Try scanning with hitman pro cloud scanner
http://www.surfright.nl/en
Main Topics
Browse All Topics
Loading Advertisement...
Question
New Virus/Malware ...
I have a few servers under my control and of these 8 of them are exhibiting something strange. The only thing these 8 servers have in common is that they are Windows 2003 ... we found some ports open to vip762.3322.org on these servers the other night and are trying to figure out what is happening ...
What we know -
The ports are NOT the same on each box, although there are some common ports but not across all of the boxes, i.e. - 3 or 4 of them may have port 1114 open, but not the other 4 boxes ...
Some of the ports connect to microsoft-ds, some to LDAP, some to just other ports ...
There doesn't seem to be a huge decrease in available bandwidth across the network
the 3322.org is the Chinese DNS Responder that had something to do with the SQL Injection Attacks from not too long ago, and the same one from the ActiveX Video vulnerability.
Blackholeing thru DNS doesn't stop the connections
Antivirus (AVG, McAfee Stinger, and the MSRT) does not find any problems on these machines, it does occasionally find bad files in user folders, or email (if the server has exchange running)
These servers are both Standard 2003, and SBS 2003 ... some of them have the websites running on them and others have absolutely no firewall ports open for inbound connections.
The only software in common between these servers is our Kaseya Agent software, and Kaseya's version of VNC, along with standard security patches (all boxes are completely patched up to date) - Some boxes run QuickBooks Server, some run QuickBooks (07 thru 09) and some run MSDE 2000, some don't run any SQL at all .... some can be accessed via RDP and others can not be accessed at all (except thru Kaseya)
This is really annoying as it appears to be something new and latent, perchance a new version of COnficker or something like that?
Anyone got any ideas on what to try and what to look for, etc ...
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
The Hitman Pro file was NOT the one causing the port connections ... I did notice something however on the reboot after running Hitman ... and confirmed this by rebooting another server with symptoms ... the ports that connect to the vip762.3322.org are different ones on each reboot for that machine .... so we're still stuck not knowing what this is or how to correct it and close these ports short of getting a firewall and closing down all outbound connections. Personally I'd rather find out what this is that is causing the ports to open in the first place ... BTW no Windows 2008 or 2000 servers have been affected, nor has any workstation OS either ... just the 2003 Servers, and not all of my 2003 servers either ....
Not to well up on these matters but run active ports and it should show you a remote ip to see where it going
http://majorgeeks.com/Acti
You could try scanning with malwarebytes and see if it picks up on anything
Malwarebytes http://www.malwarebytes.or
Host does resolve to Houston,Texas,US.
Could you run autoruns (dont make any changes within autoruns)
Autoruns http://technet.microsoft.c
Within Autoruns,select the file tab and select save(Ctrl+S)
Upload that file here.
TBK:
Your systems are more than likely infected with a rootkit and all of your data is being exfiltrated to foreign country. It is also very likely your systems have given up complete admin control to an external party.
3322.org aka theplanet.com is a hotbed of foreign national hacker activity and is very well known to host old and new exploits.
My triage recommendation would be to turn off internet access to these systems if possible until you can determine the depth to which your systems have been compromised.
There is a chance you can do some of the analysis yourself, but if those servers house any kind of personal/sensitive/company
The first thing you likely want to determine is what computer process is responsible for these connections. I recommend a small and very effective tool call TCPView. This will show you a list of your open connections and tie it back to the process on your computer that is initiating these connections. Second, you can try running another utility called Process Explorer on whichever process(es) are responsible for the connections. This might be able to give you a more granular view into what specific files you are dealing with.
Once the files are identified, copy them and submit them to www.virustotal.com and see if you get any hits. If you find a product that detects these as trojans/rootkits, I'd recommend buying whatever that product is and running it against your servers.
Lastly, I'd also recommend you block the entire 61.160.128.0/17 and 74.52.0.0/14 subnets on your border devices. You will still see connections outbound from your servers, but at least you should be able to check the router logs and see that they are being dropped.
Sorry to hit you with what I'm sure is news you don't want to hear, but trust me when I tell you your servers are 99.99% compromised. I've dealt with this domain and their "products" professionally for 3 years.
Depending on the size of your company and the kind of data your process, you may still need to bring in some computer security analysts and forensics investigators to make sure you got the entire threat and that this isn't just the tip of the iceberg (i.e. all your password have been compromised, all your workstations are also infected, your systems are being keylogged, etc).
I don't offer this service, but I can recommend some companies if you get to that point.
http://technet.micro
http://technet.mi
P.S. If you are seeing active connections to these addresses but they aren't showing up in TCPView, then you are definitely infected with a rootkit that is specially designed to hide itself from utilities like TCPView.
You may want to run GMER rootkit revealer as well. It's not super user friendly, but it is VERY good.
