Solved

How to remove a Dubrute virus from Server

Posted on 2012-03-22
8
8,575 Views
Last Modified: 2013-11-22
We have a Windows 2003 server (member server of a domain) that is used for terminal service connections (remote desktop).  About once a week, the cable internet slow down to a crawl.  We rebooted the server the first couple of weeks, but last week I was trying to figure out why it was slow before we rebooted it.  I logged into it via remote desktop, looked at a few things like event viewer and Anti Virus status things then logged out of the remote desktop.  When I logged out, I got a strange little window that said something to effect of dubrute.exe closing.  It appeared as if my logging out forced this dubrute application to force itself to shutdown.  When my session logged, out, the internet jumped back up to normal speeds and the remote users worked fine for a few days.  Yesterday, the internet went back down to a crawl, and after I logged back into the server remotely again, the same thing happened when I logged out.  The dbrute little window popped open and I clicked OK to close it (I presume) and the internet jumped back up to normal speeds.

I have AVG Server edition installed on this server, and while it has found problems in the past, all the scans I run on it now are clean.  I ran malwarebytes as well, and that comes up clean.  I have checked the startup services and startup apps in the MSCONFIG window, and nothing is out of the ordinary.  I did a search in the registry for dubrute and nothing came up.  I checked all installed applications in add/remove programs and everything looks normal in there.  I checked the task manger yesterday when the internet was really slow and didn't see anything called dubrute running as a server.  I am thinking about running combofix, but because this is a server, I am nervous about doing that.  Any ideas???
0
Comment
Question by:jbobst
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 6

Assisted Solution

by:netjgrnaut
netjgrnaut earned 167 total points
ID: 37752595
Yes.  Rebuild the server.  It's the only way to be 100% certain that the problem has been resolved.  You cannot - cannot - trust any host once it has been compromised.
0
 
LVL 38

Assisted Solution

by:younghv
younghv earned 166 total points
ID: 37753051
Please do not use ComboFix on any server platform. It is not designed for it and is not recommended.

Both RogueKiller and Malwarebytes are server safe and you should use them as described in these EE Articles:
Rogue-Killer-What-a-great-name
Stop-the-Bleeding-First-Aid-for-Malware

DUBrute is fairly old (June 2010) so most tools can handle it properly. Here is a link to an EE solution for this problem from last year:
http://www.experts-exchange.com/Q_26979796.html

In the FWIW department - there are rare occasions that I am not able to be confident that a system has been thoroughly cleaned - 2 or 3 times a year out of a couple of hundred incidents.

A complete system rebuild is not sufficient to eliminate some malware variants and it is better to use the tools that can get the job done right.

As soon as you get the system running properly, please make sure that you run all patches/updates for the OS and all applications.
0
 
LVL 1

Author Comment

by:jbobst
ID: 37753133
Thanks for the advice.  By the way younghv, I am curious how a system rebuild is not sufficient in eliminating problems?  If you format the hard drive, or just put in a new hard drive (they are very cheap) how can that not get rid of a virus???
0
 
LVL 38

Expert Comment

by:younghv
ID: 37753162
There are malware variants that infect the MBR, hidden partitions on the HDD, and even the BIOS ROM. A new hard drive would solve for the first two examples, but not for the third.

This is from an earlier post here on EE:
http://www.globalnet-iti.com/innovations/blog/1st-virus-that-infects-a-computer-s-bios-is-discovered/

Storing the malicious code inside the BIOS ROM could actually become more than just a problem for security software, giv[en] the fact that even if antivirus detect(s) and clean(s) the MBR infection,
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 6

Expert Comment

by:netjgrnaut
ID: 37753200
A complete system rebuild is not sufficient to eliminate some malware variants and it is better to use the tools that can get the job done right.

That's absolutly wrong.  Furthermore, leaving a malware-infected production server connected to the network after "cleaning" the malware is in direct opposition to security best practices.

Not one of my corporate customers would stand for such a response.  A once-compromised system is an unnaceptable risk to the entire organization.

BTW - there's un underlying root cause analysis that should be done any time a server is infected with malware.  Are your server admins browsing the Internet from the server console with elevated privs?  Either an unpatched vulnerability was exploited, or this is the result of poor practice.  If you don't take the time to figure out - and correct - the root cause, you'll be doing this again... soon.
0
 
LVL 38

Expert Comment

by:younghv
ID: 37753761
jbobst,
I stand by the comments I made and I think the link I provided (more if needed) is ample proof that there is existing malware that cannot be removed by formating/replacing a hard drive.

Malware discussions are often joined by those with differing opions, some more obnoxious than others.
0
 
LVL 5

Accepted Solution

by:
9660kel earned 167 total points
ID: 37770236
Another article on the function of the mebromi virus:http://www.symantec.com/connect/blogs/bios-threat-showing-again
This is a really good reason to set the write protection in your motherboards BIOS, and most boards have it.

Meanwhile, the environment you work in tends to shape the philosophy that you use.

In some cases, it can be better to simply re-image the system, especially where you have the resources to automate the task and all documentation to streamline the process. In a medium enterprise environment, I would tend to re-image the machine, but not before I determined the infection, and the source, if possible. Doing a procedure audit is a good move in larger environments as well.

In most cases, I prefer to clean the infection, as this is very expedient. Not all users or even companies have proper documentation and backups to rebuild the system, not all infections are actually difficult to remove, and only a few have residual infection potential.

Now, down to business, DUBrute is a hack tool, so it is possible that you have an interloper on your network. Simply cleaning the system in this case might not get you very much value, instead you might want to focus on entry vectors, and open ports that might not be needed. Checking router logs for suspicious traffic, or enhanced logging may help to pinpoint and block perpetrators.

Sophos anti-virus claims to be capable of removing this threat, and they are usually good at their word.

However, if it isn't showing up in programs or processes, it could reside on another system. I would look for listening ports that are not used for your installed apps, one article mentions port 3389.
0
 
LVL 1

Author Comment

by:jbobst
ID: 37802202
Sorry for the delay in closing this question.  Thanks for the information!
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Moving SQl Server SBS 2003 to SQL Server 2014 27 119
How to virtualize old server? (2003) 7 91
WSUS Feature Updates for WIndows 10 6 91
Connecting two servers 30 75
PREFACE The purpose of this guide is to provide information to successfully install the MS SQL client tools for the Symantec Endpoint Protection Manager (SEPM) to function properly when installed on Windows 2008. AUDIENCE Information Technology…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now