War-Against-Worm

Hi guys here is the saga to my war-against-worms. The system is XP with NAV2K. Here I go....

I had Norton 2k installed on my system which I kept updating in about once a month, few months back the live update subscription of my Norton got expired and for few months I was on my non-updated AV system. Then one day I experienced my PC slowing down and its performance degrading, on a closer look I found multiple unknown processes and number of unexplained network connections when I used my dial-up. Being a computer guy (but not a sys admin) I rushed of to Internet searched for all the suspected processes. I removed as many files/registry entries/services etc. that I could from the information I received on the net.

I followed this up with online scans from adwarwe, Norton and trend and some more. They did find two worms and cleaned them, I did a fresh round of complete scans and my system was certified clean of virus. Oh! I forgot to mention that I had to download a utility from Symantec to remove Norton, as the virus had made Norton incapable of doing anything (even uninstall !!). I finally got CA's EzArmor firewall+Av suit and installed it. I completed the process by updating my XP to SP2.

I though that I had done enough to get rid of the menace but I had a surprise waiting. I suddenly found my system getting realllllly slowed down, no funny processes but lots of svchost eating up huge memories and having lots of I/O reads (above 1000 in 5 minutes) same for my lsass process. I checked these figures with other systems and did find the I/O read property abnormally high , coupled with this after about 5 days of usage my dial/up broke and then my lan access broke. I mean now I can not connect to outside world, reinstalling drivers doesn’t help (firewalls were disabled and there is nothing related to new AV or Sp2 that could be causing these problems) . Phew.... I could have easily formatted my system, but I was hell bent upon removing the worms/spyware without a reformat.

I just want to ask you guys one thing, What the heck did I do wrong. Is there something I can still do and get out of this mess. After my LAN-die out I really wanted to reformat my system, this is my last attempt to resolve this issue. Its been over a month and I dint keep track of my actions, that’s why you see stuff like "few more", "etc', "few worms" and all.

OK I should add this, some of the initial processes were, ftpd.exe, update32.exe, some service that said it was USB2 driver etc.



TIA.

In all honesty, when your system is compormised by a backdoor trojan, when a malicious user may have modified any number of things, the best (and really only) way to be sure you're clean is to re-format and reinstall the Operating System.

Quote:

---

In all honesty, when your system is compormised by a backdoor trojan, when a malicious user may have modified any number of things, the best (and really only) way to be sure you're clean is to re-format and reinstall the Operating System.

---

Hmm...I'm afraid I must disagree. Of course, I'm subscribing to one of the two major schools of thought represented here at AO, but I think reformating should be a last resort. Some points:

1) You don't learn anything about how you were compromised (and furthermore, how not to let it happen again) if you just up and reformat. Analyze, research, learn, then be better prepared next time.

2) Use multiple AV scans (for example, whatever you have installed, followed up by HouseCall) and multiple anti-spyware programs to thoroughly clean your system, then once that's done checking and double-checking, be the scanner yourself and look through key target system folders and examine running processes to make sure all is clear. Again, this way you learn, which you won't gain from simply wiping the hard drive.

3) If your computer is so screwed up that you can't even install an AV or spyware cleaner on it (I had this happen on a client's machine recently, in fact -- a key .dll file necessary for AV installation -- shell.dll, if I recall correctly -- was removed by the malware evidently), then connect the infected computer to your network and have it scanned remotely (but make sure the machine scanning the troublesome box is very well secured before connecting). If you can connect the infected computer to one other secure computer for this purpose via a null modem cable, all the better.

And note that before you do any of this, completely disconnect the machine from the Internet before cleaning, so it won't spread more havoc during the process.

If all that fails, then reformat the hard drive.

Well, I would take it just one more step.

After doing all of the above and perhaps learning something........then reformate and reinstall the OS to be really sure you got it all.

I agree, reformatting is a last resort. Programs like hijackthis are excellent removal tools becasue they force you to actually learn what the problem is rather then just deleting them. Also learn your software, AVs are no good if not configured correctly, same with firewalls and any other protection you enable. Formatting is a not so quick but easy fix for alot of computer problems, but like angelicknight said, you learn nothing but how to format, and chances are you will get the same infection becasue now you dont know what the cause of it was therefor you cant prevent it.

I recently had an XP Home machine on the bench (CEOs home computer :rolleyes: )..and It would not let me install anything..
No AV, Anti spyware or any other utility..for that matter

I connected it to the internet and tried windows update.......would get to the site then error out when I went to scan computer (if that was even the actual windows update site)....almost thought I had a harddrive failure

I ended up manually downloading XP SP2 ( for networking professionals) and ran it locally from the c:\.

That at least allowed me to get updates and install Adaware...which found over 900 spyware and malware. (I love the new SE edition). What ever it was on the machine..it disabled the WUD and AV (Norton)

I just wanted to say the Angelic Knight is right...

