Is my system compromised? I got message about ntoskrnl.exe

Question

I am not sure this question belongs her or not but let me try.

When I get to office this morning One of my colligues had a problem with his laptop and told me he had trouble restarting it and when he finally does he got the follwoing message and it says everything was coming from my IP(laptop)

Application has changed since the last time you opened it, process id: 0
Filename: C:\Windows\system32\ntoskrnl.exe
The change was denied by user.
---- Modules changed: 1 ----
C:\Windows\system32\ntoskrnl.exe
---- New modules: 0 ----

The only change I made to my laptop is I turn on XP_cmdshell yesterday since i was not able to run some T-SQL script. I dont know whetehr it is related or not.

I am on win xp sp3, and SQL server 2008

Please help me understand if my system is compromised and this is a problem at all.

Thanks,

UPDATE: I run Antivirus and it comes clean!

Answer 1

Can you run the System File Checker on your system? At a command prompt type sfc/runnow and be sure to have your Windows XP disk handy.

Answer 2

I would think it depends on what your script does, for one.

To see if your system was infected with something, I'd start scanning it with updated antivirus definitions of your favorite scanner as well as ad-aware and spybot search-and-destroy. You can also run process explorer to test and see if there's unusual processes running in the background and autoruns (both of these are part of Sysinternals, google for the free download).

If you're handy with Linux, you can set up a system or VM to intercept your laptop's network traffic (or have a mirrored port on the switch) monitor outgoing network traffic from your laptop to look for suspicious activity, and check logs of other machines on your network to see if your computer is trying to access files or copy things to other places without permission. If you're an admin user on the network there's really no telling how far malware could have gotten through the hidden system shares and other shares you have legitimate access to. Have servers updated with new virus definitions and have them do a scan as well.

If nothing really stands out after checking your own system you could also run a chkdsk on your colleagues computer, just to check and see if for some reason there's corruption, but you said that this is logged somewhere that had your system's IP showing up...so that is rather odd.

Run as much of the checks offline as soon as possible. You need to be online long enough to get updates and latest signatures and it sounds like if there's an infection, the damage was done already, but as soon as you can, get your laptop offline to check for infections and cleanup.

This link seems to have some good information on spyware removal.

Answer 3

The text of the message your describing sounds like something generated by the Sygate Personal Firewall application.

If your colleague has just installed their security patches from this past month it could be related to that, the February 2010 patches included updates to the Windows Kernel (aka ntoskrnl.exe). If there are kernel problems then the system is more likely to be blue screening and the crash dumps will provide you a wealth of information that can point to the problem software or possible infection.

Even if this is the cause of this message is benign, there may still be malware on the system. I would suggest you look for other indicators of compromise (poor performance, strange outbound network traffic, goofy popups, etc.)