Solved

Need to track down Infection in a Server 2008 domain user profile

Posted on 2016-11-15
7
24 Views
Last Modified: 2016-11-15
One of my customers remoted onto her server a couple of days ago and ran her Outlook email there. She received an infected email with an "Invoice attached" message, and, amazingly, attempted to open the attachment, which was a .jar file.

Don't recall her permission level on the server, but it was enough to run the .jar, but it stopped, prompting her to accept a command which is trying to insert a .reg file into the registry.  She did not permit the .reg file, thankfully.

I reduced her user account privileges to basic user, but whenever she logs on, Regedit is constantly requesting permission to run a .reg file. If she cancels, the prompt comes back one second later. I can stop it all by killing javaw.exe in the task manager.  However, when she logs back on, it starts up again.

Hers is the only user account affected, yet I cannot find anything anywhere that tells javaw.exe (or anything else) to start up when she, and only she, logs on. There are no suspicious extensions or add-ons in her Chrome or IE browsers. I've scanned her user profile for visues, and run a rootkit detector, etc.  All clean.

Can someone advise?
0
Comment
Question by:DaveWWW
  • 3
  • 2
  • 2
7 Comments
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
run MSCONFIG as an administrator on the server and review all Startup Items and remove or disable anything suspicious. better also review services as well.

you may also right-click the taskbar and choose Task Manager to check Startup items.
0
 

Author Comment

by:DaveWWW
Comment Utility
Thanks.  I've been been through MSCONFIG and the Task Manager. I see javaw.exe in the Task Manager, which I can shut down, but it comes back when this user logs back on.  What I'm not clear on is how to find the source of this autostarting of javaw.exe when only a single user is having the issue.  No other users autostart the program javaw.exe.

I've checked the logon script for this user and it is no different than anyone else's.

That's the confusing part in this: Where is this single user receiving an instruction to run javaw.exe that attempts to run a .reg file?
0
 
LVL 37

Accepted Solution

by:
Bing CISM / CISSP earned 500 total points
Comment Utility
javaw.exe itself is not the issue or trouble maker, the process calls Java runtime is the one to go.

you may check the Java runtime's parent process ID, it should be pointing the target process or at least providing a clue.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Closing Comment

by:DaveWWW
Comment Utility
Thank you! That worked. I found the info using Process Explorer and then searched the registry for it, and deleted it out of the Run area for that user.
0
 
LVL 86

Expert Comment

by:CEHJ
Comment Utility
msconfig is good, but much better is Sysinternals'  'autoruns' - try that
0
 
LVL 86

Expert Comment

by:CEHJ
Comment Utility
Too late - but it might have got you there right away ;)
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
> Sysinternals'  'autoruns' - try that

yes, AUTORUNS can be handy to list ALL auto-start items from both startup folders, registr items and services, but you have to review them one by pen to guess if it is related or not.

the given method of tracking back to parent process can directly determine the related process or even thread (a virus way) and finally catch the source image file on file system.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

In this post we will learn how to connect and configure Android Device (Smartphone etc.) with Android Studio. After that we will run a simple Hello World Program.
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
The viewer will learn how to implement Singleton Design Pattern in Java.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now