Malleus -
As of right now there is nothing flowing thru those ports, no info, nothing, just sitting there and waiting ... i found the connections using a simple tool - netstat -a ..... and interestingly enough when I netstat -aon to find out which processes are running to which ports only the ports that are connected to the far ends LDAP ports show up and those show up as DNS.exe and w3wp.exe as the processes responsible for opening those ports, and they show as connected back to the loopback at 127.0.0.1 in the netstat -aon command .... so perhaps my blackholing the DNS in the first place is actually working and blocking them out from info being sent anywhere now, or any commands coming in - and my logs show from before I identified these ports that very little if any info at all ever flowed thru those ports to begin with ... I think I am looking at a new virus/malware (in fact pretty sure of it at this point -- and it looks like I've got it pretty well sandboxxed at the moment too) the servers do not contain any sensitive data at all they're mostly just gateway servers, and the real data servers behind those are not exhibiting the same problems - believe me if they do I will immediately pull them offline ... so for the moment I believe I'm fairly safe to keep playing with this to see where it leads ...
I will double check with TCPView and ProcessExplorer as well to be sure I am seeing the same things there as well ... thanks so far ...
running TCPView also showed that there were no real connections to the malware site ... only loopbacks to the server itself and it also showed what netstat -aon showed that the DNS and w3wp were the only 2 ports that actually corresponded to the ports that netstat -a showed as being connected to the malware site .... so this is confusing now ... like I said I am pretty sure i've found something latent and just waiting to go off at a future date ... since we have AVG contracted for the antivirus on these servers we're trying to get them to take a deeper look into these servers and see if they can find something as well ...
Anyone else have any ideas on things to check in order to find/figure out exactly what is happening? These are small businesses that can not really afford to hire a forensics team to do this type of research as well ... hence why I am trolling for answers here ... thanks again for all the help that has been offered so far, and hopefully all the help to come!
noted in the K forum.. you might want to confirm that the kill bits were actually set and stayed set regardless of whether the patch was indicated as applied. fact that 2008 not affected matches with the original exploit. won't help you fix the problem but another thing for folks to look for if you are in fact an early recipient of something related but new. just thinking out loud.
Ok so it looks like you are running IIS 6.0 on these servers and it is your webhosting cluster then?
I would still copy the dns.exe and the w3wp.exe and submit them to virustotal.com just to doublecheck yourself and be on the safe-side.
In addition to trying to figure out why these systems are connecting to known bad foreign malware sites, the question remains as to how they got exploited in the first place. Is there a trust relationship in place between all of these servers? So if an attacker was to exploit one of them, could he then use the credentials from that server to access the rest?
Connections to this IP with little traffic indicate either a beacon scenario where it's just keeping tabs with the mothership letting it know it is still there or possibly a persistent reverse-shell where the attacker has constant access to cmd.exe with administrative privs. Just because these are going out through DNS and LDAP ports, doesn't mean that this is what is actually travelling out via those ports, just that these may be the only ports that were open to communicate.
the w3wp.exe process is the IIS application pool process. According to Microsoft, you should be able to narrow down which website is attached to that process via the following command.
---- copied from http://weblogs.asp.net/ows
Micro
The script is already placed in systemroot\system32 on Windows Server 2003 so simply go to your Command Prompt and type in iisapp.vbs (the .vbs is optional) and you'll have an instant list of all the App Pool information you've always wanted to know. You may need to type cscript iisapp.vbs instead if CScript isn't your default WSH script host.
Let's see an example of the output:
Here is an example of the output.
W3WP.exe PID: 1468 AppPoolId: AppPoolForSite1.com
W3WP.ex
W3WP.exe
Direct from the horse's mouth, Microsoft documents this:
http://www.microsoft.com/r
-----------
This might help narrow it down to which site might be compromised or potentially even hosting malware that is being served from a compromised site.
Give that a shot, and let us know.
the iisapp.vbs shows 2 app pools connected to w3wp.exe neither of which the PID matches the one from before - 1 is the DefaultAppPool and the other is the ExchangeAppPool ... NOTE HERE - not all of these boxes are running exchange, yes all of them do have IIS setup, but not all are accessible from the outside either NAT boxes are in place in front of all of these to allow only certain ports in, but some of these have no holes in as well, whereas some have full access to all the ports a 2003 SBS Server wants open - Remote Desktop, SMTP, FTP, etc ...
BTW both dns.exe and w3wp.exe cleared thru virustotal.com as clean
Let's see how protected or naked you are. I am going to give you some methods to allow you to see what a hacker sees from the outside world.
__________________________
Please review this portlist and tell me what applications are listening on those ports.
http://www.iana.org/assign
You can also run "Netstat" at the command prompt to see open/listening ports. these are your active ports.
