waddler - second opinion on DDS log

waddler_8

Initial look through suggests this was on it - http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Worm%3AWin32%2FMorto.A

What have they been able to tell you about it - Are they running a game server?

c:\program files\Anti CSDoS by Shocker
c:\\Documents and Settings\\Administrator\\Desktop\\HLDS By freeshmanny\\hlds.exe

There's that much crap on it it's hard to tell if it's hacked or not.

GunJack

waddler_8 wrote: »

Looks like false positives.

http://support.microsoft.com/kb/908077

good spot, that...

GunJack

waddler_8 wrote: »

Initial look through suggests this was on it - http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Worm%3AWin32%2FMorto.A

What have they been able to tell you about it - Are they running a game server?

c:\program files\Anti CSDoS by Shocker
c:\\Documents and Settings\\Administrator\\Desktop\\HLDS By freeshmanny\\hlds.exe

There's that much crap on it it's hard to tell if it's hacked or not.

^^^ my thoughts exactly about the carp

It's not a gameserver, it's one of a small office (clinic) network that the guy put together himself, with some help from the software package providers (database, booking system, etc,.) . When I saw the AntiCSDoS and read up on it, it was sort of
feasible that they could have been trying to use it to protect their systems, albeit misguided....

edit: that page you linked to was a different one to the one I found, mine was less specific about gaming servers.

Don't recognise that worm name, but when I get chance later I'll pull up t'other couple that I've already removed, for reference

Cheers for the extra eyes on this one

GunJack

I've since removed that dodgy AVG directory, looking at a couple of the notepad files in there, funny old thing at least 2 of the names in the list were those used for the newly-created user accounts, so, hacked?? I think so...

waddler_8

I was just in the process of posting this when you replied.

How do they explain HLDS.exe in the firewall exceptions?

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Administrator\\Desktop\\HLDS By freeshmanny\\hlds.exe"=

Everything points to this being hacked. I'd wipe it and check any others on the network.

waddler_8

We've got a worm that "allows unauthorized access to an affected computer"
We've got a game server (HLDS)
We've got HelloVNC (hidden) "With this program you can easily find vulnerable vnc server"
We've got DUBrute "Hacking tool used for brute forcing passwords." Sophos
We've got Anti CSDoS by Shocker "Provide your Half-Life Dedicated server with protection from CSDoS and Born to be pig exploit."

On a clinics computer?

Enough evidence to say it's been hacked I'd say. Someone's been having fun with it. Possibilty of compromised personal data too?

GunJack

waddler_8 wrote: »

We've got a worm that "allows unauthorized access to an affected computer"
We've got a game server (HLDS)
We've got HelloVNC (hidden) "With this program you can easily find vulnerable vnc server"
We've got DUBrute "Hacking tool used for brute forcing passwords." Sophos
We've got Anti CSDoS by Shocker "Provide your Half-Life Dedicated server with protection from CSDoS and Born to be pig exploit."

On a clinics computer?

Enough evidence to say it's been hacked I'd say. Someone's been having fun with it. Possibilty of compromised personal data too?

yer not wrong mate....not good at all.....

GunJack

Ey up waddler...just for completeness these were t'other two trojans I'd binned off this machine:-

http://www.threatexpert.com/files/bin.exe.html many names for this one

http://www.threatexpert.com/report.aspx?md5=b79bbf9aa8c225c3a2327e408d75a854


I'm in the process of putting the guy a report together detailing why he should wipe this one and start afresh....

waddler_8

GunJack wrote: »

I'm in the process of putting the guy a report together detailing why he should wipe this one and start afresh....

That should make good reading for him. He really should have you wipe it & start again.

I like to clean PC's where I can instead of wiping & rebuilding, but sometimes it's the best option - this being one of those cases. Someone has had remote access to it.

Initially, If this had been a teenage gamer come wannabe hax0r, then the programs on it wouldn't have surprised me, but as it stands they definitely shouldn't have been on there.

GunJack

I suspect, after the deeper reading you pointed out, that maybe someone's been remotely using it for extra oomph for their games hosting, botnet-style....b@st@rds