4

My system is Windows XP SP3, updated with the latest patches.

The PC is connected to a Cisco 877 ADSL router, which does NAT from the internal network to its single static public IP address. There are no forwarded ports, and the router's management console can only be accessed from the inside.

I was doing two things: working on a remote office machine via VPN and browsing some web pages on the Cisco web site.

The remote network is absolutely safe (it's a lab network, four virtual servers, no publicly accessible services and no users at all; also, none of what I'm going to describe ever happened there).

The Cisco web site... well, I suppose is quite safe, too.

Suddenly, something happened.

Strange popups appears anywhere; programs claiming they're "antimalware", "antispyware" et so on begins autoinstalling; fake Windows Update and Security Center icons pop up in the system tray. svchost.exe began crashing repeatedly. Then, finally, after some minutes of this... BSOD.

And, upon rebooting, BSOD again. Even in safe mode.

Ok, that was obviously some virus/trojan/whatever. I had to install a new copy of Windows on another partition to clean things up. I found strange executables, services and DLLs almost anywhere. Amongst the other things, user32.dll and ndis.sys had been replaced. A fake software called "Antimalware Doctor" had been installed. There were services with completely random names or even GUIDs (!), and also ones called "IpSect" and "Darkness". There were executable files without an .exe extension. There were even two boot-class drivers, which I'm quite sure are the ones that finally caused the system to crash.

A true massacre.

Ok, now the questions:

  • What the hell was that?!? It was something more than a simple virus!
  • How did it manage to attack my computer, as I am behind a firewall and was not doing anything even only potentially harmful on the web at the time?
Improve this question
5
  • 4
    A firewall doesn't guarantee anything.
    – Sathyajith Bhat ♦
    Commented Apr 28, 2010 at 20:26
  • 1
    Well, it guarantees nobody will connect to vulnerable services on your computer, so you have to actively (or unknowingly) download and run something from the Internet.
    – Massimo
    Commented Apr 28, 2010 at 20:38
  • Massimo is spot on - you have probably clicked on a disguised link, and once you've done that you've given permission.
    – raw_noob
    Commented Apr 29, 2010 at 8:35
  • 3
    That or you got hit by a drive-by. Even legitimate sites - when they sell ads - the ad seller can put on a Jave or activeX exploit. When you go to the site, the ads come down and start running - bang you're infected.
    – Blackbeagle
    Commented Apr 29, 2010 at 20:38
  • 1
    Blackbeagle, I think a drive-by is even more likely the cause - but see also Massimo's comment on his outdated Java Runtime Environment below.
    – raw_noob
    Commented Apr 29, 2010 at 21:14

2 Answers 2

Reset to default
2

This sounds very like a problem I had recently with XP Antispyware, a Java-based exploit that turns off your firewall and antivirus, claims to have detected hundreds of virus infections, adds fake security centre icons to the taskbar, and prevents the launch of .exe programs so that you can't run antimalware software.

There is a fix, but you have to know what you're doing - not obvious - and run a little script on the registry to kill the .exe blocker, or it just keeps coming back. Then you have to get rid of the bad Java plugin in your browser.

Read all about it at: http://lifehacker.com/5499124/how-to-remove-xp-antispyware . This was a lifesaver for me. I am very careful about viruses etc. and have been lucky so far, but this one was on the machine before I realised what had happened. I still don't know where I picked it up.

Improve this answer
5
  • It was not that one, but very similar.
    – Massimo
    Commented Apr 29, 2010 at 20:28
  • 1
    I had recently installed quite an outdated JRE (1.5.something) in order to make Cisco SDM work (it doesn't with 1.6 ones)... could have been its fault?
    – Massimo
    Commented Apr 29, 2010 at 20:34
  • The JRE is indeed the gateway - I can't remember the details but it was definitely earlier versions of the JRE that were being exploited. It looks as though a whole family of viruses has been designed to exploit this weakness. I believe they started showing up at the end of March. AVG doesn't detect the one I picked up. If you don't need the JRE it is safer to disable it or remove it - that's what I did. This person: smarterware.org/5530/how-to-uninstall-xp-antispyware actually disabled Java updates in msconfig to prevent the problem reoccurring.
    – raw_noob
    Commented Apr 29, 2010 at 21:11
  • I'd never had used such an outdated software... if those morons at Cisco had made their java-based router web management (SDM) compatible with more recent ones :-(
    – Massimo
    Commented Apr 29, 2010 at 22:17
  • 1
    Massimo - take a look at: vupen.com/english/advisories/2010/0747 for detail on the exploit. Affected versions are: Sun Java JDK version 6 Update 18 and prior / Sun Java JDK version 5.0 Update 23 and prior / Sun Java JRE version 6 Update 18 and prior / Sun Java JRE version 5.0 Update 23 and prior / Sun Java JRE version 1.4.2_25 and prior / Sun Java SDK version 1.4.2_25 and prior / Also: "Upgrade to Sun Java JDK and JRE 6 Update 19, JDK and JRE 5.0 Update 24, and JRE and SDK version 1.4.2_26"
    – raw_noob
    Commented Apr 30, 2010 at 12:09
0

Looks like it was "Neprodoor": http://www.prevx.com/blog/115/Neprodoor-flies-beyond-the-radar.html

I managed to clean almost everything by working from a fresh Windows installation on another disk... but that beast installed literally tens of malwares on the system, and I still had a broken Windows Update (like a hosts redirect, but the hosts file was empty) and some ad sites popping up now and then.

I ended up formatting and reinstalling... couldn't trust the system anymore. Oh, well, it was time to move to Windows 7 :-)

But I still don't know how did it get in... ?!?

Improve this answer
1
  • 1
    See Blackbeagle's comment above. Some of the bad links look like legitimate advertising and have been sold as such to reputable websites.
    – raw_noob
    Commented Apr 29, 2010 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .