Security Basics mailing list archives
Re: Hacked
From: Matan Peled <chaosite () gmail com>
Date: Thu, 14 Apr 2005 22:58:32 +0300
Mauricio Fernandez wrote:
This morning I found a wwwhack window opened on one of my w2k servers, antivirus agent was deleted (TrendMicro) and when I reinstall it back, it found about 4500 viruses named PE_PARITE.B Now the virus is still regenerating itself creating files on winnt\temp folder, I saw the task list and stopped all the suspicious process, but the virus still goes on... The virus/hacker created a folder named RADMIN, where he copied these files: r_server.exe admdll.dll hide.reg raddrv.dll pro.bat start.bat Does anyone knows how to remove this virus and avoid this hack vulnerability?
First of all, RADMIN is most obviously "Remote Admin", which means he left himself a backdoor. My hints - get your data off that server, and completely reinstall the machine. Note that the virus makes a DLL that attaches itself to the Explorer process, which means that you effectively cannot see the virus's process in the task manager. Also, the virus spreads by exe/scr files, so be careful. To avoid being hacked again, find out how the hacker got in - possibly through the software being run on the server. -- [Name ] :: [Matan I. Peled ] [Location ] :: [Israel ] [Public Key] :: [0xD6F42CA5 ] [Keyserver ] :: [keyserver.kjsl.com] encrypted/signed plain text preferred
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Re: Hacked, (continued)
- Re: Hacked confi dential (Apr 14)
- RE: Hacked Mauricio Fernandez (Apr 14)
- RE: Hacked Dr.Chandra (Apr 15)
- RE: Hacked Mauricio Fernandez (Apr 14)
- Re: Hacked Markus Pieton (Apr 14)
- Re: Hacked Jacob Bresciani (Apr 14)
- Re: Hacked Ansgar -59cobalt- Wiechers (Apr 18)
- Re: Hacked Nathaniel Hall (Apr 14)
- Re: Hacked Valentin Höbel (Apr 14)
- Re: Hacked xyberpix (Apr 14)
- Re: Hacked Alen Capalik (Apr 14)
- Re: Hacked Matan Peled (Apr 14)
- RE: Hacked lista (Apr 14)
- Re: Hacked Etapien (Apr 15)
- Re: Hacked matt donovan (Apr 18)
- RE: Hacked Joshua Berry (Apr 14)
- RE: Hacked Jason DeCamp (Apr 14)
- RE: Hacked Steve Scholz (Apr 14)
- RE: Hacked Conlan Adams (Apr 14)
- RE: Hacked Mauricio Fernandez (Apr 14)
- RE: Hacked Mauricio Fernandez (Apr 14)
- RE: Hacked Mauricio Fernandez (Apr 14)
(Thread continues...)
- Re: Hacked confi dential (Apr 14)