Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks detected. What is going on and is there anything I can do? I've got ESET smart security.

Not to sound alarmist but when the DNS poisoning attack happened I was viewing this page on past CIA projects from wikipedia. https://en.wikipedia.org/wiki/Project_MKUltra

share|improve this question
What was the file it found, and what was the malware detected? Were the DNS poisoning attacks internal or external to your machine? – GdD Nov 5 '12 at 11:06
It found Win32/Obfuscated.NEU trojan and Win32/RiskWare.HackAV.HP. The attacking IP was 112.90.143.29:53 – Celeritas Nov 5 '12 at 11:09
1  
Both of those sound like generic signatures designed to find obfuscated executables and keygens. – Polynomial Nov 5 '12 at 11:54

2 Answers

up vote 3 down vote accepted

Sounds like nothing big - DNS poisoning attacks and random other attack-like packets from the 'net are an every-day occurrence. I'm surprised your AV caught them though, unless it's a combined AV and firewall solution.

If the malware managed to run at all, however, your machine is compromised. Nuke it from orbit and start over. Now would be a good time to dust off your backups. You do have backups, right? ;)

share|improve this answer
up vote 0 down vote

DNS poisoning could be external to you, so if it is some sort of browser AV plug-in telling you this is may be consulting some sort of external database on compromised sites, in which case you could verify the information yourself and keep confidence in your system. I'm not familiar with ESET's capabilities there. You could open a support ticket and ask what the significance of the message is of course.

If you are getting these messages from your AV itself then it could be you have been successfully attacked, in which case you the malware could be trying to direct you to specific sites. Check your hosts file for extra entries. If you have been hacked the only way you can gain assurance again is to, as @Polynomial says, wipe it and start over.

I highly doubt it has anything to do with going to the MKULTRA page in any case. It's almost certainly a coincidence (or is it?!)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.