Printable View
My company got hit with a new virus about 4 days ago and we can't seem to get rid of it. The AV's haven't come out with the def's for it yet. Any one heard of this yet or have a solution that might help out. Here is a website with more info:
http://www.antisource.com/article.ph...bc08-msdirectx
Hi,
Capture it in a zip file and send it to me via PM :) I need to know what it does.
What operating systems are you running?
What symptoms are you experiencing?
How do you think it got in to start with (if you send it to me, I will know how it spreads)
Cheers :)
I don't readily have a copy of the file yet. I do know that it seems to be trying to connect to an IRC server and that for most of the incidents that we've found it's been coming across port 445 acccording to our IDS which is monitored by ISS. We are running Windows XP with all the latest patches due to our nifty patch link program and McAfee AV which of course is updated regularly too. Both McAfee and Microsoft have been notified of our situation and are currently try to devise a tool to combat this. So far we've found about 200 known infections across the US. We currently have it contained internally on the network due to the addition of ACL's and firewall modifications. I'll try to get the file for you as soon as possible....thanks
Also I forgot to mention above the symptoms...
regedit and taskmanager won't stay open...
Antivirus software crashes....
machine freezes...
I attached a file that I believe shows which AV company's have found something in their defs about the file...
lol....eager for some infectious cyber-files nihil are we? me too...i like analyzing these critters. lolQuote:
Originally posted here by nihil
Capture it in a zip file and send it to me via PM :) I need to know what it does.
Capture it and send it to AVERT here https://www.webimmune.net/default.asp
And like nihil...I'll take a copy too. :)
OK,
Schmit, if you know which machine it came in from just pull it from the net and leave it alone.......you may want to do some forensic analysis later? You need to pull the other known infecteds as well.......any idea of the route logic of the infections?
AV companies are very good but can be a bit slow in response time to make sure that they get things right............they have a corporate reputation to uphold :rolleyes:
We are expected to do things yesterday, which is why I tend to go for a "containment" approach, and try to find out what it does and how, rather than look for a perpetual solution. ;)
Good luck..................and Happy Easter............they do time these things well don't they?
Well...fortunately it doesn't appear to be doing any damage...more of a nuisance...hopefully we'll have a solution to this by Monday. I'm still trying to track down the darn file. We actually aren't sure which machine was infected first, but rest assured the infected are being pulled from the network as they show up. We aren't sure how it depicts which route it will take next either...hopefully that will be something else we can find out soon. Thanks for the advise though...and I'll keep you updated...oh...and get you and ric-o that file some time this year :D
Hi schmit...........
In the mopping up operation please take a look here..........no personal or commercial connections, just a satisfied customer recommendation:
http://www.diamondcs.com.au/
Process Guard will protect AV and Firewall (software) and anything else for that matter.......
Look at the "products" bit and check out "RegistryProt" which is free............even to corporates :)
That has saved a few a$$es (a donkey, genet and mule) in my time :D It warns you if the registry is about to be changed, and how, and by what..........nice tool?
The other stuff is worthy of consideration as well..........
Good luck
Good advise: we run Trojan Defense Suite 3 (TDS3) and love it! We use it for initial scans.Quote:
Originally posted here by nihil
In the mopping up operation please take a look here..........no personal or commercial connections, just a satisfied customer recommendation:
http://www.diamondcs.com.au/
Hey wait a second...I thought you were a BillP Studios fan (re.; WinPatrol) lol. I actually found that I couldn't uninstall RegProt from an XP machine that I had installed WinPatrol on as well...maybe they were too busy fighting. ha ha.Quote:
Look at the "products" bit and check out "RegistryProt" which is free............even to corporates :)
Anyway, along with RegProt, WinPatrol is good too www.winpatrol.com
Agree with Nihil about containment first. Here's the approach we use in your type of situation....
1) Identify the victims: sometimes that involves quick reviews of firewall logs, IDS, etc and if widespread shutting down whole networks to contain the critter
2) Pull them off the net but keep them powered up -- tell user not to touch them
3) Quick assessment using tools off CD (original O/S tools could be corrupted): network ports open (OpenPorts and NETSTAT), processes running (PULIST by SysInternals) record this list down in text file, state of AV and firewall (versions, etc)
4) Connect victim PC up to private network: we have a 4 port hub in our security incident *jump bag* for just this use; hard code IP
5) Connect security laptop up to private network: hard code IP
6) Note: security laptop has a firewall protecting it from any attempted unsolicited connections from the victim PC
7) Start up packet sniffer to see what traffic the victim is spewing out if anything
8) Reboot victim PC into Knoppix (LIVE CD if you didn't know): this way you can bring up the file systems without bringing up the infected PC
10) Run Samba server in Knoppix and share out all drives
11) Scan shared drives (at root level) of victim PC using TDS3 and AV software: note that we scan the directories to most likely contain malware first to save time:
Windows = c:\winnt or c:\windows, c:\documents and settings, c:\program files
Linux = all bin and sbin directories; there are others as well but dont have them close to me right now...plus most incidents are infected Windows desktops :)
Now using the info we gained on the quick assessment we sometimes will to a port scan of all our networks looking for any of the suspicious listening ports that might have been found on victim PC to see if anyone else is exhibiting the same. Review firewall logs to see what IPs the victim visited prior to report of infection.
More advanced forensics work involve mounting the infected drives into a separate PC that already has a boot drive. Then scan through the various directories for evidence as to what happened, how the malware got in, what it did, files recently opened, etc etc.
Between Nihil's tips and these hopefully it will give you some good info for this incident and future ones. I wish you luck....the adrenalin is pumping isnt it?! While these are frustrating, they are also exciting and fun.
Keep us posted, I'm very curious what you got here.
Here's a quick update...
McAfee came up with two updates for us last night one at 1 AM and one at 5 AM...both of which hung in the process of installation. This morning the final one that they came up with....after being loaded, will prevent a machine from getting infected but will not clean a machine that's already infected. Thanks again for all the advise....
I have found a variant of this on my mother-in laws computer (go figure) same scenery, but this had also implanted itself as a system service. I had re-booted into safe mode to remove the service and all registry changes.
But in regular mode, could not get into control panel to see if I could start shutting off ports to see if I could get it to stop. Also I could not open programs from start had ot go through the run window. Seemed to have made several programs all with different names. So if I moved it to virus vault it would just make another program.
These were intstalled in the windows directory. I am going to try a recovery tomorrow.
Ok, tell the class please - what filenames and locations, what service name, etc. as you find them? Some of us want to be curious without having to tear apart the offending program... (that's why we love Nihil and Ric-o) :D.
Ok. If you are running ISS you should be able to find the first infected system by highlighting the tag name, right click and select "What are the sources of this event?". Then all you have to do is filter the "Earliest Event" and wallah, you have the first offender. And now you can give us the details.
If I had to guess on what little we know, I would go with a MyTob worm variant (a.k.a)MyDoom. At least MyTob meets all of the conditions described so far.
The service was called of all thing 'Network Security Service'. The file was ipcw.exe, sitting in the Windows directory. Service name was a bunch of gibberish.
But then there were a bunch of other small exe files sitting in the windows directory that would fire off as you removed them, so ina s ense one would take anothers place. They were dated back to about March 9th, so it was probably going on since then.