Can a trojan bypass netstat?

Hi, I'm using Windows xp sp2 with NAV 2005, sygate personal pro and microsoft anti-spyware beta. I make regular checks for both viruses and spyware. Recently, my computer started acting a bit strange. It shuts down all by itself when I'm watching a movie or something, the songs i'm playing in winamp change and windows minimize and maximize by themselves. Whenever such a thing happens, I immediatly check using "netstat -a" but it doesn't show any foreign address connected. Is it possible for a trojan sitting on my computer to not show up in netstat? The data sent and received don't show anything strange. Is there anyway to know for sure whether there's a trojan on my computer or not? It's not very severe but still, it's very irritating to think that someone is watching what you're doing all the time.

Quote:

---

with NAV 2005, sygate personal pro and microsoft anti-spyware beta.

---

Have you also got the Microsoft firewall running?

Does this behaviour happen if you are off the net, and running saved stuff?

Update your NAV and run it in safe mode
Go to the Trend Micro Pc cillin site and run the "housecall" online scanner.

Check your scheduled tasks, auto updates etc and turn them off.

My gut feel at this stage is that NAV 2005 is conflicting with something.

Let me know how you get on :)

If you this think that some one are connected to you computer, try to disconnect from internet and do what you usualy do....

Best test if you are monitoring by some one.....

Yes a trojan can bypass netstat, usually with a little help.

In addition to the excellent advise of nihil , I would recommend a utility that has the same functionality as netstat but is external to the OS. I use Fport from foundstone. You can find it on their web site. It is free, and you can compare the results to netstat and look for anomolies.

Also is there any other device on your network where you could see the connection? Like a router or NAT device? Might look there as well if you have one.

I have a CD with OS utilities like NETSTAT from a clean system that I take around to machines I think have been compromised. See if you can get that file off a known clean system and put it on some sort of read-only media (CD or write-protected floppy) and run it on your suspect system. You wanna use the '-ao' if XP and '-an' parameter if W2K.

You could also try OpenPorts located here http://www.diamondcs.com.au/openports/ it's FREE.

It does sound like you may have a 'critter' on your box. Thoughts...

- Did you try safe mode and scan with AV scanner?
- How about safe mode with networking and visit one of the online virus scanners such as on Symantec's site http://security.symantec.com/default...d=ie&venid=sym.
- You could also download and run the Trojan Defense Suite (TDS3) located at that same website as OpenPorts - they have a free 30 day eval http://tds.diamondcs.com.au/

If NONE of those detect anything you might want to try the Rootkit Revealer from SysInternals. It's a little advanced and will take some research of the findings but will detect many rootkits. http://www.sysinternals.com/ntw2k/fr...itreveal.shtml

Good luck, let us know what you find.

Hi,

Some of these things are quite good at hiding :(

There are some useful tools on Karen Kenworthy's site:

http://www.karenware.com/powertools/powertools.asp

You might want to try Windows Watcher?.....................if you have a nasty one it may not be stealthed against that ;)

Fellow tool freaks, you might like to browse the site as well..............Karen writes some useful stuff.........sorry should have mentioned the site ages ago :o

Cheers

Great stuff posted before. Could be software conflicts, trojans, you bet!

But don’t forget the possibility of this being heat related or voltage issues. You had mentioned that this happens during high resource demands (movies, etc) = higher temps and higher voltage demands. Generally computers are not suppose to just shutdown unless we pull the plug or instruct them to. Whether that instruction comes from the keyboard or set peremeters (such as max CPU/Board temps, mini/max voltages, something is making it or telling it to shutdown). I’d check your PC health in the setup to see what the CPU and Board temps are (also the shutdown temp setting and compare the two) and check the voltages. Then go to your CPU’s and Main board’s manufacturer and compare the temps/voltages with their standards.

You must have good airflow in and out of the box and the power supply must supply the required voltages.

Quote:

---

Can a trojan bypass netstat?

---

Most assuredly! One goal of the deviant is to try to hide by altering logs, detection processes etc. Coding filters to alter netstat’s output has already been accomplished and for those that can’t write their own, they are readily available at the L4m3rz $i7es.

Looks like we have just about all the possibilities covered now. Let us know.

cheers

Hi !