__________________________
Remember, you are behind a layer 3 hardware router/ NAT firewall, so you are relatively safe for now. Tell me a litte about your router. It might be a good idea to put you on the access list to deny any authentication from the outside world. Do you use Citrix, have domain authentication from the outside or have VPN connections through your router? If not, let's lock this down from the outside, so there is no doubt.
So, go to this web site that is a legitimate port scanner. It will tell you how naked you are to the outside world. Run the program called Shields UP. It will scan all ports up to a certain point, I can't remember what port that was.
This will allow you to see what a hacker sees from the outside of your domain.
http://www.grc.com/intro.h
__________________________
Check your event logs under the security events to see if you have a bunch of failed logons. If so, they may have an open path to you but no way to logon and authenticate. One of the prime symtpoms of the Conficker/Downadup virus is a lot of failed logons and the inability to contact any Antivirus web site, (like symmantec, or Mcafee).
__________________________
Now, run Hijackthis and copy/paste and post it on this web site. This will show trojans, worms and keyloggers pretty well.
http://www.hijackthis.de/
__________________________
We will check for root kits if all else comes up clean:
grc I ran awhile back - only the ports that I want open are actually showing open thru them - smtp, ftp, remote desktop, vpn, etc ... Netstat -a is actually how I came across this anomaly in the first place on these boxes ... again keep in mind, while I use NAT Routers (Linksys Routers) not all of them have the same ports open - at least 1 box has nothing port forwarded, 2 or 3 of them have all the ports that SBS 2003 suggests open, the rest are somewhere inbetween - from just SMTP and HTTP, etc ...
I had not checked for failed logins - will do that and see what that shows ... and will run HiJack this as well in the AM and will post all results here tomorrow AM ...
OK, at this point, I think we should get an idea of what ports and what is supposedly in contact with your server on those ports. If your NAT firewall isn't allowing traffic through those ports, you shouldn't have anything to worry about.
The signifigance of a NAT router/firewall is your application ports as well as your entire PRIVATE IP space will be stealth from port scanners. The only way for your domain to be accessed is through your VPN tunnel, a trojan that allows communications between the two and provides the route as well as authority to communicate with it. If your passwords are strong passwords, I don't think you have anything at all to worry about. Kerberos authentication is certainly very strong, unlike LMhash and NTLMhash.
Though things seem suspicious, you probably don't have anything to worry about.
So, let's start studying who, and what is really going on. I don't think you have malware on your DCs. So, you will probably not see to many failed logons.
After reading through this thread I'm a bit surprised nobody mentioned the possibility of a local workstation being compromised rather than the server. DNS may show the open port, but it could be because a client machine is getting it to resolve the domain.
If the servers seem benign, then I would start scanning local workstations to see what's up.
An iterative query through DNS means the client will seek its own DNS query.
A recursive query for DNS means that the server will perform an iterative query on behalf of the client. Many people saw this as a potential IT security threat to enable recursive lookups and also DNS forwarders.
This is why it is important to determine what port we are looking at. The DNS server could be doing DNS queries on behalf of the client. But, forwarders and recursive lookups need to be enabled and configured.
Netman is right on the server performing DNS queries for the client.
Agreed concerning the w3wp process, that is a little puzzling if the server shows no signs of activity relating to this.
Would it be possible that a redirect to a client is at play via a compromised default page within IIS - thus leveraging the service on the server without actually triggering malicious traffic directly?
I'd be tempted to start a Network Monitor on the inside interface of the router to see if any traffic from inside is moving out to that Chinese site. At least this may help trace the flow.
btw- i believe that this behavior is happening on multiple of TBK's clients' sites. If this is an invasion of sorts then the commonalities are:
the kaseya server at TBK's HQ and whatever flows through the Kaseya tunnel
the security setup be it firewalls, AVG, patching, etc that are determined by TBK's kaseya configuration
(which in all likelihood is nearly identical - to facilitate easier management (ours are at any rate)).
Possibly the ISP and DNS providers.
I will check a sampling of our managed systems.
We still should know the port we are looking at.
If the server performs a query on behalf of the client, (a recursive query), It will only pass down the resolution to the client. In other words, the server will not act as a proxy between the client and the remote site.
So, after the recursive query was answered, traffic would stop. The client would then contact the site directly. This is why DNS is really not a heavy traffic protocol on the server.
If the port number is port 53, I would be willing to bet Netman was right on is original thought. It would most likely be a recursive query on behalf of a client machine. If that is the case, you can prevent access from that remote client using the NAT firewall. This would be firewall specific.
