UNSOLVED
Strange Network Traffic
Lately we have had alot of traffic on the network. I downloaded ethereal and found the following packets coming from one computer. I know which computer it is, but have no idea what is putting out the packets. Any ideas? The computer has updated anti-virus software, and has all Windows Updates. It is running Windows XP Pro, Service Pack 2. Thanks.
No. Time Source Destination Protocol Info
2 0.000230 10.1.184.103 10.1.193.78 TCP 1971 > 1816 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
4 0.001689 10.1.184.103 10.1.193.75 TCP 1971 > 1292 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
6 0.091187 10.1.184.103 10.1.193.110 TCP 1971 > 2800 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
10 0.310052 10.1.184.103 10.1.193.55 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
12 0.374982 10.1.184.103 10.1.193.75 TCP 1971 > 1292 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
16 0.547159 10.1.184.103 10.1.193.78 TCP 1971 > 1816 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
18 0.921912 10.1.184.103 10.1.193.75 TCP 1971 > 1292 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
20 0.922641 10.1.184.103 10.1.193.75 TCP 1971 > 1293 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
22 1.354058 10.1.184.103 10.1.192.105 TCP 1971 > 1333 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
24 1.359406 10.1.184.103 10.1.193.75 TCP 1971 > 1293 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
38 1.836054 10.1.184.103 10.1.192.105 TCP 1971 > 1333 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
42 1.906335 10.1.184.103 10.1.193.75 TCP 1971 > 1293 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
48 2.273548 10.1.184.103 10.1.192.105 TCP 1971 > 1333 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
50 2.274521 10.1.184.103 10.1.192.105 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
52 2.328266 10.1.184.103 10.1.193.109 TCP 1971 > 1902 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
56 2.701315 10.1.184.103 10.1.193.109 TCP 1971 > 1902 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
58 2.820478 10.1.184.103 10.1.192.105 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
60 3.113518 10.1.184.103 10.1.192.64 TCP 1971 > 2502 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
62 3.248245 10.1.184.103 10.1.193.109 TCP 1971 > 1902 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
64 3.248973 10.1.184.103 10.1.193.109 TCP 1971 > 1903 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
66 3.257972 10.1.184.103 10.1.192.105 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
71 3.596046 10.1.184.103 10.1.192.64 TCP 1971 > 2502 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
73 3.685739 10.1.184.103 10.1.193.109 TCP 1971 > 1903 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
75 3.860106 10.1.184.103 10.1.193.74 TCP 1971 > 2914 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
77 4.032768 10.1.184.103 10.1.192.64 TCP 1971 > 2502 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
79 4.033497 10.1.184.103 10.1.192.64 TCP 1971 > 2503 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
83 4.232667 10.1.184.103 10.1.193.109 TCP 1971 > 1903 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
85 4.342588 10.1.184.103 10.1.193.74 TCP 1971 > 2914 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
87 4.380526 10.1.184.103 10.1.193.83 TCP 1971 > 4828 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
89 4.579697 10.1.184.103 10.1.192.64 TCP 1971 > 2503 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
92 4.863253 10.1.184.103 10.1.193.83 TCP 1971 > 4828 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
94 4.889517 10.1.184.103 10.1.193.74 TCP 1971 > 2914 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
96 4.890247 10.1.184.103 10.1.193.74 TCP 1971 > 2915 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
98 5.017191 10.1.184.103 10.1.192.64 TCP 1971 > 2503 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
100 5.329444 10.1.184.103 10.1.193.104 TCP 1971 > 2630 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
102 5.410185 10.1.184.103 10.1.193.83 TCP 1971 > 4828 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
104 5.410912 10.1.184.103 10.1.193.83 TCP 1971 > 4829 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
106 5.436447 10.1.184.103 10.1.193.74 TCP 1971 > 2915 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
108 5.812172 10.1.184.103 10.1.193.104 TCP 1971 > 2630 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
110 5.956868 10.1.184.103 10.1.193.83 TCP 1971 > 4829 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