@Nihil:

I've got the latest updates for all of them and I run regular scans of my system. Spyware scans are done every night at 2am. There is one thing I forgot to mention. I'm in a college campus with all the computers in the campus connected through LAN. We keep sharing stuff among ourselves using WASTE and sometimes even through Lanshares. That's why I keep my comp switched on all the time. I will try the pc-cillin house call and let you know wht happens. I don't think it's a NAV conflict coz this is a fairly new winxp installation (about a month old). This kind of strange behaviour started just a couple of days ago. It doesn't happen all the time. Just now and then. Once, I just left the room for a min and when I got back, somehow the "standby,turn off, restart" window was showing on the screen. I am not running windows firewall. I've even changed the settings in sygate to ask me for each and every program that needs to use the network. I'll try out the tools you suggested and post back.

@gump:

Can't check the connection coz as I said, I'm on a LAN and the main server is far far away. I'll check up that utility that you suggested.

@rico:

I haven't scanned in safe mode. But if NAV doesn't detect it in normal mode, there isn't much point in scanning again in safe mode right? It says '0 viruses found' . Safe mode is only for removing the viruses/trojans detected but which are staying memory resident right?

@relyt:

I don't think it's the voltage fluctuation. coz this comp is 6 months old and I haven't had a problem before. The CPU and M/B are well ventilated. That's because I always keep the side panel open :D. Sometimes, it's easier to take your Hard disk to someone else's computer and copy the stuff you want ;).

Quote:

---

Originally posted here by alamuru420123
@rico:
I haven't scanned in safe mode. But if NAV doesn't detect it in normal mode, there isn't much point in scanning again in safe mode right? It says '0 viruses found' . Safe mode is only for removing the viruses/trojans detected but which are staying memory resident right?

---

The idea behind booting in Safe Mode is to load as few of the drivers and services as possible because one of them could be the malware. There are some stealth tatics by malware writers that can be avoided by booting into Safe Mode so they become visible.

All in all it's really just another step in a long list of system checks that should be done.

One more tip to add to the Rootkit Revealer tip: rename the EXE to a different name. Rootkit makers have responded to the tool by watching for the execution of the executible file. Some rootkits even compares the MD5 so you gotta edit the exe file. I did just that, changing a couple text characters where there was a text line - for example 'This program cannot be run in DOS mode' in the beggining and that changes the MD5. But this is all getting advanced.

Quote:

---

How about safe mode with networking and visit one of the online virus scanners such as on Symantec's site http://security.symantec.com/defaul...e&venid=sym.

---

I think I brought up an idea along time ago, it was whether or not you could run those online scans in safe mode. I can't remember who exactly tested it, either nihil or tiger shark, one of those two, but whoever it was said they couldn't get it to work...

Correct me if I'm wrong :)...

There are tools like rootkitrevealer (don'task me for the URL..I am too lazy)..
or useing the good old tools like HJT and Stinger on a BART PE os disk.. in other words a "remote" scan of the HDD.. that is where it isn't your os that is checking the registry and files..
For information on the BART PE disk setup have a look at IronGeeks tutorial on the subject

Here is the output from FPORT:

Quote:

