notepad.exe
C:\WINNT\system32\svchost.exe
C:\Documents and Settings\MML\Desktop\HijackThis.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} (GDIChk Object) - http://www.microsoft.com/security/co...I/0/GDIChk.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

Hmm...well I guess counter.cab looks suspicious.

ClamAV is an awesome AV, but you do not need to mount it in linux. There is a windows port of clam, called ClamWin. You can run that in safe mode as well. Clam has had excellent, quick release defs, IMO.

Since you are more interested in actually finding the exploit, or where you're box is vulnerable, lets look at a few things.

1. What version of IE are you running?

Quote:

---

I assume it was some Windows/IE exploit, but I system should have all the recent MS patches on it.

---

2. What OS, service pack? You mention 2k, but make sure all the critical updates are installed (windows update) so we aren't chasing our tails. :D
3. Do you have your firewall enabled? You don't mention one.
4. Does anyone else use this computer besides yourself?

If you want to do a little more forensic work on your box, try checking out the tools at sysinternals.com, and also the sniffer, ethereal. Filemon, regmon, tcpview are all relevent to what you are trying to do.

C:\Program Files\AVPersonal\AVWUPSRV.EXE // What AV is this? There is a rapidly growing amount of bogus AV/Adware programs, such as eacceleration.
C:\WINNT\system32\NOTEPAD.EXE // Were you running these? There are trojans that replace notepad...
C:\WINNT\system32\NOTEPAD.EXE

Don't forget to keep updating your scanners... They usually come out with sigs a day or too after a new infection.

Yes, I was running that many copies of Notepad when I ran HiJackThis. AVWUPSRV.EXE is in fact my AV, AntiVir.

My System currently has Win2K Service Pack 3 and IE 6.0.2600.0000 with the following patches: KB819696, KB823182, KB823559, KB823980, KB824105, KB825119, KB826232, KB828035, KB828741, KB828749, KB835732, KB837001, KB839643, KB839645, KB840315, KB840987, KB841356, KB841533, KB841533, KB841872, KB841873, KB842526, Q323172 (Pre-SP4), Q324096 (Pre-SP4), Q326830 (Pre-SP4), Q326886 (Pre-SP4), Q329115 (Pre-SP4), Q329834 (Pre-SP4), Q329170 (Pre-SP4), Q810833 (Pre-SP4), KB817606 (SP4), Q329553 (SP4), Q814033 (SP4).

I am the sole user of this computer. The network connection I'm using has a hardware firewall on it, though I'm not running any software firewalls.

Quote:

---

I am also familiar with the security epidemic in IE

---

Are you sure..............if so why are you running v6.00.2600.0000,
when you should have SP1 installed and be patched to 6.00.2800.1106.

I would also recommend running Windows Update to see if you are missing anything there. AFAIK Win2k is at SP4 these days.

I know that it is a pain, but it is really essential. You see the slimeballs watch for MS patches and then go and write exploits for the vulnerabilities, knowing that many people don't keep their stuff up to date.

just a thought :)

True. So maybe my assertion was a little over-zealous when I said that my system had all the MS patches. I guess I could compare the security updates in IE SP1 and Win2K SP4 with the patches my system currently has to see if there are any exploits that might have been taken advantage of.

Hey, don't get me wrong.........................I am not saying load anything and everything that MS put out. I usually take a look every couple of weeks (unless there is an alert out) and only bother with those that affect the services and applications that I actually use or might use.

I am not sure about SP3 v. SP4 but there have certainly been several security patches in IE regarding trojan activity.

Might I also suggest that you download a copy of Belarc Advisor (it is free) and run it. Down the bottom left of the report you will see all the MS patches you have got and their STATUS.

My point being that you can download a patch that does not install properly. MS update thinks that you have it, so does not offer it again. Belarc will tell you of any of those so you can uninstal them and try again. It is obviously very dangerous if you think that you have a patch and it hasn't worked (could also make your system unstable)

:)

Thanks for the info Nihil,

According to Belarc, none of my hotfixes failed verification although a few were unmarked.

As an update, I downloaded ClamWin and had it scan the kbdus.exe file, but it didn't detect anything.

Also, I can't tell you why, but I've worked on some cases where proper updates allowed the scanners to pick up more objects that came through exploits (I've seen this in blaster and sasser, can't really say why). Maybe the fact that you are behind on some is impeding on your scans.

Yes, there are some that it cannot positively verify, that is normal. I still find it a useful diagnostic tool to have in the "box" so to speak.

Right, to progress.............kbdus.exe produces no hits on Google, which makes it rather suspicious. On the other hand it has not been recognised as part of any known malware either. "kbdus" as a .dll, or .kbd extension are OK....................they support the US keyboard.

Can you make a copy as a .txt file or zip it and send it to me as a PM (personal message) attachment, so I can take a quick look. You might also like to send a copy to your AV company. Either in the help file or on their website you should find the instructions for submitting suspected malware.

206.58.237.248........................well, well, well...............I ran a "Whois" and "Traceroute" on that address and it appears to be bogus/spoofed, which is not unusual.

Cheers

The file kbdus.exe also contains the string ' Marca = "hckdw2003*" ' This seems to be part of some script (possibly VBScript) that is embedded in the executable. There are a bunch of foreign words used floating around in there. The word "marca" means "it marks" in Spanish.

According to Symantec, Trojan.Adwaheck is known to insert hckdw2003* into webpages. Do you think that this is what I havd/had on my system? They also say that Trojan.Adwaheck contains a backdoor with somekind of autoupdate feature, so it may be possible that the version on my system is not yet detected by AV.

I really just want to know what the heck this thing is!

nihil: I sent you a copy of it to look at.

Thanks Mark~

It is definitely a "bad guy" I haven't had chance to give it more than a quick look.

My "call" right now is that it is a variant, which is why the AVs don't find it. The languages are Spanish and German. I guess that the German guy got the Spaniard's source code and modified it. Kinda crafty using a US keyboard like name.

Update feature?.............try looking for uup.bat or " wildcard" and uup.bat on your system ;)

Cheers

EDIT: Please try this link: http://www.trendmicro.com/vinfo/viru...=TROJ_SMALL.AN

There is also a link to run "Housecall" that should deal with it for you

The last time I ran HouseCall on it, it didn't detect it. I believe that TROJ_SMALL.AN is the same as Download.Trojan and SillyDl, which has been mentioned in this thread. At least according to http://www3.ca.com/securityadvisor/v....aspx?id=39574 that's true. Also, notice that the filesize is significantly larger than Trend Micro reports. My guess is that the bastard who created this thing had access to the source code of the SillyDl trojan (which I assume is pretty common) and he used some of it.

I guess I'll try forwarding it to my AV company to see what they make of it.

Well, they sent a reply saying it's a new virus.

Thanks for the update :D and also for your very positive feedbacks