For Cisco, as an example, you could deny access to that site by putting the IP of the site on the access list deny all traffic of the remote site's IP.
the lines from netstat -aon are as follows --
TCP 127.0.0.1:14757 127.0.0.1:389 ESTABLISHED 1592=DNS.exe (by tasklist)
TCP 127.0.0.1:17390 127.0.0.1:10080 CLOSE_WAIT 3840=W3WP.exe (by tasklist)
and the lines from netstat -a are as follows --
TCP server:ldap vip762.3322.org:14757 ESTABLISHED
TCP server:ldap vip762.3322.org:17473 TIME_WAIT
TCP server:1055 vip762.3322.org:ldap CLOSE_WAIT
TCP server:1072 vip762.3322.org:ldap CLOSE_WAIT
TCP server:1116 vip762.3322.org:ldap CLOSE_WAIT
TCP server:1130 vip762.3322.org:ldap CLOSE_WAIT
TCP server:1216 vip762.3322.org:ldap CLOSE_WAIT
and 2 more lines a bit farther down are --
TCP server:14757 vip762.3322.org:ldap ESTABLISHED
TCP server:17390 vip762.3322.org:10080 CLOSE_WAIT
So this is NOT happening on Port 53 ...
Netman - not possible that it is on workstations as one location is just a server, no workstations at all ...
ChiefIT - yes all the servers are set to use recursive DNS and forwarders are set to OpenDNS DNS Servers ... the entire domain of 3322.org is blackholed/blocked from there ...
GandZ is right the commonalities between the affected units is only the connection to my K Server, & the usage of OpenDNS for DNS Forwarding. Other than that - different software, different dime store routers, different usage by the clients, etc. Some servers are by themselves, some server webhosting, some do remote desktop, some do exchange email, etc ... However Kaseya has checked my KServer for abnormalities and cleared it and then closed my ticket on this issue from them - didn;t even let me get AVG involved for the KES/AVG Licenses thru them ....
BTW -- HJT didn't find anything out of the ordinary either ... this thing seems to be sandboxxed fairly well with the DNS blocked to the actual site ... but it's still strange to have this happening - I am getting permission to rebuild/reload one of the affected machines - I want to see if after it is rebuilt if the anomaly stops or if it restarts right away ... this will take some time tho, but if we haven't solved any other way before then I'll post the findings here ...
TCP 127.0.0.1:14757 127.0.0.1:389 ESTABLISHED 1592=DNS.exe (by tasklist)
This first line is an LDAP query against itself. Port 389 is an LDAP query, and the DNS server pointed the way using a SRV DNS query. You are currently using the Loopback address to point the DNS server to istelf. It is recommended you use the actual IP address, instead of the loopback address.
TCP 127.0.0.1:17390 127.0.0.1:10080 CLOSE_WAIT 3840=W3WP.exe (by tasklist
According to portlist:
Port 10080 is Amanda as an application:
amanda 10080/tcp Amanda
amanda 10080/udp Amanda
# John Jackson <jrj&gandalf.cc.purdue.edu>
# <amanda-core&amanda.org>
Some information on Amanda:
http://www.auditmypc.com/p
***The weird symptoms you are seeing on your network are not attributed to a virus>
You should tell us what "weird things" you are seeing that led you to believe you may have a virus and what caused you to start troubleshooting in the first place.
the strange things were the netstat -a results showing the 3322.org address being the one contacted by several ports ... as I said the netstat -aon seems to show loopback addresses rather than the 3322.org address instead for the same ports ... why is that?
Is the loopback being used because OpenDNS is blocking the 3322.org address? If so, then as I said, whatever it is it is fairly well sandboxxed at the moment ...
Look under IPconfig /all
If your preferred DNS server list (primary &/or secondary) is the loopback address, these DNS queries will go to that loopback address.
If the preferred DNS servers are your IP addresses of the server, the DNS query shouldn't be your loopback address. In this instance, you may have had someone intercept a DNS packet. Then, they changed a few things on the header. Then, they queried your server. This is known as a DNS DDoS attack. However, you probably have your DNS server set to answer queries it is authoritative for. If that's the case, your server will drop the packets if the DNS headers were changed to answer queries for yadah,yadah.yadah.org.
yes the servers run DNS and are authoritative for their own domains as far as the internal domain goes ... anything for external is forwarded to OpenDNS thru DNS Forwarders, and OpenDNS has blacklisted 3322.org for all of my servers ...
I don't think anyone would've intercepted internal queries as that would never have left the internal network, and port 53 is not open incoming thru the NAT firewall router ...
I think whatever this is at the moment is benign and/or sandboxxed via DNS so I'm not going to worry about it too much for now and will work on reloading the OS and data on these servers 1 at a time until they are clear ... I was hoping that someone would be able to shed some more light on what it might possibly be, all good ideas and will split the points between everyone who offered advice - thanks all !!!
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: MikeHolcombPosted on 2009-10-31 at 14:26:16ID: 25711609
Based on the domain name involved and your lack of success with current anti-virus solutions, I would suspect that a type of trojan/rootkit has possibly been installed on the system. I would suggest testing the systems with F-Secure's Blacklight application (http://www.f-secure.com/e
Hope this helps...
Mike