---

Pid Process Port Proto Path
1912 inetinfo -> 25 TCP C:\WINDOWS\system32\inetsrv\inetinfo.exe
1912 inetinfo -> 80 TCP C:\WINDOWS\system32\inetsrv\inetinfo.exe
1340 -> 135 TCP
4 System -> 139 TCP
1912 inetinfo -> 443 TCP C:\WINDOWS\system32\inetsrv\inetinfo.exe
4 System -> 445 TCP
1912 inetinfo -> 1029 TCP C:\WINDOWS\system32\inetsrv\inetinfo.exe
2592 mqsvc -> 1032 TCP C:\WINDOWS\system32\mqsvc.exe
2344 -> 1039 TCP
2592 mqsvc -> 1801 TCP C:\WINDOWS\system32\mqsvc.exe
2592 mqsvc -> 2103 TCP C:\WINDOWS\system32\mqsvc.exe
2592 mqsvc -> 2105 TCP C:\WINDOWS\system32\mqsvc.exe
2592 mqsvc -> 2107 TCP C:\WINDOWS\system32\mqsvc.exe
996 ccApp -> 2405 TCP C:\Program Files\Common Files\Symantec Shared\ccApp.exe
1284 FIREFOX -> 2974 TCP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
1284 FIREFOX -> 2975 TCP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
1284 FIREFOX -> 3031 TCP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
1284 FIREFOX -> 3032 TCP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
1284 FIREFOX -> 3033 TCP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
1284 FIREFOX -> 3034 TCP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
3024 mysqld-nt -> 3306 TCP C:\MySQL\bin\mysqld-nt.exe
1728 ypager -> 5101 TCP C:\Program Files\Yahoo!\Messenger\ypager.exe
1284 FIREFOX -> 123 UDP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
2592 mqsvc -> 123 UDP C:\WINDOWS\system32\mqsvc.exe
3024 mysqld-nt -> 137 UDP C:\MySQL\bin\mysqld-nt.exe
1728 ypager -> 138 UDP C:\Program Files\Yahoo!\Messenger\ypager.exe
1912 inetinfo -> 161 UDP C:\WINDOWS\system32\inetsrv\inetinfo.exe
1912 inetinfo -> 445 UDP C:\WINDOWS\system32\inetsrv\inetinfo.exe
1340 -> 500 UDP
1912 inetinfo -> 1025 UDP C:\WINDOWS\system32\inetsrv\inetinfo.exe
1284 FIREFOX -> 1027 UDP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
1284 FIREFOX -> 1028 UDP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
4 System -> 1031 UDP
1284 FIREFOX -> 1900 UDP C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
4 System -> 1900 UDP
1912 inetinfo -> 2015 UDP C:\WINDOWS\system32\inetsrv\inetinfo.exe
2344 -> 2019 UDP
2592 mqsvc -> 2020 UDP C:\WINDOWS\system32\mqsvc.exe
2592 mqsvc -> 3456 UDP C:\WINDOWS\system32\mqsvc.exe
2592 mqsvc -> 3527 UDP C:\WINDOWS\system32\mqsvc.exe
2592 mqsvc -> 4500 UDP C:\WINDOWS\system32\mqsvc.exe

---

Why are there so many instances of mqsvc running on so many ports? Can this be the trojan? I googled and found that mqsvc is the message queuing service. netstat -abn shows the destination ip address of mqsvc as 0.0.0.0:0. What does this mean? rootkit revealer hasn't detected anything.
I don't know what;s wrong but, trendmicro's housecall is giving me an error. It keeps saying "page not found" the minute I click on the "start scan now" link.

You have ISS 5.0 running, MySQL, Message Queue Server Process running?

What type of OS are you running? What service that OS is providing to your LAN?

I'm using winxp pro sp2. I'm not providing any service to the LAN. I've got an assignment to make a webserver and that's why i've got iss and mysql running.

This is quite a shock to me. I thought Netstat was infallible. With all the different syntax i have always been able to find what I need or suspected.

I thought Netstat simply checked all TCP/UDP Ports and displayed the connection. How does it do this? Does it use ICMP? And beyond that, how can a program hide its connection?

I always liked and used the sysinternals free tools. Like pstools, tcpview, procexp, regmon, filemon. other than that I use Spybot S+D, and AdAware SE.

tarpi

Hi

alamuru420123, your fport output looks ok to me, if you have use for
the Microsoft Message Queue Server and if you use the yahoo messenger.

Quote:

---

Originally posted here by Dr Toker
I thought Netstat simply checked all TCP/UDP Ports and displayed the connection. How does it do this? Does it use ICMP? And beyond that, how can a program hide its connection?

---

I will quickly give the keywords for three ways to display connections, and then throw some
keywords that it is possible to hide it from being shown (which is hiding :) ), in principle.

netstat

I just shortly mention a few ways how netstat could reveal the
TCP/UDP connections:


- ntdll.dll: Use ntdeviceiocontrolfile() to check
for the "\device\tcp"/"\device\udp" resource (kernel land!)
and ntquerysysteminformation() for the process id etc.

- iphlpapi.dll: Either use AllocateAndGetTcpExTableFromStack()/
AllocateAndGetUdpExTableFromStack or GetTcpTable() (user land!)


rootkits

Now, it is possible to hide processes and their interaction from
the system, but one has to create rootkits to do so.

Either on kernel level (ring 0)[1], for example with overwriting entries in
the Service Descriptor Table to redirect addresses to own functions -
however, this might be very difficult, since the devices varies from
OS to OS, or

on user level (ring 3)[2] - which is quite complicated (one has to hook all
target API), but might allow for larger compatibility.