When I first started coming to this site I thought the only way to fix the machine was to format and reinstall....I have learned a TON since then.

Although...if it was my server compromised...that may be a different situation as CERT recommends a format reinstall for ALL compromised servers..whatever the OS

Thats why..you patch patch patch

and patch somemore

My .02 CDN ( which is becoming more valuable by the minute lately :) )

MLF

I take it you installed SP2 After the fact...hmmmm you could still have one of the lovely worms living happily under the skin of your nice new AV prog

Be aware that some of the stuff you have described could be a damaged driver/ or virtual device driver .. in otherwords system files corrupted..

Go to www.moosoft.com and download a trial copy of The Cleaner, install, update, restart the machine in Safemode, and run a scan.

Also get a hold of the removal tools for Gaobot from Symantec (some versions of this worm won't allow you to update Win, or install/uninstall an AV

Also get the usual Spy/Ad ware removal tools
Spybot search and destroy
Adaware se 1.05
Coolwebschreeder (CWS)
Spysweeper or spyware blaster(we throw this in after we fix yoiur problem)
Why do I mention this.. many AV's dont detect the ad/spyware crap.. and these also can cause virus like symptoms.. and as some are built on trojans..

but only start on this if you are serious about having a go at the removal process.. else follow timmy77's advice..

edit/ I will need to speed up my typing..or stop posting and talking on the phone.. good replies there guys.. the site is in good hands.. I'm taking a holiday.. be back in a few weeks.. cheers

Do me a quick favor and we may be able to get to the bottom of this fairly quickly.

You mention ftpd etc. Sounds like a worm or virus. Letsget a copy of Hijack This, (on a floppy if necessary), and see if you can run it. If you can, save the results and post them here....

The we can take a look and see what we can do for you.........

Shark

HijackThis was probably the first tool after NAV that i tried, it did help a lot.

Now HijackThis does not show up any thing suspicious (atleast in my eyes). Anyways I will run a scan and post the logs (I should have done that before). I should also explain my position here, I am at GMT+5.30 timezone, and connect to net from my office pc (remember I lost both my lan and dialup connectivity few days back). So I will post logs tomorrow morning my time.

In the mean while would you like me to do anything else? I had actually asked a guy to come and reformat my system, but I have some how got new enthu. I have called him to cancel the job. Will give my system a few more days oops... nights :)

Und3ertak3r

I had Adaware se 1.05 and two more anti-spywares (dont remmeber the names now..but will post them with the logs) installed, as I mentioned I got my system online scanned from NAV and Trend (Housecall??). Currently I have Adware SE and EZArmor on my sytem.

I will download the cleaner and see what it turns up.

Could you guys give some pointers to find out the system files that might have been compromised, somehow to get my dial-up working again and stuff.

As I earlier said that now I suspect something wrong becuase of folowing points
1) General slowing down.
2) Huge 20Mb+ svchost process + multiple svchost (around 7 processes)
3) audio video drivers, network getting courrupted.

I did not mention that I have to frequently reload my drivers.

All most sounds like a hardware problem??? as suggested here

Quote:

---

Be aware that some of the stuff you have described could be a damaged driver/ or virtual device driver .. in otherwords system files corrupted..

---

Sometimes when you reapply drivers ...you need to update your SP level...(in the old NT4 days)

Even though WINVER said you had the SP installed when you put the SP CD in..it would inspect and ask you if you wanted to install over a previous version...

Do you have a spare harddrive..you could do a test install as an install will test all hardware...and fail if there is trouble.

I usually try this or a parallel install (if you have lots of room on your existing harddrive)to test\stress the hardware to the point of failure.

With the parallel install..just tell the install not to format and chose a different directory for the system files..I use \winbak

This will then give you 2 boot options when starting up....old system and parallel system...
If you are experiencing the same probs with the new or parallel install most likely you have a hardware issue...memory\cpu\board\harddrive etc

Parallel installs are good cause you can remove later and you dont lose your original install\data. Its a good way to access data on a unstartable system...as long as it is not a harddrive failure.

Last couple of harddrive that failed...I could read...but the system would fail miserably when trying to write...I at least was able to pull data off.


I have done this with NT4 and 2000...havent needed to do with a XP install...yet. :rolleyes:

Post your hjt logs..cause I know that the help offerd by TS ..is priceless :)

MLF

Quote:

---

Originally posted here by coolnads
Hi guys here is the saga to my war-against-worms. The system is XP with NAV2K. Here I go....

I had Norton 2k installed on my system which I kept updating in about once a month, few months back the live update subscription of my Norton got expired and for few months I was on my non-updated AV system. Then one day I experienced my PC slowing down and its performance degrading, on a closer look I found multiple unknown processes and number of unexplained network connections when I used my dial-up. Being a computer guy (but not a sys admin) I rushed of to Internet searched for all the suspected processes. I removed as many files/registry entries/services etc. that I could from the information I received on the net.

