Solved help with recovery from trojan attack

PeterReilly

New Member
I have vista 32 bit, I have suffered a trojan attack. I have done a restore to before the attack and am left with a problem under explorer.
The attack loaded vnc server as a process and installed an app that informed me that my hard drive was corrupt. to add convistion to this the app either replaced explorer or intercepted its output such that only 4 direcories were visible. I have 1tb drives in raid 1 mirror config, so I new the data was secure, as windows and the raid software always inform and correct any problems.
with the restore I now have full directory listing but all directories are readonly and do not retain read/write after I have applied the readonly check removal.
Also, there are no data files visible. exe, com,dll are visible but html, txt, video and picture files are invisible in explorer.
I ran mcafee stinger to virus check and all the files were visibly processed so they have not been deleted by the attack.
Questions::
How do I make the files visible?
How do I make the readonly attrib removal stick?
 

My Computer

System One

  • Manufacturer/Model
    dell dimension 9200
    CPU
    1.86GHz intel 2core
    Motherboard
    dell std
    Memory
    4GB
    Graphics Card(s)
    inbuilt
    Sound Card
    inbuilt
    Monitor(s) Displays
    20" dell hd
Hello Peter and welcome to the forums :party:

I am currently doing a malware removal degree and during this time I am unable to help you with malware removal.

As part of my degree, I need to familiarise myself with these logs and I would really appreciate it if you could take the time to create one for me please?

OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

I will be able to tell you whether you are infected, and I will also be able to decide where's best to go next regarding your problem :)

Tom
 

My Computer

System One

  • Manufacturer/Model
    Build #1
    CPU
    Intel Core i7 3770K @4.4GHz
    Motherboard
    ASUS P8Z77-V PRO
    Memory
    Corsair Vengeance 2x4GB DDR3 1600MHz Low Profile (White)
    Graphics Card(s)
    Gigabyte Radeon HD 7850 (2GB GDDR5)
    Sound Card
    Integrated on motherboard
    Monitor(s) Displays
    23" LG LCD/LED IPS
    Screen Resolution
    1920*1080
    Hard Drives
    Samsung EVO 128GB SSD
    Seagate Barracuda 2TB 7200rpm
    2x500GB Seagate FreeAgent 5400rpm
    PSU
    Corsair TX650W V2 (80+ Bronze)
    Case
    NZXT Phantom 410
    Cooling
    Corsair H100 Water Cooler, 1x140mm and 1x120mm stock fans
    Keyboard
    Microsoft Desktop 2000 Wireless Keyboard
    Mouse
    Microsoft Desktop 2000 Wireless Mouse
    Internet Speed
    95 Mb/s Download 70 Mb/s Upload
tom982
Thanks but I've now managed, by restoring again, to overcome the trojan problem. First restore wasn't 100%. Second restore allowed me access to enough files to delete the trojan dir. having gone thru my critical dirs and forced "show hidden files" I've managed to locate all my web development files. I now intend to backup all my data and source code files then do a re-install of vista with format. This should take about a day, allowing for all the updates ms will want to do to my oem originals, but I shall be secure and more careful in future.

Regards
Peter
 

My Computer

System One

  • Manufacturer/Model
    dell dimension 9200
    CPU
    1.86GHz intel 2core
    Motherboard
    dell std
    Memory
    4GB
    Graphics Card(s)
    inbuilt
    Sound Card
    inbuilt
    Monitor(s) Displays
    20" dell hd
Hello Peter,

That's good to hear :)

There's a few things that I would recommend that you do, just to make yourself a little safer when using your computer. Here's the list:

1. Windows Update
  • Hold the
    windows_key.JPG
    key and press R to bring up the Run box
  • In the box, type wuapp.exe and press enter
  • On the side panel, there is an entry called Change Settings. Click it
  • On the drop down menu, select Install updates automatically (recommended)
  • Tick every box on that page
This ensures that the latest vulnerabilities in Windows and MS Office are patched, making it less likely that you get infected in the future

2. System Restore

To manually create a new Restore Point
  • Go to Control Panel and select System and Maintenance
  • Select System
  • On the left select Advance System Settings and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create
Now we can purge the infected ones
  • Go back to the System and Maintenance page
  • Select Performance Information and Tools
  • On the left select Open Disk Cleanup
  • Select Files from all users and accept the warning if you get one
  • In the drop down box select your main drive i.e. C
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete
You are now done

Sometimes system restore points can be infected, and by using them now that your system is clean, you will only infect yourself again and bring us back to square one. So let's get rid of them and start over

3. Clear Temp Files

  • Download TFC (By OldTimer), to your desktop.
  • Save any open documents, then close any active programs/windows
  • Right click on the file, and select Run As Administrator
  • When it opens, click Start to being the process
  • A reboot is required upon completion of this, if this is not done by TFC then do so manually
Remnants of infections may still be in your temporary files but by using this tool, we can remove all of your temporary files - purging the nasties out and freeing up disk space

4. MVPs HOSTS File

  • Download the MVPs HOSTS File to your desktop
  • Extract the files from the .zip folder
  • Right click on mvps.bat and select Run As Administrator
  • This should open up a command window, follow the on screen instructions
  • Open your start menu, and type cmd
  • Right click on cmd and select Run As Administrator
  • When it opens, type the following:
ipconfig /flushdns

