Packets in are 10x packets out

Hello all:

I am extremely new to both computers and security. unfortunately, the web doesnt wait for one to become familiar with things before getting hit... I am running Microsoft XP, and surf the web with Internet Explorer.

I was surfing the web a few days ago, and one of the pages that came up was a trojan. i caught it (i thought) before it got into my comp, and I thought I deleted it. But now my packets out are 10 times my packets in, in my network connection status.

I have AVG, and have run it 3 times, once in safe mode. I have ad aware and spybot, and have run those as well. Finally, I have kerio firewall, and have always had that running.

I checked my Kerio intrusions, and have found several things:

BACKDOOR trojan active trojancow
trojan probe orifice
trojan backdoor construction
DDOS shaft synflood incoming

a bunch of SCAN things, from nmap to webtrends

a plethora of BACKDOOR trojans, from yetanother to Voodoo to portalofdoom.
finally, there were severa attempts to remote activation bind.

in the vast majority of things, the reference URL was www.whitehats.com/info/ID####
the other common reference URL was www.cve.mitre.org
there were several 4 digit numbers used.

Aside from the incoming packet thing, my comp has no problems. I did not have the latest updates from Microsoft, but I have them now.

updating was a very good start. You may want to try housecall.trendmicro.com It is one of the best virus scanners I know of. Also download stinger (just google it, it is a mcafee product that has saved me tons of time and agrovation in the past) both are free and both are awesome. Make sure all your anti malware software is up to date and run thoe two scanners. run stinger in safe mode and re run adaware and spybot in safe mode also. After all that is done, if the problem still continues download hijackthis and post the log here and some of us can help you out with what to delete.

As long as the intrusions have been logged by Kerio, you have nothing to worry about - it's the ones that Kerio didn't detect you should worry about :)

The reference URL is just a link to more information on the attack.

In your case, what I would do first is delete all Kerio rules, and start all over. Any time something requests a connection, look it up or ask for advice (look at what it's trying to connect to - look up the IP address). In addition to that, follow XTC46's advice :)

And run a trojan scanner (http://www.agnitum.com/tauscan for example).

Quote:

---

...surf the web with Internet Explorer...

---

Hi RamsestheGreat, have u checked out Firefox at http://********firefox.com or somebody recommended you using IE :p

Use firefox and get rid of most of spyware/malware problems.

Yes, it certainly sounds as if "ET is phoning home"

Get Ewido, and the Microsoft anti-spyware beta.

Update everything then re-boot into safe mode and run them.

Be warned, AVG, in common with a lot of AVs is not very good at detecting spyware and trojans. Hence the need to run specialist products in safe mode.

Good luck :)

If your machine is compromised you need to reinstall it and restore carefully from backups.

If you don't have a hardware firewall, be sure to install the updates before connecting to the internet; this is tricky if you have to connect to the internet to obtain them - ask a friend (who has not had their machine compromised) to burn the SP2 and latest updates on to a CD for you, so you can install them after you reinstall but before you connect to the internet (of course, run Windows Update too, once connected, to get any more recent ones).

Slarty

<a href="http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en&Hash=FP4FH6C">M$Antispyware Beta</a> - the only free one that stays running in the task bar

OK, SO here's an update.

I did all of the above suggestions. The only thing found was something that dealtwith Internet Explorer. I fixed that, but the problem persists.

I guess I will download the hackerlog and see if that provides any illumination...

Thanks for the advice, everyone. It was very appreciated.

OK, I got hijackthis, and here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 1:08:45 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\SmackyMc\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?ned=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?ned=
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: eurekster Toolbar - {7380543E-F530-42EF-BDB0-D03BCCFA7185} - C:\WINDOWS\Downloaded Program Files\eurekster-2.10.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Tau Monitor] C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &eurekster Toolbar search - res://C:\WINDOWS\Downloaded Program Files\eurekster-2.10.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: eurekster Toolbar - {B9510087-D944-4309-9823-38D3D544D15B} - C:\WINDOWS\Downloaded Program Files\eurekster-2.10.dll
O9 - Extra 'Tools' menuitem: eurekster Toolbar - {B9510087-D944-4309-9823-38D3D544D15B} - C:\WINDOWS\Downloaded Program Files\eurekster-2.10.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/game...ts/y/ht1_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt1_x.cab
O16 - DPF: {7380543E-F530-42EF-BDB0-D03BCCFA7185} (eurekster Toolbar) - http://home.eurekster.com/toolbar/eurekster.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/A...oadcontrol.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Greeting's

you hijackthis log looks clean to me except 1 entry

Extra context menu item: &eurekster Toolbar search - res://C:\WINDOWS\Downloaded Program Files\eurekster-2.10.dll/SEARCH.HTML