114 6.359101 10.1.184.103 10.1.193.104 TCP 1971 > 2630 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
116 6.360560 10.1.184.103 10.1.193.104 TCP 1971 > 2631 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
118 6.503797 10.1.184.103 10.1.193.83 TCP 1971 > 4829 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
120 6.682540 10.1.184.103 10.1.192.86 TCP 1971 > 4951 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
129 6.905787 10.1.184.103 10.1.193.104 TCP 1971 > 2631 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
141 7.130491 10.1.184.103 10.1.192.86 TCP 1971 > 4951 [RST, ACK] Seq=0
2 0.000230 10.1.184.103 10.1.193.78 TCP 1971 > 1816 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
4 0.001689 10.1.184.103 10.1.193.75 TCP 1971 > 1292 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
6 0.091187 10.1.184.103 10.1.193.110 TCP 1971 > 2800 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
10 0.310052 10.1.184.103 10.1.193.55 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
12 0.374982 10.1.184.103 10.1.193.75 TCP 1971 > 1292 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
16 0.547159 10.1.184.103 10.1.193.78 TCP 1971 > 1816 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
18 0.921912 10.1.184.103 10.1.193.75 TCP 1971 > 1292 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
20 0.922641 10.1.184.103 10.1.193.75 TCP 1971 > 1293 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
22 1.354058 10.1.184.103 10.1.192.105 TCP 1971 > 1333 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
24 1.359406 10.1.184.103 10.1.193.75 TCP 1971 > 1293 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
38 1.836054 10.1.184.103 10.1.192.105 TCP 1971 > 1333 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
42 1.906335 10.1.184.103 10.1.193.75 TCP 1971 > 1293 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
48 2.273548 10.1.184.103 10.1.192.105 TCP 1971 > 1333 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
50 2.274521 10.1.184.103 10.1.192.105 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
52 2.328266 10.1.184.103 10.1.193.109 TCP 1971 > 1902 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
56 2.701315 10.1.184.103 10.1.193.109 TCP 1971 > 1902 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
58 2.820478 10.1.184.103 10.1.192.105 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
60 3.113518 10.1.184.103 10.1.192.64 TCP 1971 > 2502 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
62 3.248245 10.1.184.103 10.1.193.109 TCP 1971 > 1902 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
64 3.248973 10.1.184.103 10.1.193.109 TCP 1971 > 1903 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
66 3.257972 10.1.184.103 10.1.192.105 TCP 1971 > 1334 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
71 3.596046 10.1.184.103 10.1.192.64 TCP 1971 > 2502 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
73 3.685739 10.1.184.103 10.1.193.109 TCP 1971 > 1903 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
75 3.860106 10.1.184.103 10.1.193.74 TCP 1971 > 2914 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
77 4.032768 10.1.184.103 10.1.192.64 TCP 1971 > 2502 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
79 4.033497 10.1.184.103 10.1.192.64 TCP 1971 > 2503 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
83 4.232667 10.1.184.103 10.1.193.109 TCP 1971 > 1903 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
85 4.342588 10.1.184.103 10.1.193.74 TCP 1971 > 2914 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
87 4.380526 10.1.184.103 10.1.193.83 TCP 1971 > 4828 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
89 4.579697 10.1.184.103 10.1.192.64 TCP 1971 > 2503 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
92 4.863253 10.1.184.103 10.1.193.83 TCP 1971 > 4828 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
94 4.889517 10.1.184.103 10.1.193.74 TCP 1971 > 2914 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
96 4.890247 10.1.184.103 10.1.193.74 TCP 1971 > 2915 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
98 5.017191 10.1.184.103 10.1.192.64 TCP 1971 > 2503 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
100 5.329444 10.1.184.103 10.1.193.104 TCP 1971 > 2630 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
102 5.410185 10.1.184.103 10.1.193.83 TCP 1971 > 4828 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
104 5.410912 10.1.184.103 10.1.193.83 TCP 1971 > 4829 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
106 5.436447 10.1.184.103 10.1.193.74 TCP 1971 > 2915 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
108 5.812172 10.1.184.103 10.1.193.104 TCP 1971 > 2630 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