Currently I am looking into a "new" method using EPROCESS structure[3]
(eEye has written a White Paper about it), but I had no time to test it.


Cheers.

[1] http://www.phrack.org/phrack/62/p62-...Windows_NT.txt
[2] http://www.phrack.org/show.php?p=62&a=12
[3] http://www.google.com/search?q=+EPRO...3Aantpower.org

To expand on Sec-Ware's excellent post and to broaden the the thrust of what he is saying.....

There are two types of rootkit, the User and the Kernel Level. They sound similar but they are very different. One is 'relatively' easy to detect and beat, the other is near impossible unless you work in a very high security environment with very strict procedures that are actually adhered to. On the other hand the first is relatively easy to implement by the attacker while the other is very difficult and has it's inherent risks to the attacker.

The User Level Rootkit: This is the more commonly found rootkit because it's easier to install and less likely to cause problems on the target machine. It consists of replacing certain executables with subverted executables that will mask the attackers activity. Easy examples are Netstat.exe and cmd.exe.

Netstat would be subverted to show all connections except those from IP Address xxx.xxx.xxx.xxx. All the other connections will show just fine.

Cmd would be subverted so that a "dir"will show all folders except those that begin with "+" for example. Thus an attacker will add a folder to the root called "+owned". That folder and all subfolders will never show when a dir is done, (obviously, in this case explorer.exe would have to be similarly subverted). These will be further subverted, usually, to not show the additional disk space taken up by the folders so that you don't notice the sudden loss of a gig or so.

This is very easily detected once you realize that "something" is wrong and is why I carry "trusted" versions of the appropriate files with me wherever I go, either on CD or on a USB fob with all the files set as read only. It's very simple to run a netstat from the local machine and a netstat from the trusted media and compare them..... If they differ you are looking at a user level rootkit.... The solution... Reinstall....

The Kernel Level Rootkit: What could possibly be the difference between this and a User Level Rootkit? Simple really... Netstat, cmd, explorer and all those other apps get their information from the kernel. That's why, when you take a "trusted" app and run it, the results are not different and is exactly why a kernel level rootkit is so much more difficult to detect. The attacker doesn't have to change the apps themselves - they can all remain "trusted" and even my stash of "trusted" apps will do me no good. In fact _any_ app you bring in to look at the system will be lied to by the kernel whereas in a user level rootkit if I used Fport rather than netstat I would see the difference because the attacker didn't find the fport and subvert it, (or couldn't).

The problem for the attacker is that he is messing with the kernel. It's actually easier for him to do once he owns a *nix box because he can recompile the kernel with his changes in it. Windows is more problematic which is why there are less Kernel Level Rootkits for Windows.. You can't just recompile the kernel... There's a whole lot of hoops you have to go through, (and hope they all work right without screwing up the machine).

If the attacker manages to install a _stable_ rootkit on any type of machine it really, really isn't yours.... and it's bloody difficult to detect after the fact. Your only real chance is to have a regular MD5 checksum made of every system file and log any changes made to the system that you make and which files the changes affect. Only a comparison of the changes in MD5 checksums and your changes to files after the fact will give you a clue that the files have changed. By the way, do _not_ keep the checksums on the box you are trying to protect.... They should be read only on a separate media - it would be trivial for an attacker with the skill to place a Kernel Level Rootkit to alter your precious MD5 checksums to match his spiffy new ones....

The solution to a Kernel Level Rootkit... Panic, quit, run to the pub, drink beer, sleep, get over hangover, go back to work and beg for your job, reinstall every computer on the network from scratch.... Quit.... ;)

Hope that's all clearer then my morning coffee... Mud... ;)

Wow, that's a lot of food for thought. But to be able to do something like changing netstat.exe and cmd.exe, an attacker would need to get physical access to my computer and have to replace the files while in safe mode right. I never leave the computer alone for so long that someone comes in and just starts fooling around (Hey, it's my comp right?). After I made my last post, I reset all the applications permissions in sygate to ask me whenver they need to connect to the internet. Since then, I haven't been having any problems. Although every now and then, I get a pop-up saying 'ndsuio.sys has been contacted from an external address 10.x.x.x. Allow?' I've disabled this. But it doesn't seem to really affect anything. People can still connect to my shared folders (those who I've given read permission to) and I can connect to other computers. What is this file used for?

Netstat, cmd etc. are not protected system files. You can do anything you like to them..... So can an attacker.... locally or remotely....