The MVPs (Microsofts Most Valuable Professionals) have made this host file which contains a very large list of advertising/malicious websites by redirecting them to the IP 127.0.0.1 (your own computers). This means that whenever you attempt to load one of these sites, your computer won't be able to connect to them hence making your browsing safer and slightly faster

5. Ensure all programs are updated

  • Download and install Secunia PSI
  • Run this regularly to ensure programs are not out of date
This program compares the current version number of all of your software against the most recent version number and displays which programs need updating. It also provides links to do this. This ensures that the latest security holes and vulnerabilities in your software are patched - reducing your chance of infection through an exploit e.g. a PDF exploit

6. Create a system image

  • Use Macrium Reflect to make images of your system every 3 months
  • Not only does this backup your files, but it allows us to restore your computer to a date which is before the infection
  • Make sure these images are stored on an external hard drive
This backups your whole hard drive partition that you have installed Windows on - core Windows files, programs and your files. Not only is this protection against data loss, but it can also be used in the event of a system failure as you can just restore your computer to a time before the problem

7. Backing up registry

  • In the event of registry corruption/damage then you can restore your registry to a previous date by using this software
  • Follow this tutorial to set up daily registry backups: ERUNT Daily Registry Backup Tutorial
This handy little tool will backup and rebuild your registry on a daily basis. Sometimes things can go wrong on your computer - perhaps caused by a virus, perhaps a bug - and this could lead to your registry being corrupted or damaged. This could have all sorts of adverse effects on your system and could potentially stop Windows from functioning or booting. By doing this, we are able to restore to one of these backups if needs be

8. WOT Link Scanning

  • Install WOT (Web Of Trust) from here Safe Browsing Tool - WOT
  • This program provides information about the safety of websites and links that you visit.
  • The ratings can be found below:

    Green - Website is highly rated
    Yellow - Website should be used with caution
    Red - This website should be avoided
  • A complete list of the symbols can be found here
WOT provides colour coded link scanning for websites and allows you to see whether a link you are about to click on is bad - e.g. malicious


9. SpywareBlaster

  • This software prevents the installation of Spyware on your system by blocking a specific list of ActiveX controls that are known to be spyware related.
  • Once you have installed this program, make sure you update it.
  • Open SpywareBlaster and tick the Enable Protection For All Unprotected Items

10. Make Internet Explorer More Secure

  • Hold the
    windows_key.JPG
    key and press R
  • When the run dialogue opens, type Inetcpl.cpl and press enter
  • Open the Security tab
  • Click Reset all zones to default level
  • Ensure that Internet Zone is selected and click Custom Level
  • In the ActiveX section, set:
    [*]Download signed ActiveX controls to Prompt
    [*]Download unsigned ActiveX controls to Prompt
    [*]Initialize and Script ActiveX controls not marked as safe to Disable
Some infections can be caused by malicious ActiveX controls, all this program does is block a large list of controls that are known to be malicious

11. Hide Hidden Files/Folders

  • Hold the
    windows_key.JPG
    key and press R
  • When the run dialogue opens, type CONTROL FOLDERS and press enter
  • Go to the View tab
  • Make sure the following boxes are set correctly:
  • Don't show hidden files, folders, or drives = Checked
  • Hide extensions for known file types = Checked
  • Hide protected operating system files (Recommended) = Checked
  • Click Apply then OK
There is no need to view hidden files or folders for everyday use, so if we hide them, then we wont be able to accidentally delete something important

Tom
 

My Computer

System One

  • Manufacturer/Model
    Build #1
    CPU
    Intel Core i7 3770K @4.4GHz
    Motherboard
    ASUS P8Z77-V PRO
    Memory
    Corsair Vengeance 2x4GB DDR3 1600MHz Low Profile (White)
    Graphics Card(s)
    Gigabyte Radeon HD 7850 (2GB GDDR5)
    Sound Card
    Integrated on motherboard
    Monitor(s) Displays
    23" LG LCD/LED IPS
    Screen Resolution
    1920*1080
    Hard Drives
    Samsung EVO 128GB SSD
    Seagate Barracuda 2TB 7200rpm
    2x500GB Seagate FreeAgent 5400rpm
    PSU
    Corsair TX650W V2 (80+ Bronze)
    Case
    NZXT Phantom 410
    Cooling
    Corsair H100 Water Cooler, 1x140mm and 1x120mm stock fans
    Keyboard
    Microsoft Desktop 2000 Wireless Keyboard
    Mouse
    Microsoft Desktop 2000 Wireless Mouse
    Internet Speed
    95 Mb/s Download 70 Mb/s Upload
Thanks Tom,
When my system is reinstalled and clean I shall take your advice on some of these points.

Best of luck with the degree course.

Peter
 

My Computer

System One

  • Manufacturer/Model
    dell dimension 9200
    CPU
    1.86GHz intel 2core
    Motherboard
    dell std
    Memory
    4GB
    Graphics Card(s)
    inbuilt
    Sound Card
    inbuilt
    Monitor(s) Displays
    20" dell hd
Hello Peter,

Thanks :) I would recommend that you do all of them, but it's your choice!

