Re: Help, possible rootkit

From: Harlan Carvey (keydet89_at_yahoo.com)
Date: 10/24/04

  • Next message: Arias Hung: "Re: Help, possible rootkit" 
    Date: Sun, 24 Oct 2004 14:21:15 -0700 (PDT)
To: Incidents <incidents@securityfocus.com>

    Sounds more like a process or driver problem than
    anything else.

    In a nutshell, you really haven't presented any
    information showing that you *do* have a rootkit.
    Outside of pure speculation, you do not have anything
    that shows that you have a rootkit.

    Did you find an open port via nmap that does not show
    up on netstat or openports?

    Did you find some traffic on your network coming from
    a port that doesn't show up in the netstat output?

    Did you run pslist against the system (or a WMI-based
    program or script) that turned up processes running
    that don't show up when you run the tools locally?

    Did you find Registry entries (in the ubiquitous Run
    key) that show up when the system is booted to Safe
    Mode, but not when it's booted normally?

    Harlan

    --- BillyBob <billybobknob@hotmail.com> wrote:

    > I have noticed that my XP system is behaving like I
    > have a rootkit.
    >
    > - My mouse is jumpy (it freezes for a second when I
    > move it around the
    > desktop) and the minimized Taskmanager in the
    > systray shows I have around
    > 25 - 30 % usage, but when I open it, there is no
    > process listed using this
    > much.
    > - I did a netstat, fport, openports and none of
    > these show that I have any
    > odd ports open or any connections established.
    > - even when I disconnect from the Internet these
    > symptoms do not stop. They
    > stop if I reboot, but then start again.
    >
    > I have ran VICE, Klister, PatchFinder and RkDetect
    > from rootkit.com and they
    > could not find anything.
    >
    > Any more suggestions ?
    > Any more rootkit finding tools for Windows ?
    >
    > Thanks
    > Bill
    >
    >
    >

    =====
    ------------------------------------------
    Harlan Carvey, CISSP
    "Windows Forensics and Incident Recovery"
    http://www.windows-ir.com
    http://groups.yahoo.com/group/windowsir/

    "Meddle not in the affairs of dragons, for
    you are crunchy, and good with ketchup."

    "The simplicity of this game amuses me.
    Bring me your finest meats and cheeses."
    ------------------------------------------

  • Next message: Arias Hung: "Re: Help, possible rootkit"

    Relevant Pages

    • Re: [fw-wiz] FW: OT? New compromise.
      ... If you suspect you have a rootkit, it shouldn't be that hard to find it, ... depending on whether you can shut down any of these boxes and run Knoppix ... Port 1863 is the port for Microsoft's Instant Messenger client ...
      (Firewall-Wizards)
    • RE: root_drv.sys rootkit
      ... you should also run a port scan against this machine ... Subject: root_drv.sys rootkit ... I have a Windows 2003 Web Edition Server that has been compromised due ... The question is that now this server have a rootkit installed. ...
      (Focus-Microsoft)
    • Re: [Full-Disclosure] Removing ShKit Root Kit
      ... >"Searching for ShKit rootkit default files and dirs... ... ethernet port and run netstat -tupan on the server. ... server level security. ...
      (Full-Disclosure)
    • LKM Trojan: How could it have been installed?
      ... if you know port typical port configuration) ... Is it likely or possible that the intruder came in through ports 80 0r ... descriptions of how an intruder can rootkit on port 80. ... ways to secure port 80 whilst leaving it open. ...
      (comp.os.linux.security)
    • Re: [fw-wiz] OT? New compromise.
      ... to correlate them back to an application (unless you do some CPU ... Just because nothing shows up in netstat doesn't mean that there isn't ... a rootkit is one possible explanation. ...
      (Firewall-Wizards)