Solved

Virus Kronos

Posted on 2016-10-21
4
83 Views
Last Modified: 2016-10-31
Hi Experts,

our firewall alerts me about connection to this IP: 204.79.197.200
It also alerts me about KRONOS Virus.
More and more machines are affected.

Can you help me with this ?
What kind of IP is it ?
What is KRONOS ?
How to get rid of it ?
0
Comment
Question by:Eprs_Admin
  • 2
4 Comments
 
LVL 11

Accepted Solution

by:
andreas earned 250 total points
ID: 41853510
The mentioned IP belongs to microsoft. So it might be legit communication. Which ports are involved on the PCs and on the remote site?

The KRONOS Virus hides itself inside the registry and does not leave infected files on the PC.
It can, steal passwords, record keystrokes and install other malware from the internet.

https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Kronos-A.aspx
0
 

Author Comment

by:Eprs_Admin
ID: 41853584
Ok I also checked, this IP is from Microsoft.
But why it is in combination with KRONOS ?
0
 
LVL 11

Expert Comment

by:andreas
ID: 41853619
Portnumbers may shed some light. So which ports on the IP the clients with the virus are trying to access?

What does a local AV-Scan, on a PC the firewall reports, show?
0
 
LVL 29

Assisted Solution

by:Sudeep Sharma
Sudeep Sharma earned 250 total points
ID: 41854015
You should be more concerned to the local IP address which is trying to make connection with Kronos Virus on Microsoft IP.

Find the system and scan it, it might be infected already.

Sudeep
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Never store passwords in plain text or just their hash: it seems a no-brainier, but there are still plenty of people doing that. I present the why and how on this subject, offering my own real life solution that you can implement right away, bringin…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

937 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

5 Experts available now in Live!

Get 1:1 Help Now