Tom
 

My Computer

System One

  • Manufacturer/Model
    Build #1
    CPU
    Intel Core i7 3770K @4.4GHz
    Motherboard
    ASUS P8Z77-V PRO
    Memory
    Corsair Vengeance 2x4GB DDR3 1600MHz Low Profile (White)
    Graphics Card(s)
    Gigabyte Radeon HD 7850 (2GB GDDR5)
    Sound Card
    Integrated on motherboard
    Monitor(s) Displays
    23" LG LCD/LED IPS
    Screen Resolution
    1920*1080
    Hard Drives
    Samsung EVO 128GB SSD
    Seagate Barracuda 2TB 7200rpm
    2x500GB Seagate FreeAgent 5400rpm
    PSU
    Corsair TX650W V2 (80+ Bronze)
    Case
    NZXT Phantom 410
    Cooling
    Corsair H100 Water Cooler, 1x140mm and 1x120mm stock fans
    Keyboard
    Microsoft Desktop 2000 Wireless Keyboard
    Mouse
    Microsoft Desktop 2000 Wireless Mouse
    Internet Speed
    95 Mb/s Download 70 Mb/s Upload
Depending on what type of Trojan horse or virus you have, intruders may have access to your personal information and may even be using your computer to attack other computers. You can stop this activity by turning off your Internet connection. The best way to accomplish this is to physically disconnect your cable or phone line, but you can also simply “disable” your network connection.
At this point it is a good idea to take the time to back up your files. If possible, compile all of your photos, documents, Internet favorites, etc., and burn them onto a CD or DVD or save them to some other external storage device. It is vital to note that these files cannot be trusted, since they are still potentially infected. (Actually, it’s good practice to back up your files on a regular basis so that if they do get infected, you might have an uninfected set you can restore.)
Since your computer (including its operating system) may be infected with a malicious program, it is safest to scan the machine from a live CD (or “rescue” CD) rather than a previously installed antivirus program. Many antivirus products provide this functionality. Another alternative is to use a web-based virus removal service, which some antivirus software vendors offer (try searching on “online virus scan”).
 

My Computer

Hi
Thanks for your reply.
I found vnc server in my processes; I deleted this.
I ran macafee stringer which found no running virus.
The trojan had hidden many directories and set them to readonly.
Having deleted the directory containing the files with the trojan in them, I ran a restore to b4 the download. This solved the trojan problem, and with the vnc server gone, my machine was fairly secure.
I am in the process of checking my backup files for viruses, but to be sure, until I have done a complete reload, I am running critical apps (banking, etc.) on an isolated machine.
Not looking forward to the reload, 1TB mirrored on RAID 1. If I interrupt a session or suffer a power failure, the RAID rebuild on restart takes half a day alone. Lots of little files.
I thought of storing them in a cloud, but what if it rains?

Thanks for the reply.

Regards
Peter
 

My Computer

System One

  • Manufacturer/Model
    dell dimension 9200
    CPU
    1.86GHz intel 2core
    Motherboard
    dell std
    Memory
    4GB
    Graphics Card(s)
    inbuilt
    Sound Card
    inbuilt
    Monitor(s) Displays
    20" dell hd
Hi Peter,

That sounds like a great plan to me, what are you scanning your files with?

It's good that you are handling your sensitive information on another computer, some people aren't aware of the risks involved on doing it on an infected computer.

Well RAID has it's ups and downs - like all of the other data storage techniques. But it's just something you'll have to put up with :( And fingers crossed on not having a power failure!

The effectiveness of Cloud computing really depends on your internet connection, it will be a more viable option if you have fast DL/UL speeds.

Personally, I would recommend that you purchase a portable external hard drive that you store somewhere other than your house, on which you can do monthly backups of your files. This is to protect your data against fires and theft etc. Of course it's not fool proof, but it implements another layer of backup.

Tom
 

My Computer

System One

  • Manufacturer/Model
    Build #1
    CPU
    Intel Core i7 3770K @4.4GHz
    Motherboard
    ASUS P8Z77-V PRO
    Memory
    Corsair Vengeance 2x4GB DDR3 1600MHz Low Profile (White)
    Graphics Card(s)
    Gigabyte Radeon HD 7850 (2GB GDDR5)
    Sound Card
    Integrated on motherboard
    Monitor(s) Displays
    23" LG LCD/LED IPS
    Screen Resolution
    1920*1080
    Hard Drives
    Samsung EVO 128GB SSD
    Seagate Barracuda 2TB 7200rpm
    2x500GB Seagate FreeAgent 5400rpm
    PSU
    Corsair TX650W V2 (80+ Bronze)
    Case
    NZXT Phantom 410
    Cooling
    Corsair H100 Water Cooler, 1x140mm and 1x120mm stock fans
    Keyboard
    Microsoft Desktop 2000 Wireless Keyboard
    Mouse
    Microsoft Desktop 2000 Wireless Mouse
    Internet Speed
    95 Mb/s Download 70 Mb/s Upload
Back
Top