110 5.956868 10.1.184.103 10.1.193.83 TCP 1971 > 4829 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
114 6.359101 10.1.184.103 10.1.193.104 TCP 1971 > 2630 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
116 6.360560 10.1.184.103 10.1.193.104 TCP 1971 > 2631 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
118 6.503797 10.1.184.103 10.1.193.83 TCP 1971 > 4829 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
120 6.682540 10.1.184.103 10.1.192.86 TCP 1971 > 4951 [RST, ACK] Seq=0 Ack=0 Win=0 Len=0
129 6.905787 10.1.184.103 10.1.193.104 TCP 1971 > 2631 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0
141 7.130491 10.1.184.103 10.1.192.86 TCP 1971 > 4951 [RST, ACK] Seq=0
- Thanks for that information. I searched the registry for the keys that where in the article but I found nothing. How ever I do believe you are correct in what you are saying. I opened task manager, and added the PID column. I then went to a command prompt and ran netstat -b which shows which process are communicating with the network. I did not have anything running that would be causing network traffic. The only process that was listed as communicating with the network was a process called system. When I try to end the task in task manager, nothing happens. I searched the registry for system.exe and found nothing. I searched the harddrive for system.exe and found nothing. Any suggestions as of what to do next?
Login via safe mode as administrator.
Goto c:\ via command prompt and type attrib system.exe -r -a -s -h /s
Then look for the system.exe
From C:\ type Dir system.exe /b /s
Do you find any.
Personally I would find another Better antivirus.
You could uninstall norton and download zone alarm security suite trial and scan with that.
This would put a firewall up and alert you to processes that are not standard that want to access the internet and then you could deny access and or find and delete them.
I prefer 2 firewalls. 1 at the border and 1 on each machine. A layered approach.
http://www.zonelabs.comYou could also try these free tools
http://www.trendmicro.com/spyware-scan/
http://housecall.trendmicro.com/housecall/start_corp.asp- I scanned the computer with two online scanners, and neither found anything. I also ran Microsoft Spyware scanner and found and removed some spyware. One was a trojan dropper. I will try zone alarm and let you know what I find. I have seen system in the task manager on many computers. How do I know this is a trojan and not a componet of windows?
- This is not a dell problem.
Scanning after infection is not a good test.
I have my scanners update every 2 hours.
Reformat Reinstall, install zone alarm.
It will tell you if there is a new "process"
Seems to me you have rampant viruses behind your firewall and the problem is only going to get worse. I figured out what the traffic on port 1971 was. We have deepfreeze installed on most of the computers in the school. The computer that has the ip address 10.1.184.103 has the management console on it. All the computers that have deep freeze are configured to conect to this computer. I can' believe I forgot about that.
Thanks,
Brandon
speedstep
11 Legend
•
46969 Posts
223
0
Posted November 8th, 2005 00:00
Also Known As: Backdoor.Win32.Bifrose.d [Kaspersky], BackDoor-CKA [McAfee]
Type: Trojan Horse
Infection Length: 72,397 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Novell Netware, OS/2, UNIX, Windows 3.x
When Backdoor.Bifrose runs, it performs the following actions:
Copies itself as System.exe to either the %Windir% or the %System% folder.
Notes:
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
Generates an encrypted file named %System%\Plugin1.dat.
Adds one of the following values:
"system"="%System%\system.exe"
"system"="%Windir%\system.exe"
to the following registry keys, so that the back-door Trojan horse runs when Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Adds one of the following values:
"stubpath" = "%System%\system.exe s"
"stubpath" = "%Windir%\system.exe s"
to the following registry key, which runs when Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
Creates the following registry entries to store status information:
HKEY_CURRENT_USER\Software\Wget
HKEY_LOCAL_MACHINE\SOFTWARE\Wget
Collects system information from the infected computer.
Attempts to use Microsoft Internet Explorer to connect, using TCP port 1971, to one of the following addresses and send out the collected system information:
firedragon.no-ip.com
killvirus2002.serveftp.org
222.65.219.234
Waits for commands from the attacker.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":
Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.