Educause Security Discussion mailing list archives
Re: bestfriends.scr AIM virus
From: RLVaughn <Randy_Vaughn () BAYLOR EDU>
Date: Sat, 22 Jan 2005 16:49:19 -0600
Apologies for top posting: --------- I've asked Gadi Evron to look into this. He strongly suspects Albany.NYC.Greenpeace.org and it's currently associated IP of 81.91.66.220 to be a Command and Control for a bot drone army. A rDNS search on the above IP yields ns1.mondomix-planet.com as the PTR record. Gadi supplies the following snort signatures and report of his detective work: Snort: alert tcp any any -> any any (msg:"suspected botnet/educause by Gadi Evron"; content: "Albany.NYC.Greenpeace.org";) alert tcp $HOME_NET any -> 81.91.66.220 6667 (msg:"suspected botnet/educause by Gadi Evron";) IRC C&C session: [19:04:28] *** Connecting to 81.91.66.220 (6667) - Welcome to the NYCNet IRC Network |eS|00267! <snip by rlv> Your host is Albany.NYC.Greenpeace.org, running version Unreal3.2.2 This server was created Mon Jan 10 2005 at 22:26:53 CET Albany.NYC.Greenpeace.org Unreal3.2.2 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeKVfMGCuzNT SAFELIST HCN MAXCHANNELS=10 CHANLIMIT=#:10 MAXLIST=b:60,e:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307 KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS WATCH=128 are supported by this server SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(ohv)@%+ CHANMODES=beqa,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=NYCNet CASEMAPPING=ascii EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=@%+ EXCEPTS CMDS=KNOCK,MAP,DCCALLOW,USERIP are supported by this server - There are 1 users and 580 invisible on 1 servers - Local host: <snip> - 1 operator(s) online 67 unknown connection(s) 3 channels formed I have 581 clients and 0 servers - Current Local Users: 581 Max: 1014 Current Global Users: 581 Max: 1014 - MOTD File is missing - [19:04:30] *** |eS|00267 sets mode: +iB - *** No one in your notify list is on IRC Regards, Randal Vaughn Professor Baylor University Saturday, January 22, 2005, 12:44:42 AM, Brandie wrote: ---------
We have Tipping Point and at about 10:00 last night multiple machines began doing user enumeration. By today they were hitting ports 135 and 139 with login attempts, rpc scans, etc. We looked at 3 of the infected machines and found: 1) all Windows 2000 2) all had an entry under HKLM/software/microsoft/windows/currentversion/run and /runservices and the User tab of these two paths - titled WindowsSP2.exe 3) the %sysdir%/system32/ had a file named msgfix.exe
Once we had this information we found Sophos had it named sdbot.QT and seems to be the only AV vendor with a signature for it.
On further Tipping Point inspection we found all the infected machines and more to have received an IRC registration response from one IP address which we have since blocked at the border.
Thought I would send this info along in case it is relavent and helps anyone.
Brandie Anderson, CISSP, MCSE, CNA Information Security Officer Texas Tech University
________________________________
From: The EDUCAUSE Security Discussion Group Listserv on behalf of Jason Richardson Sent: Fri 1/21/2005 5:44 PM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: Re: [SECURITY] bestfriends.scr AIM virus
Just blocked about 20 machines doing the same thing on our Res Net - all port 139.
--- Jason Richardson Manager, IT Security and Client Development Enterprise Systems Support Northern Illinois University Voice: 815-753-1678 Fax: 815-753-2555 jasrich () niu edu
brooksje () LONGWOOD EDU 1/21/2005 12:40:16 PM >>>Correction: it was port 139. Started at 11:00 AM Eastern today.
-----Original Message----- From: The EDUCAUSE Security Discussion Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Jason Brooks Sent: Friday, January 21, 2005 1:19 PM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: Re: [SECURITY] bestfriends.scr AIM virus
Do you know if this one has any other characteristics to watch for? We caught a dramatic increase in port 135 scans originating from the RESNET this morning. Before today, all was quiet, so I'm wondering if there might be a connection.
Thanks, Jason Brooks
Jason Brooks Information Security Technician Longwood University 201 High Street Farmville, VA 23909 (434) 395-2034 mailto:brooksje () longwood edu
-----Original Message----- From: The EDUCAUSE Security Discussion Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Mark Wilson Sent: Friday, January 21, 2005 11:22 AM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: [SECURITY] bestfriends.scr AIM virus
Be on the lookout for this one as we are seeing a lot of this. There is a snort rule for it.
If you notice traffic going to 81.91.66.220, you probably have infected hosts.
There are several strains going around as we have had to update McAfee 3 times.
More info can be found at http://www.jayloden.com/BestFriends.htm
Mark Wilson GCIA, CISSP #53153 Network Security Specialist Auburn University (334) 844-9347
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
********** Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at http://www.educause.edu/groups/.
Current thread:
- bestfriends.scr AIM virus Mark Wilson (Jan 21)
- <Possible follow-ups>
- Re: bestfriends.scr AIM virus Jason Brooks (Jan 21)
- Re: bestfriends.scr AIM virus Jason Brooks (Jan 21)
- Re: bestfriends.scr AIM virus Mark Wilson (Jan 21)
- Re: bestfriends.scr AIM virus Mark Wilson (Jan 21)
- Re: bestfriends.scr AIM virus Jason Richardson (Jan 21)
- Re: bestfriends.scr AIM virus Anderson, Brandie (Jan 21)
- Re: bestfriends.scr AIM virus Brock, Adam (Jan 22)
- Re: bestfriends.scr AIM virus RLVaughn (Jan 22)
- Re: bestfriends.scr AIM virus H. Morrow Long (Jan 22)
- Re: bestfriends.scr AIM virus Peter Moody (Jan 22)
- Re: bestfriends.scr AIM virus Cam Beasley, ISO (Jan 23)
- Re: bestfriends.scr AIM virus Cam Beasley, ISO (Jan 23)
- Re: bestfriends.scr AIM virus Jeff Kell (Jan 23)
- Re: bestfriends.scr AIM virus Jason Brooks (Jan 24)
- Re: bestfriends.scr AIM virus Jason Richardson (Jan 24)
- Re: bestfriends.scr AIM virus Mark Wilson (Jan 24)
- Re: bestfriends.scr AIM virus Jason Richardson (Jan 25)