Jump to content
Sadikhov IT Certification forums
Sign in to follow this  
gtrasi

Trojans Detected!

Recommended Posts

I hav a drive in whch some Backdoor trojans hav been detected by AVG.

 

Thers also one folder named "Recycler" in every partition whch looks odd and is only visible if I click "Show hidden files" and "unhide system files".

 

Is ther still a problem or Iam only imagining things?

Share this post


Link to post
Share on other sites
Thers also one folder named "Recycler" in every partition whch looks odd and is only visible if I click "Show hidden files" and "unhide system files".

Nothing abnormal in this i guess.

Share this post


Link to post
Share on other sites

As harch said, nothing abnormal about the recycler folder.

Just make sure you remove all traces of those trojans ASAP.....

kippy

Share this post


Link to post
Share on other sites

minh0333 why should he do that? is not recycler a system folder unless of course you know different ?

explanation if you please

 

iTGeeZer :blink:

Share this post


Link to post
Share on other sites

friends!

for more informations :

 

When Backdoor.Ptakks.B runs, it performs the following actions:

 

It displays the message

 

Header file corrupt, if you downloaded this file from internet, try to download again.

 

It copies itself as %system%\Winxpsh.exe.

 

NOTE: %system% is a variable. The Trojan locates the System folder and copies itself to that location. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

 

Next, it creates the value

 

WinXpsh VXP skinheads WinXPsh.exe

 

in the registry key

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

so that the Trojan runs when you start or restart Windows.

 

If the operating system is Windows 95/98/Me, the Trojan registers itself as a service process to continue to run after you log off. In this case, Backdoor.Ptakks.B closes only when you shut down the system.

 

The Trojan installs hook procedures into a hook chain to monitor the system for keyboard and mouse messages. The hook procedures process the messages and pass the hook information to the next hook procedure in the current hook chain. This permits Backdoor.Ptakks.B to intercept keystrokes.

 

The Trojan notifies the client side using ICQ pager or email. The commands allow the hacker to perform any of the following actions:

 

* Deliver system and network information to the hacker, including login names and cached network passwords

* Print text, play media files, and open or close the CD-ROM drive

* Hide icons, the system tray, buttons, and the taskbar

* Switch the monitor off and on

* Intercept confidential information by hooking keystrokes and intercepting information that appears on the screen, and delivering it to the hacker

 

you should :

 

* Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.

* If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.

* Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.

* Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.

* Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.

* Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.

* Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

 

then :

NOTE: These instructions are for all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

 

1. Update the virus definitions.

2. Do one of the following:

* Windows 95/98/Me: Restart the computer in Safe mode.

* Windows NT/2000/XP: Stop the WinXpshTrojan process that is running.

3. Run a full system scan, and delete all files that are detected as Backdoor.Ptakks.B.

4. Remove the WinXpsh VXP skinheads value from the registry \Run key.

 

For details on how to do this, read the following instructions.

 

To restart in Safe mode or stop the process:

Windows 95/98/Me

Restart the computer in Safe mode. All Windows 32-bit operating systems, except for Windows NT, can be restarted in Safe mode. For instructions on how to do this, read the document How to start the computer in Safe Mode.

 

Windows NT/2000/XP

To stop the Trojan process:

 

1. Press Ctrl+Alt+Delete one time.

2. Click Task Manager.

3. Click the Processes tab.

4. Double-click the Image Name column header to sort the processes alphabetically.

5. Scroll through the list, and look for WinXpsh.

6. If you find the file, click it, and then click End Process.

7. Close the Task Manager.

 

To reverse the changes that the Trojan made to the registry:

 

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to make a backup of the Windows registry for instructions.

 

1. Click Start, and click Run. The Run dialog box appears.

2. Type regedit and then click OK. The Registry Editor opens.

3. Navigate to the key

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

4. In the right pane, delete the value

 

WinXpsh VXP skinheads WinXPsh.exe

5. Exit the Registry Editor.

 

============

 

 

Write-up by: Serghei Sevcenco

 

Regards

M

Share this post


Link to post
Share on other sites
Thanks great advice but why should he delete the Recycler folder that he has found on every drive partition?

 

iTGeeZer :blink:

ItGeeZer !

 

maybe in that folder contains Virus

 

Regards

M

Share this post


Link to post
Share on other sites
maybe in that folder contains Virus

do u know about recycler folder .

and why should u delete recycler folder :blink:

 

The Recycler folder is used only on NTFS partitions. The Recycler folder contains a Recycle Bin for each user that logs on to the computer, sorted by their security identifier (SID).

