Re: strange windows behaviour.

From: Jeff Kell (jeff-kell_at_utc.edu)
Date: 10/10/03

  • Next message: Jeff Bollinger: "Re: Spamming, 'hidden' mail server" 
    Date: Thu, 09 Oct 2003 19:13:09 -0400
To: J Mike Rollins <rollins@wfu.edu>

    J Mike Rollins wrote:
    > I have just tested the ideas expressed here and have to report that
    > streams can still be a threat.
    >
    > When I try to make a copy of the dll stored within the stream, the virus
    > scanning software does find it.
    >
    > However, when I run the contents of the dll stream by using rundll32 the
    > program is not caught by the virus scanning software. And the trojan
    > continues to execute undetected.

    All I see is spam starting to spew from an otherwise quiet machine (most
    cases) although we have also had two cases of machines spoofing source
    addresses and attacking (a) an IRC server and (b) somebody's identd.

    This is happening here and I have one machine under quarantine in the
    testbed. Symantec NAV latest DATs doesn't detect anything. Spybot
    latest signatures doesn't detect anything. Ad-Aware doesn't find
    anything. McAfee's freebie Stinger doesn't find anything. Yet if it is
    connected to the network when it boots, some process comes up, makes a
    few connection attempts to remote addresses, port 80; then it opens up
    two random high-numbered TCP ports and listens. Telnetting to them and
    entering much of anything causes it to close the connection and respawn.

    In ActivePorts it lists the owning process name as the same as some
    other existant process in the list (e.g., explorer.exe, svchost.exe) but
    will have a unique PID in the task list. Using ActivePort's terminate
    process feature on it causes the two sockets to disappear, only to be
    immediately followed by the original behavior -- connects to an outside
    address port 80 (not always the same address, mind you), followed by two
    different high-numbered ports opened and listening.

    There is a strange registry key in /HKEY/LOCAL.../Run and .../RunOnce
    which appears to be a random string, 'bzyrczu' or something similar, and
    the key value is 'rundll32 C:\Windows\System32:bzyrczu.dll'. Of course
    I can't find any file by that name by traditional means (before reading
    this thread on NTFS streams).

    Attempting to delete the registry keys for /Run and /RunOnce appear to
    work, but when you go back to check, the keys have "reinstalled"
    themselves. Even starting up in safe mode with network unplugged, you
    can't delete the registry keys, even with System Restore disabled (this
    is an XP Home Edition box).

    I plan on getting a packet capture of the beast's activity tomorrow.
    And assuming that the thing does exist as a stream, I'll try to capture
    the binary.

    Jeff

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Jeff Bollinger: "Re: Spamming, 'hidden' mail server"

    Relevant Pages

    • Re: WME Error 0xC00D2F0B
      ... but I have a new customer connecting and then ... Unable to establish a connection to the server. ... you are probably running IIS on port 80 on that server. ... You can't view the stream "through" IE, it must be viewed through WMP ...
      (microsoft.public.windowsmedia.server)
    • [Newbie]Problem writing streaming audio using NetworkStream
      ... will generate a list of files and stream them to a port on my computer. ... I'm not sure if this is the correct way to load an mp3 file and stream ... I'm loading the mp3 file into a byte array, ...
      (microsoft.public.dotnet.languages.csharp)
    • RE: Streaming to firewall users.
      ... comes with Windows Server 2003). ... mechanism where it tries RTSP on port 554 and if that fails, ... I've set up a streaming server to stream mp3s to myself and few of my ... > Windows Media streams just fine. ...
      (microsoft.public.windowsmedia.server)
    • Re: strange windows behaviour.
      ... Jeff Kell wrote: ... |> When I try to make a copy of the dll stored within the stream, ... | address port 80, followed by two ... | can't delete the registry keys, even with System Restore disabled (this ...
      (Incidents)
    • Re: Solipsis: Python-powered Metaverse
      ... >>>through the same router, ... to be address *from* that particular port. ... was/is a steady stream of updates to both clients even if they send nothing ... > areas of>the packets it sends, the router usually can't properly rewrite ...
      (comp.lang.python)