I followed this up with online scans from adwarwe, Norton and trend and some more. They did find two worms and cleaned them, I did a fresh round of complete scans and my system was certified clean of virus. Oh! I forgot to mention that I had to download a utility from Symantec to remove Norton, as the virus had made Norton incapable of doing anything (even uninstall !!). I finally got CA's EzArmor firewall+Av suit and installed it. I completed the process by updating my XP to SP2.

I though that I had done enough to get rid of the menace but I had a surprise waiting. I suddenly found my system getting realllllly slowed down, no funny processes but lots of svchost eating up huge memories and having lots of I/O reads (above 1000 in 5 minutes) same for my lsass process. I checked these figures with other systems and did find the I/O read property abnormally high , coupled with this after about 5 days of usage my dial/up broke and then my lan access broke. I mean now I can not connect to outside world, reinstalling drivers doesn’t help (firewalls were disabled and there is nothing related to new AV or Sp2 that could be causing these problems) . Phew.... I could have easily formatted my system, but I was hell bent upon removing the worms/spyware without a reformat.

I just want to ask you guys one thing, What the heck did I do wrong. Is there something I can still do and get out of this mess. After my LAN-die out I really wanted to reformat my system, this is my last attempt to resolve this issue. Its been over a month and I dint keep track of my actions, that’s why you see stuff like "few more", "etc', "few worms" and all.

OK I should add this, some of the initial processes were, ftpd.exe, update32.exe, some service that said it was USB2 driver etc.



TIA.

---

What did you do wrong?
Answer you did not use a firewall.
After sp2 you do have one!

A couple tools i would try as those scanners dont always pick up everything

Check for rootkits (unlikely but worth a shot)
http://3wdesign.es/security/

Currprocess from www.nirsoft.net can give you a good list of running processes, and if you see a svchost.exe in a location than C:\WINDOWS\system32\svchost.exe i would be wary of it

The reasons that we always advise a reformat following ANY compromise;

1. You do not know how many additional pieces of malware were piggybacked upon a known one
2. You do not know whether the malware opened up holes to allow opportunist attackers to install their own rootkits
3. You do not know whether an unknown piece of malware has leaked in some other way.

So as such, the normal procedure:

1. Back everything up
2. Reformat and reinstall
3. Secure your machine fully including using fully up to date malware scanners
4. Restore extremely carefully, avoiding anything which could possibly contain malware if at all possible- try not to restore .exes, word docs etc unless absolutely necessary
5. Change all passwords for third party systems that could have been keylogged by the malware while it was installed; if a compromise is suspected, repeat the process for those too.

In some cases, 5. will include a reformat of all machines in your organisation. It could be hard to convince the management that this is necessary, but you should try anyway.

Slarty

Hi All

Thanks for all the help. We had a long weekend here and I was supposed to get you ppl HijackThis logs , I did get them on my USB stick, but guess what, the file that I got was empty !!! PS: I should get a new memory stick.

From the look of the things I should be better off with formating my system, The cleaner from moosoft reportes nothing, I am yet to try rootkits and CurrProcess, otherwise I am almost through with all the the other tools you guys mentioned, and they all say that my system is clean. I think I might have some compromised process, which is difficult to track down or something....

will wait for the weekend and then let it go...

Here it is guys...
sorry it took so long..I was very busy at office with deadlines swooshing past me ....

I still think that there is nothing wrong in these logs..but then I could be wrong.

Thanks for all the help.

Logfile of HijackThis v1.97.7
Scan saved at 6:47:08 AM, on 12/1/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
E:\Program Files\CD tools\Deamon\daemon.exe
E:\WINDOWS\system32\NVATray.exe
E:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
E:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\CD tools\Nero 6\Nero\nero.exe
E:\Documents and Settings\Neo\Desktop\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\windows\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\windows\googletoolbar1.dll
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\CD tools\Deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [VetTray] E:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKCU\..\Run: [STYLEXP] E:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://e:\windows\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\windows\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\windows\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - E:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - E:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\windows\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\windows\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/mail/ymmapi.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

The FlashGet bar is spyware. Check and remove all those items and then delete the associated files off your HDD.


O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\PROGRA~1\FlashGet\fgiebar.dll
O8 - Extra context menu item: Download All by FlashGet - E:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - E:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)


By the way, if you haven't already, be sure to run all your spyware/virus/trojan/worm scans in Safe Mode. In my experience, many of the boogers are easily able to hide from the scanners in regular mode. Safe Mode levels the playing field, and prevents most of the background spyware processes from running and interfering with the scans.

I thought FG was a download-accelerator. I have been using it from last 3 yrs or so and havent really got any issue with it.

Yes It does show some ads, more like adobe acrobat.

Is it really bad. Bad in sense does it clogs network resourses, open backdoor, spams and all that unwanted stuff?