Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 34 guests and 5 members online
Free Business and Tech Magazines and eBooks
You are here:
Home
Ethical Hacking Discussions and Related Certifications
Malware
Security related issues
EH-Net
May 21, 2013, 09:28:06 PM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Ethical Hacking Discussions and Related Certifications
>
Malware
(Moderator:
don
) >
Security related issues
Pages: [
1
]
Go Down
« previous
next »
Print
Author
Topic: Security related issues (Read 7687 times)
0 Members and 1 Guest are viewing this topic.
Stifler
Newbie
Offline
Posts: 7
Security related issues
«
on:
January 25, 2009, 01:49:33 PM »
I need some help please. I just got this computer up and running and installed winxp home. I made it as far as service pack 2 and I downloaded service pack 3 but before getting a chance to install it and my antivirus, I experienced a virus attack. Now my security center says my auto updates are turned off but when I open the auto update window, it shows it set to download and install updates automatically. The next problem is when I click the link to take me to windows update site, it takes me to google but it still shows windows update in the address bar. And finally, my antivirus says I'm not connected to the internet and therefore cannot update itself, but obviously I am on the net right now. I can go anywhere on the net that I want to except for places having to do with security or updating.
My antivirus found a few viruses using it's default definition files that it came with and successfully removed them and now the computer is acting normal except for these updating issues. 2 of those viruses were both called "Mal_Otorun" if that helps any. They were found on C: and infected the default autorun.inf file, it could not be cleaned and was deleted, it also infected my system restore point files, so now I can't even restore back to anything before the virus happened.
Can anyone help me fix this? I would be very greatful!
Logged
The Stiffmeister
apollo
Full Member
Offline
Posts: 146
Re: Security related issues
«
Reply #1 on:
January 25, 2009, 05:24:16 PM »
In hard to get rid of virus applications, I have found that malware bytes has been pretty effective. You can get it at :
http://www.malwarebytes.org/
. Obviously your milage may vary, and if you have something particularly nasty you are probably going to have to be in safe mode to get rid of it. I'm guessing that your hosts file has probably been modified in c:\windows(or winnt)\system32\drivers\etc .
Logged
CISSP, CSSLP, MCSE+Security, MCTS, CCSP, GPEN, GWAPT, GCWN, NOP, OSCP, Security+
shednik
Jr. Member
Offline
Posts: 75
Re: Security related issues
«
Reply #2 on:
January 25, 2009, 05:57:52 PM »
Honestly I'd just reformat thats the only way to be sure you have removed the virus for good. When going through the reinstall i would have the anti virus on sooner and be cautious of what you download. Do you have any ideas where you got the virus?
Logged
CCNA, MCP, A+, N+
WIP: Masters of Infosec, CEH, & Mastering C
geekyone
Full Member
Offline
Posts: 180
Re: Security related issues
«
Reply #3 on:
January 25, 2009, 06:46:15 PM »
I agree with shednik it's probably not worth your time to try and recover from the virus. Just reinstall and get your anti-virus put on a CD so you can install it before connecting to the Internet.
Logged
CISSP, CEH, GPEN, GCIH, GCFA
adamj
Newbie
Offline
Posts: 17
Re: Security related issues
«
Reply #4 on:
January 25, 2009, 08:31:20 PM »
Maybe this is partly a personal thing, but I think that it's almost always a bad idea to reinstall/format. If it's a production box and you really need its functionality, I'd suggest you do something like restore from images/backups a duplicate system, or swap drives, so you haven't messed with the infected volume. You can then get some resources onto identifying exactly what it was infected with and more importantly how, so you can ensure you won't get infected again. Might also be worthwhile keeping evidence so you can if not pursue legal avenues, have samples of malware which you can send to your AV vendor. I always find it odd that so many large corporates pay lots of $ for AV services, and don't bother sending in samples. It's not helpful bitching about vendors not finding all malware, if you don't make sure they know which malware they don't find.
If you reinstall, there's a very good chance, that the reinstalled machine will get reinfected; note it's possible for malware to survive a reinstall.
Logged
Stifler
Newbie
Offline
Posts: 7
Re: Security related issues
«
Reply #5 on:
January 30, 2009, 03:04:39 AM »
Thanks for the input guys. Unfortunately I wasn't able to fix the problem before it totally fried my motherboard and cpu, so now I'm coming to you from my laptop. Evidently the malware that I had was attached to the system BIOS on the motherboard before I ever installed anything or got on the net. That's what I get for using a motherboard that was used when I got it (christmas gift). I didn't know it was even possible for a virus to infect a motherboard. I'm still not sure I believe it but that's what I was told.
