Re: DNS calls to Ukraine destinations

the ISA logs show this machine making repeated calls on DNS protocol, port 53, to two different IPs that belong to a web hosting company in the Ukraine. I can't help but think that this is malware in action, but can't determine what is doing it.

Gary,

As long as you can keep the malware blocked, post the log to the HijackThis Forum at AumHa:
http://aumha.net/viewforum.php?f=30

We'll call in the "Experts" if need be and at least identify the malware, the risk from it, and who's hosting it.

I'll BCC this. Email me when you post the HJT log and please, provide us with the IPs, too.


MowGreen [MVP 2003-2006]
===============
*-343-* FDNY
Never Forgotten
===============


Gary S. Terhune wrote:
I have an XP Pro box on an SBS network (one SBS Premium server w/ ISA 2004,
two XP Pro clients.) The box was heavily infected by numerous viruses and
other malware on 9/11. Issues with antivirus installation resulted in its
not updating for some time, but I'm not certain just how it all got started.
Far as I can tell, none of it got to any of the other machines on the
network,

I cleaned up using various AV and anti-spyware tools (AdAware, Spybot,
Trend-Micro AV) and it seems to be healthy now, but the ISA logs show this
machine making repeated calls on DNS protocol, port 53, to two different IPs
that belong to a web hosting company in the Ukraine. I can't help but think
that this is malware in action, but can't determine what is doing it. The
ISA firewall is blocking the requests, but I'd like to know what's going on.
Any ideas on how to trace this? I can't find anything in running processes
that isn't supposed to be there. Note that these calls are being made even
when nobody is logged on to the machine. They're averaging one per second.

.

Relevant Pages

  • Re: DNS calls to Ukraine destinations
    ... to two different IPs that belong to a web hosting company in the Ukraine. ... I can't help but think that this is malware in action, but can't determine what is doing it. ...
    (microsoft.public.security.virus)
  • Re: DNS calls to Ukraine destinations
    ... protocol, port 53, to two different IPs that belong to a web hosting company in the Ukraine. ... I can't help but think that this is malware in action, but can't determine what is doing it. ... Email me when you post the HJT log and please, provide us with the IPs, too. ... if you do not want to post here then you know my email and please email me where you posted the Hijack This log and thanks in advance because I appreciate all you do for these newsgroups. ...
    (microsoft.public.security.virus)
  • Re: DNS calls to Ukraine destinations
    ... It's a 017 item in HJT, Steve, (actually, three or four nearly identical ... to two different IPs that belong to a web hosting company in ... I can't help but think that this is malware in action, ... is in the HiJack This log. ...
    (microsoft.public.security.virus)
  • Re: DNS calls to Ukraine destinations
    ... protocol, port 53, to two different IPs that belong to a web hosting company in the Ukraine. ... I can't help but think that this is malware in action, but can't determine what is doing it. ... Trend-Micro AV) and it seems to be healthy now, but the ISA logs show this ... if you do not want to post here then you know my email and please email me where you posted the Hijack This log and thanks in advance because I appreciate all you do for these newsgroups. ...
    (microsoft.public.security.virus)