I can't find anything sensible about ndsuio.sys.... I would consider finding it, renaming it ndsuio.sys.old and restarting and see whether your box works normally.

If I were you, I would ask administrators of your colledge LAN do I realy need Message Queue Service.

I wonder

Tiger: great post

Quote:

---

Originally posted here by The Duck
I think I brought up an idea along time ago, it was whether or not you could run those online scans in safe mode. I can't remember who exactly tested it, either nihil or tiger shark, one of those two, but whoever it was said they couldn't get it to work...

Correct me if I'm wrong :)...

---

Hey Duck: I'll correct you....lol. Seriously, I just tested Symantec's online virus scan on an XP machine booted into Safe Mode with Networking and it works fine. The screen navigation is a bit challenging due to the low resolution of being in safe mode but workable. I didn't test it with Trend Micro or other online scanners.

@Tiger-Shark: I've tried out what you said and renamed ndsiuio.sys to ndsiuio.sys.old and there doesn't seem to be any problem so far. Atleast not with the network or the system.

@ikalo: I don't know if we need message queue service. This is on my personal computer in my quarters which is connected using the campus network. I've got a webserver set up. Can I disable it without causing a problem with the webserver?

But yesterday night something weird happened again. I was working with photoshop when the create new profile window of firefox popped up without me clicking anything. I clicked on cancel but it popped up again. It kept this up until I changed sygate to block all network connections. Then I checked in the task manager and firefox was using up almost 100% pf cpu time. I closed it and reconnected to the net and everything was normal again. I know this sounds crazy but it really happened and now I'm convinced that there is someone who is trying to freak me out. What can I do? I just can't seem to detect whatever he uses to connect and I can't detect his ip address.

Sounds like spyware to me.....

i've done a complete check with microsoft anti spyware beta with deep scan. It didn't show any results.

well it may be a trojan ....
its only possible if they are using a kernel rootkit because it hides the process threads from user by modifying the kernel fuctioning,
and as netstat -a shows all the connections with port no.
the trojan may have modified netstat -a fuctioning or copied with its looklike which is hiding
that trojan..
u can try a port scanner to scan all the ports (not nmap bcoz current windows version it doesn't have the ability to scan itself)
soo u can try any commercial troajn scanner if can see the the ports if it has modified the netstat command
bt if a rootkit is installed .. try using a rootkit scanner..
also wen anything like happens jus make a log of netstat -a n compare to wen its working fine..
well thats my way of thinking....
ashtified_85

"i've done a complete check with microsoft anti spyware beta with deep scan. It didn't show any results."

Spyware detection tools aren't infallible. Its always best to use a variety.

Good luck! :)

The real name of that file is "ndisuio.sys".

You need to rename it back again or better yet, boot to safe mode and replace the file (which sits in \system32\drivers) with a fresh copy of the file which sits in c:\windows\servicepackfiles\i386. When replacing, delete the old file first, do not copy atop of the old file.

It's a Microsoft file related to the user interface of the wireless configuration service.

If you don't need it, turn it off. Some wireless utilities don't work properly unless you turn this service off.

In order to disable Wireless Zero Configuration, go to:
Control Panel ---> Performance and Maintenance ---> Administrative Tools ---> Services.

Click on Wireless Zero Configuration; change the "Startup Type" drop box to "Manual" and stop the service.

Then I would scan with MS Antispyware, Adaware PE, and Spybot S&D (update them all first and run the deep/complete scans), then go to http://www.pandasoftware.com/activescan/com/

I've seen a trojan once and Panda was the only AV scanner that caught it.

You will need to disable system restore before the scan so it can repair it.

Does that solve the problem?

Well, that solves that problem. Thanks ZT3000. But I've kind of given up on this trojan thing. I guess I'll reinstall windows. It's running a little too slow right now. A fresh install should shape things up and as a side bargain, I'd get rid of the RAT as well. Thanks to everyone that tried to help me, especially Tiger Shark. :). That's a lot of useful info u posted back there.

If you are going to reinstall, disconnect your ethernet cable prior reformatting. (I like to wipe out the partition too) XP install will let you do both things during install (read the install screens carefully)

Make sure you have the latest version of your antivirus burned to a backup of some sort.
After the reinstall, install your antivirus, scan your system, activate the Win XP firewall, then plug your network cable back in and get all those updates from MS update site.