 

:blink:

Share this post


Link to post
Share on other sites

dnt delete the recyler its nt a trojen it is seen in every partition as hidden files

Share this post


Link to post
Share on other sites

Ok if I format an NTFS partition does it then hav any system folders such as System Volume Information and Recycler?

 

Also OS doesnt allow me to delete Recycler folder...although if i cut/paste in to the desktop then i can delete it! But the nxt time i bootup its ther in the drive(partition)!

 

I hav a doubt that this system folder is infected. Actually I reinstalled XP on this drives bootable parttion with data in other partition. After installing XP when i clicked on the other parttion to browse it it didnt allow me to do that saying u dont hav the permissions...in the security option ther were uknown users "1002-AS54..." lik these random numbers...

 

I thnk i will hav to format the entire drive...its good that i hav a backup.

Share this post


Link to post
Share on other sites

If your infected drive has both recycler and recycled folders, then it's trojan from RBOT family. In that case I'd recommend you a clean install.

Share this post


Link to post
Share on other sites
I hav a doubt that this system folder is infected. Actually I reinstalled XP on this drives bootable parttion with data in other partition. After installing XP when i clicked on the other parttion to browse it it didnt allow me to do that saying u dont hav the permissions...in the security option ther were uknown users "1002-AS54..." lik these random numbers...

 

 

gtrasi

 

you need not format the entire drive inorder to get access to the folders that does not allow. You can access all the folders that prevent you from opening eventhough it has unknown users SID ("1002-AS54..." lik these random number = SID with which the folder was accessed in NTFS from a different OS Before installing XP) by taking ownership of these folders

 

Inorder to access the files Right Click on the parent folder and go to properties. Go to the security tab click on "Advanced" button After clicking on "Advanced" you have a tab called "Owner" which displays the current owners available in the Windows Xp system you have logged in. Select the user account which has administrator rights in windows xp in "Change Owner to" list displayed. Now click on check box "Replace owner on subcontainers and objects" and finally "OK" button. You would see a brief process saying that permissions being applied happening after that you should access the files ... if it still does not work you need to select your name in the security tab and check "Full Control" for your username

 

Whenever you have trojans problem and you are not sure which process is causing the infection try to get this small program called "Process Explorer v9.02" from

. This procexp gives detail description of every process running in your system including the location of a particular file on your hard disk. I had so many trojans in my PC with the process name "svchost.exe, lsass.exe .." Good luck cleaning your pc from trojans ...

 

SAL

Edited by sal

Share this post


Link to post
Share on other sites
If your infected drive has both recycler and recycled folders, then it's trojan from RBOT family. In that case I'd recommend you a clean install.

 

Yes I hav 5 trojans detected by AVG and all ar backdoor.sdbot.55.U infecting files such as /system32/winole.exe and system32.tftp1540.

 

And I hav done wht Sal has said.

Share this post


Link to post
Share on other sites

hi gtrasi

 

first things first, pleae don't delete the recycler it is like harsh puri rightly said..

The Recycler folder is used only on NTFS partitions. The Recycler folder contains a Recycle Bin for each user that logs on to the computer, sorted by their security identifier (SID).
.

 

and you don't necessarily have to do a clean install!!! that is d last option.

 

torjans are basically backdoor programs that run on ur systems, to take it over and usually connect remotely and download other malicious program components... so u need to delete not just the downloaded files but the initiating program. it usually runs as a process automatically when you start windows. you need a program to view ur running processes showing the folder/file path form which they are running. i usually use spybot search and destroy(h**P://security.kolla.de). the trojan programs usually have the same name as "normal" windows system programs (svchost.exe, lsass.exe et al), but viewing the source folder will give you hints as to it's "authenticity". like sal rightly said. so you first have to stop these processes, and then delete the files.

 

usually when the trojans are running there is usually very high network traffic

(mostly upload), if u have a bandwidth monitoring tool (h**p://www.bandwidthmonitorpro.com) u will notice that when u stop the trojan program there is a very noticeable drop in bandwidth

 

another thing is i don't really know about d efficacy of AVG, i use symantec antivirus. or better still get the symantec norton internet security 2005 package. u need to be careful what kinds of file u download and what sites u visit cos many of them download trojans onto ur system too.. i see it a lot.

 

i hope this helps..

 

if u r not clear on what i said or need further help let me know.. u can post a reaply or PM me :)

Share this post


Link to post
Share on other sites
If your infected drive has both recycler and recycled folders, then it's trojan from RBOT family. In that case I'd recommend you a clean install.

 

Yes I hav 5 trojans detected by AVG and all ar backdoor.sdbot.55.U infecting files such as /system32/winole.exe and system32.tftp1540.

 

And I hav done wht Sal has said.

