How to remove this "worm"?

silvercap SG · 2007-03-23T15:24:33+00:00

IIS and Apache are servers. I don't think they managed to hack you, because Kaspersky already blocked it.

silvercap SG

My Kaspersky Antivirus sometimes will detect this fellow, but I have no ideal how did I get this worm?

How can I remove it?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3/22/2007 11:40:38 AM Intrusion.Win.MSSQL.worm.Helkern! Attacker's IP address: 202.100.109.213. Protocol/service: UDP on local port 1434. Time: 3/22/2007 11:40:38 AM

Master -_- SG

erm wake up early? so the early bird can...erm nvm Laughing

gigabyte14 SG

see the location, did u try to manually delete it?

ndmmxiaomayi SG

Looks more than hacker attack than a virus attack.

I don't know since when antivirus report port number, protocol used and IP address.

That's the job of a firewall, not antivirus.

alvin-ncs SG

firewall...

stop all internet connection den scan computer...

silvercap SG

I just checked the IP address, it's the fucking chinaman try to hack my computer! Twisted Evil

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU

ReferralServer: whois://whois.apnic.net

NetRange: 202.0.0.0 - 203.255.255.255
CIDR: 202.0.0.0/7
NetName: APNIC-CIDR-BLK
NetHandle: NET-202-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: DNS1.TELSTRA.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/info/faq/abuse
Comment:
RegDate: 1994-04-05
Updated: 2005-05-20

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: 7 3858 3100
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2007-03-21 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 202.100.96.0 - 202.100.127.255
netname: CHINANET-NX
descr: CHINANET ningxia province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: ZL127-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CHINANET-NINGXIA
changed: [email protected] 20020115
changed: [email protected] 20020225
status: ALLOCATED PORTABLE
changed: [email protected] 20041210
source: APNIC

person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: [email protected]
address: No.31 ,jingrong street,beijing
address: 100032
phone: 10-58501724
fax-no: 10-58501724
country: CN
changed: [email protected] 20051212
mnt-by: MAINT-CHINANET
source: APNIC

person: zhaolong li
address: 44 jiefangdong street,ningxia,750001,
address: china
country: CN
phone: 951-6018000
fax-no: 951-6019000
e-mail: [email protected]
nic-hdl: ZL127-AP
mnt-by: MAINT-NEW
changed: [email protected] 20010220
source: APNIC

ndmmxiaomayi SG

Looks like a Chinese hacker.

inetnum: 202.100.96.0 - 202.100.127.255
netname: CHINANET-NX
descr: CHINANET ningxia province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: ZL127-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CHINANET-NINGXIA
changed: [email protected] 20020115
changed: [email protected] 20020225
status: ALLOCATED PORTABLE
changed: [email protected] 20041210
source: APNIC

person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: [email protected]
address: No.31 ,jingrong street,beijing
address: 100032
phone: +86-10-58501724
fax-no: +86-10-58501724
country: CN
changed: [email protected] 20051212
mnt-by: MAINT-CHINANET
source: APNIC

person: zhaolong li
address: 44 jiefangdong street,ningxia,750001,
address: china
country: CN
phone: +86-951-6018000
fax-no: +86-951-6019000
e-mail: [email protected]
nic-hdl: ZL127-AP
mnt-by: MAINT-NEW
changed: [email protected] 20010220
source: APNIC

Kaspersky reports port number 1434 as well. Are you using Microsoft SQL on your PC? More info at Link Logger

Kaspersky info about the Helkern worm - http://www.kaspersky.com/news?id=970183

If you are indeed using Microsoft SQL, please shut it down.

If unsure, download Get Services and HijackThis.

Generate a log and I will be able to tell which processes and services are related to Microsoft SQL.

silvercap SG

removed!

silvercap SG

removed!

ndmmxiaomayi SG

Go to Start > Run and type in services.msc

Locate this service - ASP.NET State Service and double click on it.

Select Manual from the drop-down menu for Startup Type. Then click on Stop.

Click OK to apply the settings. Restart the PC and check that it's not being started.

hiphop2009 SG

how to check? using wad program?....hmm...

silvercap SG

Thanks, but my default setting is "Stop".

silvercap SG

This one

http://checkip.narak.com/

ndmmxiaomayi SG

HijackThis log shows one infection.

http://www.sophos.com/security/analyses/trojdowdecg.html

Line that shows this infection is O2 - BHO: (no name) - {7ACB5731-5839-13AB-EABC-124791194525} - C:\WINDOWS\system32\msindeo.dll

You are also using FlashGet, a spyware-infected download manager. For more info, read this article.

There are non-infected alternatives being suggested, with Download Express being my favourite.

Fix

Locate this O2 line, put a tick against this entry and click Fix Checked.

Then you will need to show hidden files.

Go to My Computer. Click on Tools > Folder Options.

Select the View tab. Scroll all the way down to Hidden files and folders.

Select Show hidden files and folders radio button.

Untick this box: Hide extensions for known file types.

Click OK.

Now go to C:\Windows\system32 and delete this file: msindeo.dll

Download ATF Cleaner or CCleaner to clear your temporary files (this trojan creates temporary files).

hiphop2009 SG

thanx! i increased my computer knowledge by +1 =D

ndmmxiaomayi SG

Then you better use stealth... you can be "seen".

silvercap SG

How to stealth?

ndmmxiaomayi SG

Your firewall... there should one option about hiding you... Drag that slider up to high.

ndmmxiaomayi SG

See this article by Kaspersky:

http://www.kaspersky.com/faq?chapter=170708527&qid=172510910

silvercap SG

Thanks for ur help! Very Happy

Good night.