Re: Compromised Windows Server

[df () odette es]

Hi all,

I have had the same problem with the :

Mwvsta.exe found in c:\windows\system32

and

Ponoas.exe c:\windows\system32

although

rundll16.exe c:\windows\system23 was not present in my PC, obviously rundll32.exe is there anyway (it may serve the 
same purpose, probably).

I observed the Mwvsta.exe running through my "task manager" and it was constantly acting, even after a new reboot it 
was launched again. I spotted the file name in the registry in : 

HKCU/Software/Microsoft/Windows/CurrentVersion/Run

Which is obviously launched at boot time.

I succeded to kill it by blocking the access of Mwvsta.exe with a firewall tool (in fact: McAffee) and then deleting 
the registry key and rebooting afterwards.

After I erased that key from the registry the previous constant outgoing FTP flow, through port 139 (as you mentioned), 
to lots of different IPs was finished (in my opinion it may be a "spamming" program or something similar). Before that, 
I also received a constant flow of information and that is all I observed before starting my attack against it.

As additional information I attach this proof of evidence which I have obtained after deleting that Mwvsta.exe.

It seems it is still trying to continue with its activitu althoug it cannot enter now.

Firewall Log Table (copied form my Linksys router)... just a small part of it, it was going mad constantly...
 
NO. Time Packet Information Reason Action 
001  Jun 0806 21:01:23  From:205.177.79.126:1901 To: my IP TCP default permit <2,00>  block  
003  Jun 0806 21:01:26  From:205.177.79.126:1901 To: my IP TCP  default permit <2,00>  block  
005  Jun 0806 21:01:28  From:81.177.37.67:51502 To: my IP TCP    default permit <2,00>  block  
007  Jun 0806 21:01:32  From:205.177.79.126:1901 To: my IP TCP    default permit <2,00>  block  
008  Jun 0806 21:01:37  From:81.177.37.68:49969 To: my IP TCP    default permit <2,00>  block  
009  Jun 0806 21:01:41  From:67.159.22.107:4878 To: my IP TCP    default permit <2,00>  block  
010  Jun 0806 21:01:46  From:81.177.37.68:49969 To: my IP TCP    default permit <2,00>  block  
011  Jun 0806 21:01:48  From:81.177.37.67:53683 To: my IP TCP    default permit <2,00>  block  
012  Jun 0806 21:01:50  From:67.159.22.107:4878 To: my IP TCP    default permit <2,00>  block  
013  Jun 0806 21:01:51  From:81.177.37.67:53683 To: my IP TCP    default permit <2,00>  block  
014  Jun 0806 21:01:51  From:66.185.126.84:4115 To: my IP TCP    default permit <2,00>  block  

...end of my story...

...hope it helps finding that PHANTOM ATTACK.

If I get it again I will be more cautious and study it carefully before deleting it.

Kind regards to all for your hints.

David

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29. August 3 in Las Vegas. 
World renowned security experts reveal tomorrow.s threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------