One more thing regarding that tftp infection, after the anti-virus deletes this infected file, the trojan launches a different tftpXXXX.exe file, where XXXX is a random 4 digit number. It will be a good idea to block ports used for IRC communication via your firewall as this trojan can launch weak dictionary attacks to crack your admin password. It then uses IRC to send this info to hackers. So if you are getting a warning about tftpXXXX.exe file again and again, it would be better to reformat.

Share this post


Link to post
Share on other sites

Can anyone give me a serial key for Spy Sweeper and Zone Alarm security suite plz?

 

The one given by Sal isnt valid now.

Share this post


Link to post
Share on other sites

Well after trojan trauma ther ar still som probs Iam facing.

 

XP is taking abnormally long time to bootup from the Winxp logo(in black background) to the welcome screen. Befor the welcome screen is displayed this message "Windows is strting up" comes up for atleast 20 secs. One peculiar thng is that screen is still during this time(thers no animation) although the computer doesnt freezeup.

 

This sluggishness happens only during bootup not while shutting down.

And I thnk it started after i mad som changes to Services although i hav done that plenty of times on other machines w/o any adverse effects.

 

Dunno whts wrong? :(

Share this post


Link to post
Share on other sites
Well after trojan trauma ther ar still som probs Iam facing.

 

XP is taking abnormally long time to bootup from the Winxp logo(in black background) to the welcome screen. Befor the welcome screen is displayed this message "Windows is strting up" comes up for atleast 20 secs. One peculiar thng is that screen is still during this time(thers no animation) although the computer doesnt freezeup.

 

This sluggishness happens only during bootup not while shutting down.

And I thnk it started after i mad som changes to Services although i hav done that plenty of times on other machines w/o any adverse effects.

 

Dunno whts wrong? :(

Install regcleaner and see if there are any unknown services in startup section. If so, remove them.

Share this post


Link to post
Share on other sites

I hav cleaned my system using registry cleaners such as Tuneup Utilites 2004 and Registry Mechanic.

 

While in Tuneup Utilities' Process Manager I saw 4 instances of svchost.exe.

Is that normal?

Ther were no other suspicious files that run during bootup.

 

And one more thing I notices is that Norton AV is giving me an error such as "Error 1606" while installing it in D: partition. Also I tried booting from NAV ...here it says "Invalid media type C:"...and fails to scan. :(

 

And finally I get this "Windows is starting up" even in safe mode!

Iam sick of XP...probably will switch to Linux :blush:

Share this post


Link to post
Share on other sites

hi

 

once u broken xp kinda hard to fix up to "normal" state again, depending on d level of damage and ur expertise, i suggest u back up your data and do a fresh install. don't know if u have partitions separate for your programs, documents and other data, i do. and as such it enables re-installation of xp partition, without affecting ur data. u just have to re-install apps.

Share this post


Link to post
Share on other sites
the recycler folder should not be deleted it is there in every partition as an hidden file.

This issue has been resolved many post back.

 

as ooati has said its kind tough to repair a window system,

and as u hav said tht u hav a backup so if nothing turn good for U shortly then do consider fresh Install :D

Share this post


Link to post
Share on other sites

Can any1 shed som light on why Iam getting errors lik "Error 1606: Diskeeper service failed to start. pLz check if u hav privilages"

 

This happnd while installing Diskeepr s/w. Even when I hav all rights as admin Iam not able to strt som services and install s/w in another partition "D:\ProgramFiles"

 

I hav never encountered these errors be4!

Share this post


Link to post
Share on other sites
Can any1 shed som light on why Iam getting errors lik "Error 1606: Diskeeper service failed to start. pLz check if u hav privilages"

 

This happnd while installing Diskeepr s/w. Even when I hav all rights as admin Iam not able to strt som services and install s/w in another partition "D:\ProgramFiles"

 

I hav never encountered these errors be4!

You may have got rooted! Time for clean install.

Share this post


Link to post
Share on other sites

As a number of people have mentioned-at this stage back up all your important data-and doo a clean install. This time ensure to patch the system up to date before getting on the net.

Kippy.

Share this post


Link to post
Share on other sites

Hi gtrasi,

You no need to worry about this. Because all drives has its own recycle bin by default. This is not related with Virus.

 

With regards

RIYAS

MCSE CCNA

 

:lol:

Share this post


Link to post
Share on other sites
Hi gtrasi,

You no need to worry about this. Because all drives has its own recycle bin by default. This is not related with Virus.

 

With regards

RIYAS

MCSE CCNA

 

:lol:

i think that issue has been resolved already... please read previous posts thread b4 posting replies

<_<

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×