DNS calls to Ukraine destinations

DNS calls to Ukraine destinations
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
DNS calls to Ukraine destinations Gary S. Terhune 09-24-2006
Posted by Gary S. Terhune on September 24, 2006, 2:41 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I have an XP Pro box on an SBS network (one SBS Premium server w/ ISA 2004,
two XP Pro clients.) The box was heavily infected by numerous viruses and
other malware on 9/11. Issues with antivirus installation resulted in its
not updating for some time, but I'm not certain just how it all got started.
Far as I can tell, none of it got to any of the other machines on the
network,

I cleaned up using various AV and anti-spyware tools (AdAware, Spybot,
Trend-Micro AV) and it seems to be healthy now, but the ISA logs show this
machine making repeated calls on DNS protocol, port 53, to two different IPs
that belong to a web hosting company in the Ukraine. I can't help but think
that this is malware in action, but can't determine what is doing it. The
ISA firewall is blocking the requests, but I'd like to know what's going on.
Any ideas on how to trace this? I can't find anything in running processes
that isn't supposed to be there. Note that these calls are being made even
when nobody is logged on to the machine. They're averaging one per second.

--
Gary S. Terhune
MS MVP Shell/User




Posted by Malke on September 24, 2006, 2:57 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Gary S. Terhune wrote:

> I have an XP Pro box on an SBS network (one SBS Premium server w/ ISA
> 2004, two XP Pro clients.) The box was heavily infected by numerous
> viruses and other malware on 9/11. Issues with antivirus installation
> resulted in its not updating for some time, but I'm not certain just how
> it all got started. Far as I can tell, none of it got to any of the other
> machines on the network,
>
> I cleaned up using various AV and anti-spyware tools (AdAware, Spybot,
> Trend-Micro AV) and it seems to be healthy now, but the ISA logs show this
> machine making repeated calls on DNS protocol, port 53, to two different
> IPs that belong to a web hosting company in the Ukraine. I can't help but
> think that this is malware in action, but can't determine what is doing
> it. The ISA firewall is blocking the requests, but I'd like to know what's
> going on. Any ideas on how to trace this? I can't find anything in running
> processes that isn't supposed to be there. Note that these calls are being
> made even when nobody is logged on to the machine. They're averaging one
> per second.
>

The box is definitely still infected. Since this is a work machine, I would
flatten it and apply your latest image. If you don't image your
workstations, I would still flatten it because you can't be 100% sure it is
trustworthy. Then examine your security policies on that workstation to see
how it got infected; i.e., make sure users can't install software, etc.

If you still want to work with it without flattening (not recommended), I
would remove it from the network first. Then run HijackThis and post your
log at one of the specialty sites listed below (in no particular order and
not here, please):

http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 - another
tutorial

http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forums.subratam.org/index.php?showforum=7
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/

Malke
--
MS-MVP Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"

Posted by Gary S. Terhune on September 24, 2006, 3:44 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Flattening isn't really an option for at least another two months. I work on
this network remotely and won't be getting down there until November. But
yeah, I figure I'll flatten it then. No, no imaging being done, just backup
of data files.

I don't notice any other odd traffic, and this stuff is being blocked. Guess
I'll run HJT and see what comes up.

--
Gary S. Terhune
MS MVP Shell/User

> Gary S. Terhune wrote:
>
> > I have an XP Pro box on an SBS network (one SBS Premium server w/ ISA
> > 2004, two XP Pro clients.) The box was heavily infected by numerous
> > viruses and other malware on 9/11. Issues with antivirus installation
> > resulted in its not updating for some time, but I'm not certain just how
> > it all got started. Far as I can tell, none of it got to any of the
other
> > machines on the network,
> >
> > I cleaned up using various AV and anti-spyware tools (AdAware, Spybot,
> > Trend-Micro AV) and it seems to be healthy now, but the ISA logs show
this
> > machine making repeated calls on DNS protocol, port 53, to two different
> > IPs that belong to a web hosting company in the Ukraine. I can't help
but
> > think that this is malware in action, but can't determine what is doing
> > it. The ISA firewall is blocking the requests, but I'd like to know
what's
> > going on. Any ideas on how to trace this? I can't find anything in
running
> > processes that isn't supposed to be there. Note that these calls are
being
> > made even when nobody is logged on to the machine. They're averaging one
> > per second.
> >
>
> The box is definitely still infected. Since this is a work machine, I
would
> flatten it and apply your latest image. If you don't image your
> workstations, I would still flatten it because you can't be 100% sure it
is
> trustworthy. Then examine your security policies on that workstation to
see
> how it got infected; i.e., make sure users can't install software, etc.
>
> If you still want to work with it without flattening (not recommended), I
> would remove it from the network first. Then run HijackThis and post your
> log at one of the specialty sites listed below (in no particular order and
> not here, please):
>
> http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
> http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 - another
> tutorial
>
> http://www.atribune.org/forums/index.php?showforum=9
> http://aumha.net/viewforum.php?f=30
> http://www.bleepingcomputer.com/forums/forum22.html
> http://castlecops.com/forum67.html
> http://www.dslreports.com/forum/cleanup
> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
>
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
> http://gladiator-antivirus.com/forum/index.php?showforum=170
> http://forums.subratam.org/index.php?showforum=7
> http://spywarewarrior.com/viewforum.php?f=5
> http://forums.techguy.org/54-security/
> http://forums.tomcoyote.org/
>
> Malke
> --
> MS-MVP Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic"



Posted by Leythos on September 24, 2006, 3:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
says...
> Flattening isn't really an option for at least another two months. I work on
> this network remotely and won't be getting down there until November. But
> yeah, I figure I'll flatten it then. No, no imaging being done, just backup
> of data files.
>
> I don't notice any other odd traffic, and this stuff is being blocked. Guess
> I'll run HJT and see what comes up.

Install David's Multi-AV product and run it, it would be best to run it
in safe mode, but it will still do a lot in normal mode.

--

spam999free@rrohio.com
remove 999 in order to email me

Posted by David H. Lipman on September 24, 2006, 3:29 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| I have an XP Pro box on an SBS network (one SBS Premium server w/ ISA 2004,
| two XP Pro clients.) The box was heavily infected by numerous viruses and
| other malware on 9/11. Issues with antivirus installation resulted in its
| not updating for some time, but I'm not certain just how it all got started.
| Far as I can tell, none of it got to any of the other machines on the
| network,
|
| I cleaned up using various AV and anti-spyware tools (AdAware, Spybot,
| Trend-Micro AV) and it seems to be healthy now, but the ISA logs show this
| machine making repeated calls on DNS protocol, port 53, to two different IPs
| that belong to a web hosting company in the Ukraine. I can't help but think
| that this is malware in action, but can't determine what is doing it. The
| ISA firewall is blocking the requests, but I'd like to know what's going on.
| Any ideas on how to trace this? I can't find anything in running processes
| that isn't supposed to be there. Note that these calls are being made even
| when nobody is logged on to the machine. They're averaging one per second.
|

DNSChanger Trojan ?


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm




The site map in XML format XML site map

Contact Us | Privacy Policy