Anyways, one of my buddies at school sent one of his IT friends over to my house to take a look at it for me. He started running a bunch of tests and looked through my system. And when he was done he told me about some trojan dropper containing a logic bomb. He said it had progressed too far to clean it and suggested that I run a program called "copywipe" and do 8 passes, followed by a fresh reformat and reinstall of windows. He also told me that the bomb was activated by using my function keys and by clicking on "restart" to restart the computer. And each time I used one of these functions the malware got worse and worse and spread further into the system. All the while disguising itself as legit system files with real system filenames that antivirus overlooks.
So he asks me what all I have done and where I've been on the net and I told him that I had just got this computer for christmas (late gift) and all I've done is installed windows and SP2 and my antivirus, and I used google image search a couple of times to try to find some cool wallpapers. Other than that I've done nothing except let windows update download SP3 for me, and that's when stuff started happening. He said he didn't see anything wrong with what I've done except that I should have installed my antivirus 1st and foremost just like you guys suggest. I got Trend Micro Internet Security Pro 2009 for like 60 bucks. I could be wrong but I think it requires SP2 before you can install it, otherwise I would've done it 1st because I'm a security freak. Haha I'm running 6 forms of security on this laptop with no conflicts.
Well, we came to the conclusion that I was given an infested motherboard after watching the computer crash and auto restart itself followed by a screen full of weird symbols and a complete shutdown with smoke coming out of my case. That's when he told me about motherboard malware attaching itself to the BIOS.
So now that you've read my book (sorry), any 2nd opinions? I don't know that I believe the motherboard malware thing because I've never heard of anything like that before. But that doesn't mean it's not possible just because I haven't heard of it, I know there's a lot I haven't heard of. Heck, I still don't know much about computer language and I've been using computers since DOS and Quickmenu were all you had before windows 3.1 came out. Haha, 2400 baud modems and gaming BBS's were the most awesome things ever! So I like to think I know a little bit. This is the 1st time I've ever had a bad problem like this, especially one that caused a system crash ending in a ball of smoke. And get this, when I tore the computer apart afterwards, there was a nice big black spot under the cpu both on top and underneath the motherboard where the cpu is. And the cpu itself got so hot that it stuck to the heatsink and nearly all the little pins that are suppose to be attached to it stayed on the board. All I could say was "wow". I'm glad it was just a gift, but then again, I have a feeling that's why it was a gift considering the source.
Ok I'm sorry for the book. Bring on the 2nd opinions, this is a learning experience for me.
Logged
The Stiffmeister
jason
Hero Member
Offline
Posts: 1012
Re: Security related issues
«
Reply #6 on:
February 01, 2009, 09:00:00 PM »
While storing malware in the flash storage for the bios is theoretically possible, it's very unlikely. I'm only aware of one piece of malware that could ever do this, and it didn't do it very well. It sounds to me like you had two separate issues, a bad malware infection and a hardware problem.
Logged
Equix3n-
Sr. Member
Offline
Posts: 386
Re: Security related issues
«
Reply #7 on:
February 04, 2009, 08:57:19 AM »
Reinstall is never a good option.You can go to whatthetech.com and post your problem in the
Hijackthis log and malware removal
section along with a Hijackthis log of the infected computer. They are great bunch of people and will surely help you out with your malware issues.
Logged
shednik
Jr. Member
Offline
Posts: 75
Re: Security related issues
«
Reply #8 on:
February 07, 2009, 08:36:37 PM »
Quote from: Xen on February 04, 2009, 08:57:19 AM
Reinstall is never a good option.You can go to whatthetech.com and post your problem in the
Hijackthis log and malware removal
section along with a Hijackthis log of the infected computer. They are great bunch of people and will surely help you out with your malware issues.
It may not be the most desirable method but with the stage he was at with redoing his system I wouldn't have though twice except on my own curiosity of how to fix it. Doing a secure format and reinstalling won't guarantee it can't somehow come back because his home network may be infected for all he knows...but at the beginning of any install I wouldn't think twice....just for future reference for any I found a nice solution if you boot to your favorite live linux distro and install Clam and run the scan on the partition...
http://njlinux.blogspot.com/2008/01/virus-scan-windows-using-linux-live-cd.html
I may try it out on a vm to see what it picks up in my lab for kicks some time but it's a good way to get a clean scan.
