Security Incidents mailing list archives
Re: Compromised Windows Server
From: Axel Pettinger <api () worldonline de>
Date: Tue, 06 Jun 2006 10:09:47 +0200
Patrick Beam wrote:
Came in this morning to find a windows 2003 server I manage scanning the Internet for machines listening on tcp 139 and 445. While looking at the machine I noticed the following processes running. Mwvsta.exe found in c:\windows\system32
From my own collection ...
[\winnt\system32\mwvsta.exe] MD5 : 0fa478b74b1f64f09044df8f6b5703bb SHA1 : 7083ec98d4997a9700f7e97aa62c1c07c02e7bef Kaspersky : Backdoor.Win32.SdBot.gen (packed: PE_Patch, UPack) McAfee : New Malware.aj (heuristic detection) Norman Sandbox: http://sandbox.norman.no/live_2.html?logfile=927525 According to the Sandbox results "mwvsta.exe" connects to "comto.mybizz.info" [206.53.51.108] on port 1560 (TCP).
rundll16.exe c:\windows\system23 Ponoas.exe c:\windows\system32
Again from my own collection ... [\winnt\system32\ponoas.exe] MD5 : eddf174b022954589e2d423da9b7791d SHA1 : 162b17c5be842458f0fdffa2ccff4e8f97b6a0ff Kaspersky : Trojan-Proxy.Win32.Ranky.gen (packed: PE_Patch, UPack) McAfee : W32/Sdbot.worm.gen.h Norman Sandbox: http://sandbox.norman.no/live_2.html?logfile=927526
I believe that the ponoas.exe is some sort of rootkit although searching on google for this file name returns nothing.
"My" ponoas.exe certainly isn't rootkit related but comes as one of two files in a SFX RAR archive. Such RAR archives usually contain a trojan (i.e. SdBot variant) and a trojan proxy (often a variant of Ranky - McAfee's name for it is "Proxy-FBSR trojan").
Also searching mwvsta.exereturns nothing. At this point I have removed these files from the system and registry but am weary that the server will get hit again.
I recommend following the steps mentioned here - @Wes: especially if it is a mission critical system!: http://www.cert.org/tech_tips/win-UNIX-system_compromise.html#E
Has anyone had an experience with the following file or have any idea what rookkit of virus they are associated with?
Maybe you should re-read the definition of a "rootkit": http://en.wikipedia.org/wiki/Rootkit Regards, Axel Pettinger ------------------------------------------------------------------------------ This List Sponsored by: Black Hat Attend the Black Hat Briefings & Training USA, July 29. August 3 in Las Vegas. World renowned security experts reveal tomorrow.s threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations. http://www.blackhat.com ------------------------------------------------------------------------------
Current thread:
- Compromised Windows Server Patrick Beam (Jun 05)
- Re: Compromised Windows Server Jamie Riden (Jun 05)
- Re: Compromised Windows Server pauls (Jun 05)
- Re: Compromised Windows Server Jason Ross (Jun 05)
- Re: Compromised Windows Server Axel Pettinger (Jun 06)
- Re: Compromised Windows Server Harlan Carvey (Jun 06)
- Re: Compromised Windows Server Patrick Beam (Jun 06)
- Re: Compromised Windows Server Kees Leune (Jun 07)
- Re: Compromised Windows Server Isaac Perez (Jun 06)
- Re: Compromised Windows Server Macleonard Starkey (Jun 06)
- <Possible follow-ups>
- Re: Re: Compromised Windows Server wnorth (Jun 05)
- Re: Compromised Windows Server Butterworth, Jim (Jun 06)
- Re: Compromised Windows Server ross (Jun 06)
- RE: Compromised Windows Server Alan Davies (Jun 08)
- Re: Compromised Windows Server df (Jun 08)