This search bar has been identified as nasty. Anyway looking at your hijackthis log it looks good except this i would advise you too creat new rules for your firewall something what negative said.

I have saved analysis of your log at
http://www.hijackthis.de/logfiles/fb...05792fd01.html

aside from a few things that are un-needed (but arent dangerous, like your tool bars) I dont see anything wrong. If you ran all the software we suggested in safemode and you got nothing found then your computer is clean. it could be a faulty nic card that is casuing tons of sent traffic. You were naming specific virii earlier so it means something caught it. if it found it than it probably got rid of it, if not look up the individual removal instructions and get rid of the stuff. Or take the easy way out and reformat. but you box looks clean from here.(but its not even 8am yet and I could have missed something)

being that you are running windows xp, you might want to try the nifty 'repair' option built into that os. believe it or not, it actually works sometimes. there are times in xp, where the nic card will start going goofy /tcp/ip stack gets corrupt, etc.

under network connections, right click on your active connection. hit 'repair'. windows xp will reconfigure your card. your settings will be saved. it takes only a moment, and is pretty much hit or miss. i have seen instances where cards will just stop sending packets all together, but continue to receive. most of the time, this simple 'repair' function will set things back to normal. worth a shot at least.

I went and deleted all my rules on my firewall, and slowly went about allowing access. It seems the burst of stuff comes from IE. When I accessed IE to download firefox, the in side jumped up by alot. but now I'm using firefox, and the in side is acting normal again. If I stop using IE, will that be enough, or can I get future problems? And could IE be the problem?

I did the repair thing, and it didn't say if I had any problems or not.

Also, as an aside, as a very new person to this sort of things, are the tutorial pages we have listed a good place to start learning about protecting my comp, or is there somewhere better to start from. And I mean start from, as I have extremely basic knowledge of computers and security.

Thanks for the advice and help, I really appreciate it!

Using firefox is a temporary fix. It does not solve the problem, it is just a workaround. What kind of traffic are you seeing when you start IE. What Ip addresses is it trying to connect to? From there we can see if it is just a very good browser hijacker. or something. Also, what do you have your homepage set to? have you tried changing it? show us a sample of your firewall log file from when you start IE, perhpas some of us can make some sense of this issue. If using firfox stops the problem then it sounds like a browser hijacker, which is very bad news. especially since IE and windows explorer are running very close together.

Ok, so when I open IE, microsoft anti spyware says that an application change has been blocked, and spyware asks if i want to allow a change to a user specific browser toolbar(i say no). when i follow the microsoft warning, it leads me to a list of blocked IE browsers. the only thing on the list is:

c:\windows\system32\browseui.dll

anyhow, does that help? I can show on my firewall log the list of intrusions, but the last entry seems to be from april 15th
does this help?

I am a bit lost with this problem...

The Complaint is: Incomming packets exceed Out going by a factor of 10 to 1? is that correct?
that is YOU are RECIEVING MORE than your SENDING? right?

Or are you SENDING 10 times MOre than Your RECIEVING?

please clarify this for me..

The unfortunate thing is any incomming traffic that is blocked by the firewall IS counted as part of your total incomming traffic..

Quote:

---

a list of blocked IE browsers.

---

May be an idea if you could attach a copy of your firewall log (only of the times you have a problem with) and a copy of that list you mention.. I am wondering how many Different Browsers are Installed on your PC.. and how many are Misrocoft..

Browseui.dll is a legit Windows DLL.. DON'T BLOCK IT..

http://www.liutilities.com/products/...rary/browseui/

Quote:

---

"Packets in are 10x packets out"

"But now my packets out are 10 times my packets in, in my network connection status."