Logged
CCNA, MCP, A+, N+
WIP: Masters of Infosec, CEH, & Mastering C
jason
Hero Member
Offline
Posts: 1012
Re: Security related issues
«
Reply #9 on:
February 07, 2009, 09:50:55 PM »
Presuming that your anti-malware tool can find them anyway. I've dealt with a few machines where the tools couldn't find enough of the bad bits to actually get them off of the box.
Logged
Stifler
Newbie
Offline
Posts: 7
Re: Security related issues
«
Reply #10 on:
February 08, 2009, 02:41:47 AM »
Thanks for the help. Next time I'll have a bit more knowledge if anything like that ever happens again. I do have hijackthis installed on this machine but I've never had any problems with this one. It's usually unplugged from the net unless I'm checking mail or coming to places like this or doing research for school work. Basicly it's only online when I need it to be and that's it, and my defenses are pretty strong.
As for the computer that crashed and burned (literally), I agree with you Jason in that there were probably two problems like you said. Since the machine is not even usable until I buy a new mobo and cpu, I don't think I need to worry about the malware coming back or surviving through my home network. My home network only consists of a router and a ps2 but I never even got the chance to hook them up before the big crash happened, the PC was directly plugged into the cable modem the whole time. I've already wiped the HD with that copywipe boot disk. I went ahead and let it do the full 36 passes just to be safe. So it's ready to be formatted and installed on soon as I get my mobo and cpu. Thanks to my buddy at school for letting me plug it in to his PC to do the wipe.
Logged
The Stiffmeister
Pages: [
1
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
Programming
: Finished Python Course in Codecademy now what?
(14) by
3xban
Network Pen Testing
: Ruby on Rails Vulnerabilities/Attacks in BackTrack 5 r3
(0) by
SUdoctstudent
Network Pen Testing
: De-ICE 1.140 released!
(2) by
superkojiman
Network Pen Testing
: AIX Vulnerability Assessments
(1) by
3xban
General Certification
: CPT Practical Submission
(1) by
UNIX
OSCP - Offensive Security Certified Professional
: Failed my first attempt at the OSCP exam
(94) by
azmatt
Tools
: Social-Engineer Toolkit (SET) Version 5.0 “The Wild West” Released
(2) by
m0wgli
Malware
: EICAR?
(3) by
UKSecurityGuy
Advisories
: HTB23154: Multiple Vulnerabilities in Exponent CMS
(0) by
AndyP
Advisories
: HTB23153: Multiple Vulnerabilities in Jojo CMS
(0) by
AndyP
Advisories
: HTB23151: Cross-Site Request Forgery (CSRF) in UMI.CMS
(0) by
AndyP
Tutorials
: Need guidance
(8) by
r0ckm4n
OSCP - Offensive Security Certified Professional
: Class Scheduled 6/8 - Linux n00b
(7) by
Taemyks
OSCP - Offensive Security Certified Professional
: OSCP exam scheduled
(6) by
gbhat
Incident Response
: LinkedIn Forensics
(0) by
AFENTIS_Forensics
General Certification
: Red Team/Blue Team
(1) by
ajohnson
Career Central
: Starter cert?
(3) by
Grendel
Network Pen Testing
: Beginner Ethical Hacker
(1) by
m0wgli
Web Applications
: Nessus and Nikto
(4) by
Seen
Network Pen Testing
: Cracking salted MD5 hash
(4) by
n37sh@rk
CEH - Certified Ethical Hacker
: Passed my C|EH
(3) by
n37sh@rk
Mass Media
: EC-council hacked, irony at his best?
(0) by
j0rDy
Web Applications
: SQL Injection into an INSERT statement.
(6) by
eyenit0
Network Pen Testing
: Solution for sipXtapi INVITE Message CSeq Field Header Remote Overflow
(1) by
m0wgli
Web Applications
: dns
(2) by
H1t M0nk3y
Other
: BSides Boston
(0) by
3xban
Career Central
: InfoSec in Central, FL
(2) by
tturner
Web Applications
: Web vulnerability scanner
(4) by
H1t M0nk3y
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
Free Business and Tech Magazines and eBooks
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.