RE: Hacked (...still cleaning)

From: Horn Michael (Michael.Horn_at_morganplc.com)
Date: 04/19/05

  • Next message: Beauford, Jason: "RE: Hacked (...still cleaning)" 
    To: "'mfernandez@fdta-valles.org'" <mfernandez@fdta-valles.org>, security-basics@securityfocus.com
Date: Tue, 19 Apr 2005 16:21:01 -0400

    Check your registry. I found it in there pointing to the I386 folder.

    Don't forget to back it up before you make any changes to the registry.

    Michael
    Network Administrator

            -----Original Message-----
            From: Mauricio Fernandez [SMTP:mfernandez@fdta-valles.org]
            Sent: Monday, April 18, 2005 4:34 PM
            To: security-basics@securityfocus.com
            Subject: RE: Hacked (...still cleaning)

            One thing I am trying to do is to hide the cmd.exe file to avoid the
            possibility of running some programs. I searched the file on the
    hole
            system and deleted from \system32\ and \I386\ folders, copied into a
            folder no included on the system path with a different name. But if
    I
            invoke cmd.exe, it appears again on \system32\

            Does anyone knows how to remove it?

            Mauricio Fernández S.
            IT Manager
            Tel. 591- 445-25160
            Fax. 591- 441-15056
            mfernandez@fdta-valles.org
            www.fdta-valles.org
            Cochabamba - Bolivia

            -----Original Message-----
            From: Louie [mailto:tech.louie@verizon.net]
            Sent: Sunday, April 17, 2005 1:38 PM
            To: 'Paul Marsh'; security-basics@securityfocus.com
            Subject: RE: Hacked

            Other thing also do you have a router or some kind of switch? If you
            have a router you should be albe to see from your logs which ip
    address
            is hitting those port he is trying to connect.

            -----Original Message-----
            From: Paul Marsh [mailto:pmarsh@nmefdn.org]
            Sent: Friday, April 15, 2005 8:02 AM
            To: security-basics@securityfocus.com
            Subject: RE: Hacked

            Once the system is clean, if you can ever get it to that point
    without
            flatting it. Makes sure you monitor outbound connection, don't want
            this thing to call home to mommy and put you right back at square
    one
            again.

            -----Original Message-----
            From: Etapien [mailto:etapien@gmail.com]
            Sent: Friday, April 15, 2005 10:16 AM
            To: mfernandez@fdta-valles.org
            Cc: security-basics@securityfocus.com
            Subject: Re: Hacked

            Well, he actually installed a remote administration tool (radmin)
    to
            have control over the system whenever he wants. check those 2 batch
            files, he used that for installing it as a service probably, open it
            with a text editor (notepad) and check what the commands are, then
    you
            will see what to stop. it's probably some service he installed to
    make
            sure it keeps on running, if you can do this with the machine
    offline if
            would be the best because when it's connected to the internet those
            processes are eating up all of the cpu usage and bandwidth. after
    you
            have found and deleted whatever process that shouldn't be there then
    I
            would suggest you install some firewall to avoid open ports from
    being
            accessed by anyone who scans your ip and tries to break in.

            On 4/14/05, Mauricio Fernandez <mfernandez@fdta-valles.org> wrote:
    > This morning I found a wwwhack window opened on one of my w2k
    servers,
    > antivirus agent was deleted (TrendMicro) and when I reinstall it
    back,

    > it found about 4500 viruses named PE_PARITE.B
    >
    > Now the virus is still regenerating itself creating files on
    > winnt\temp folder, I saw the task list and stopped all the
    suspicious
    > process, but the virus still goes on...
    >
    > The virus/hacker created a folder named RADMIN, where he copied
    these
    > files:
    > r_server.exe
    > admdll.dll
    > hide.reg
    > raddrv.dll
    > pro.bat
    > start.bat
    >
    > Does anyone knows how to remove this virus and avoid this hack
    > vulnerability?
    >
    > Mauricio Fernández S.
    > IT Manager
    > Tel. 591- 445-25160
    > Fax. 591- 441-15056
    > mfernandez@fdta-valles.org
    > www.fdta-valles.org
    > Cochabamba - Bolivia
    >
    >
    >

            --

            __________
            Etapien

            
    ------------------------------------------------------------------------
            ---

            Earn your MS in Information Security ONLINE Organizations worldwide
    are
            in need of highly qualified information security professionals.
    Norwich
            University is fulfilling this demand with its MS in Information
    Security
            offered online. Recognized by the NSA as an academically excellent
            program, NU offers you the opportunity to earn your degree without
            disrupting your home or work life.

            http://www.msia.norwich.edu/secfocus_en
            
    ------------------------------------------------------------------------
            ----

            
    ------------------------------------------------------------------------
            ---
            Earn your MS in Information Security ONLINE
            Organizations worldwide are in need of highly qualified information
            security
            professionals. Norwich University is fulfilling this demand with
    its MS
            in
            Information Security offered online. Recognized by the NSA as an
            academically excellent program, NU offers you the opportunity to
    earn
            your
            degree without disrupting your home or work life.

            http://www.msia.norwich.edu/secfocus_en
            
    ------------------------------------------------------------------------
            ----

    ______________________________________________________________________
    This email has been scanned by the MessageLabs Email Security System.
    For more information please visit http://www.messagelabs.com/email
    ______________________________________________________________________

  • Next message: Beauford, Jason: "RE: Hacked (...still cleaning)"