Rogue Kernel Driver ierk8243.sys may be novel Trojan

From: Barron Mertens (bmertens@UWO.CA)
Date: 01/26/03

  • Next message: Jay Lagorio: "Re: SPRINT ADSL [Zyxel 645 Series Modem]"
    Date:         Sun, 26 Jan 2003 17:29:38 -0500
    From: Barron Mertens <bmertens@UWO.CA>
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    Approximately around Jan 10 2003 our main database cluster began
    experiencing random unexplained "blue screen of death" crashes. The blue
    screen claimed that the component that had failed was called
    ierk8243.sys and this was the cause on both machines (Win2Ksp3 and
    SQL2000sp2). Inspection of those machines and even google returned no
    matches for that file or anything close (other than someone's email
    address in Iceland I think). I bit the bullet (credit card?) and called
    in Microsoft Premium Support Services after I ran out of ideas and had
    suffered through too many crashes. After a week of analyzing dump files
    we had a breakthrough when someone else showed up with the same problem,
    that person discovered that if you reboot into safe mode and search the
    registry that there is a kernel level (like a hardware device driver)
    driver called ierk8243.sys installed and you can also then find the file
    on the hard drive in the %systemroot%\system32\drivers folder. While the
    driver is running you cannot find it in the registry or on the file
    system or on a list of running processes, booting into safe mode
    prevents the driver from loading. The file's properties read as a
    standard MS file belonging to the original OS install, including the
    timestamp info. To kill the driver just change the startup value to 4
    (disabled) in the registry and rename the file. MS and NAI and
    TrendMicro are analyzing the file to see what it was doing and hopefully
    they can figure out how it got in. The only info to come out of the
    analysis so far is it might have been using port 961 and this MAY be a
    Trojan horse related to "Backdoor/Alley" which is quite obscure. We have
    found this code on four machines altogether, all administered by myself
    and all running SQL Server (not sure who is guilty), two machines were
    Win2k Advanced Server and two were XP Pro.

    Barron Mertens
    Senior System Engineer/Developer
    Faculty of Education
    The University of Western Ontario
    London, Ontario, Canada
    N6G 1G7
    Room 1095
    519-661-2111 x88662
    bmertens@uwo.ca

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by TruSecure Corporation
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    TICSA - Anniversary Special - Limited Time

    Become TICSA certified for just $221.25 US when you register before 3/31/03
    with PROMO "TS0103" at www.2test.com. NO membership fees, certification
    good for 2 years. Price for international delivery just $296.25 US, with
    this offer. Offer cannot be combined with any other special and expires
    3/31/03. Visit www.trusecure.com/ticsa for full details.

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo



    Relevant Pages

    • Re: new sk driver [was: nve timeout (and down) regression?]
      ... kind of strange getting a new release with a known not functional driver ... I am running 2 systems with the sk driver. ... The problem is appearing on SMP machines ... strokes it and it crashes in minutes or imediatly soon the network is up ...
      (freebsd-stable)
    • Re: new sk driver [was: nve timeout (and down) regression?]
      ... The box has 1GB RAM. ... The problem is appearing on SMP machines ... demand strokes it and it crashes in minutes or imediatly soon the network ... I used Pyun's driver and the timeouts went away, ...
      (freebsd-stable)
    • Re: restoring registry
      ... I have the copy of the registry prior to changes, but when I try to load it I get a message stating it was not successful and the pc still crashes when flash drive is plugged in. ... I removed the flash drive from device manager so I cant just go into there and assign a new driver to it either. ... There is, however, a way to do this that works using a program called ERUNT. ...
      (microsoft.public.windowsxp.general)
    • IRC Packets being generated. Dont know where from...
      ... *Registry value not found* ... Autorun entries from Registry: ... Enumerating ICQ Agent Autostart apps: ... RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual ...
      (microsoft.public.security.virus)
    • hijack this startup - can someone tell me the hack i am experienci
      ... *Registry value not found* ... Enumerating ICQ Agent Autostart apps: ... Intel82801 Audio Driver Install Service: ... Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual ...
      (microsoft.public.windowsxp.security_admin)