"When I accessed IE to download firefox, the in side jumped up by alot."

---

Yeah it is a bit confusing.

Your last quote would explain why you had higher packets in than normal, you downloaded something, and it's quite a bit bigger than a webpage so the number of packets received are going to be significantly higher than the packets sent out to request the download.

If the second quote there is the right issue then the other people in this thread have already given you the same advice I could give you.

Sorry I was a bit unclear.

My info being received was ten times my info being sent. I know that I should get a spike from downloading something, but I initially noticed the problem because I was not downloading anything, and yet still the info coming into my comp was greater than the info it was sending.

Oh, and the list mentioned above, undertaker, wasn't quite a list. The only name listed was the browseui. Sorry if I wasn't clear about that.

And if you think it will help, I will get the list of intrusions. Unfortunately, I can't seem to be able to copy the list straight away, so I need to manually copy it (thus my question of its usefulness). Thanks.

Quote:

---

any incomming traffic that is blocked by the firewall IS counted as part of your total incomming traffic..

---

OK.. I am getting the picture.. your reciving data while not activley downloading anything..

That is your NOT Viewing ANY WEB PAGES at all?
or .. Your not flicking between pages at the time..

If it is the latter.. DO ANY of the pages contain advertising links.. and Could any of these be regularuly updated.. I have a Weather radar site as one of my Home pages it refreshes every 5 mins.. And if you notice a difference in this activity between IE and FF then what is Firfox blocking nativly that IE need to be Told to Block?

If your concerned about what is happening.. either learn how to use Netstat on XP or D/L and run TCPVIEW.. BUT YOU WILL NEED TO LEARN HOW TO INTERPRET THE RESULTS..

Regarding the firewall log..:

I may warn that if it is posted in the open..it may contain information that could reveal your identity.. I would recommend either sending it as a PM to a member you trust or Password the ZIPPED FIle..(oh forgot you will need to Zip it if it isnt in a TXT format..)

Greeting's

Assuming that you have already run an online scan mentioned by XTC46 and looking at your Hijackthis log I can see that your windows is patched up. And because you are still facing the problem I think you might want to give a try to Rootkit revealer
Get more information at :

http://www.sysinternals.com/ntw2k/fr...itreveal.shtml

Try using it if you find anything out of the ordinary tell us or simply post the log. Like hijackthis is used for finding adware and spyware use this for finding Rootkit's

Sience you are new in computer security field try reading this http://en.wikipedia.org/wiki/Rootkit


edit :

One more idea i can give you is running a sniffer for sometime. Try ethreal
download it from http://www.ethereal.com/

Let is run for some time, save its log BUT SAVE IT AFTER YOU SANITISE YOUR LOG'S (SEARCH FOR A TUTORIAL BY TIGER SHARK ON THIS SITE.)

OK, I ran the rootkit revealer, and it only came up with 2 things. the first was HKLM/software/classes/ and the other was HKLM/software/installer/... Does that mean anything? They were altered both on 7/11/2004.

Thanks for the help, everyone. I really appreciate it.

I wipe my hands of the thread:

I think we are chasing a ghost..

While idle.. a machine will recieve more packets than it will send..
internet noise and legitmate handshaking client to server and browser to certain websites

if we have a trojan.. WOULD IT NOT BE SENDING as much as recieved if not more that rx...?

Greeting's

Run a sniffer and post the log (AGAIN AFTER YOU SANITISE IT). Except that Ill go with Und3ertak3r I think everything on your pc is okay. Also give the exact registry keys.

Undies has put all ten in the "x-ring"........(bet he used a Sportco as well!)

If you are just browsing the web you are DOWNLOADING pages? this is in response to your relatively short UPLOAD request?

So, in a normal situation you must expect far more incoming volume than outgoing?

I fell into the trap of thinking that there was a real problem, and that the OP had just got it the wrong way round......../my bad

All I have done today since I fired up this box is log onto AO.......I am running about 8 in to 2 out.....that is what I would expect, as when I look at a new topic, I look at a new page, which has to be downloaded?

Good man undies!

:)

OK, and thanks for your help everyone.

It's good to hear that my comp isn't doing something it shouldn't. At least now I know where to come to learn about this stuff. Thanks again!