Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to believe are virus related.

1) When first logging in a popup warning "services.exe" had stopped working.
2) The windows error log has numerous (I'm talking into the hundreds) of WinVNC lines stating blacklisted connections from all different IP addresses
3) The SQL Server 2005 Express database is no longer accessible. Previously it was set to allow Windows Authentication but that no longer works. Issuing commands like:

osql –U sa –S SQLSERVER\INSTANCE

...Or similar from the command line give errors stating that the authentication is denied.

4)

netstat-an | find /i "established"
TCP    192.168.15.20:4366     <SUSPICIOUS_IP>:1015     ESTABLISHED

netstat -b -a -n
TCP    192.168.15.20:4366     <SUSPICIOUS_IP>:1015     ESTABLISHED     3148
[services.exe]

And the final kicker....
5) When searching for "services.exe" on C:\ I find two. One in system32, one in system, Looking at the properties of the file in system in the Version -> Original Filename tab I get GuardS5.exe along with a few other oddball entries throughout the properties.

The question I ask.... how can I troubleshoot this further from a strictly remote connection? I will not be able to do Safe Mode or reboots. Ultimately if I can get definitive proof that this is an infected PC then more drastic steps can be taken.

share|improve this question
3  
You need additional proof? Having two services.exe processes running, one with a clearly malicious fake name, should be proof enough. Nuke it from orbit. –  Polynomial Dec 12 '12 at 14:47
1  
Yes you're completely correct. The bigger concern I have would probably be the massive amount of intrusion attempts through both VNC and Term Services. This might be less of an OS security issue and more of a "wise the fuck up and build a proper network security" scheme since there is a lot of unencrypted/insecure data for what this machine is responsible for. Thakns. –  TheCapn Dec 12 '12 at 14:58
1  
In which case, what are you actually asking? –  Polynomial Dec 12 '12 at 14:59
    
I suppose I was looking more so for 3rd party confirmation of my suspicions. I'm not very versed in Windows behavior and command line and was second guessing everything before making any assumptions. I'm extremely new to this and didn't want to jump the gun. –  TheCapn Dec 12 '12 at 16:16

1 Answer 1

up vote 4 down vote accepted

Yes, you're likely infected. The services.exe process you mention is highly suspicious, and when you combine that with the intrusion attempt via VNC, it's pretty definitive. Assume all your data has been stolen, nuke it from orbit, start over, then change all of your passwords to everything. They're all compromised.

Next time, use source address whitelisting on your VNC, properly configure your firewall, and preferably set up certificate-based authentication instead of using passwords.

share|improve this answer
    
good advice - also, since it's a Windows box, when it's rebuilt it should be set up to run and update AV and have regular patch updates applied. –  Mark Beadles Dec 12 '12 at 15:21
    
Oh, I'm aware of those safeguards. I'm the "new guy" here and a lot of people have taken a meh attitude to the security demands I expect since I don't really have any official credentials in security. I'll bring things up and hopefully get some changes made. –  TheCapn Dec 12 '12 at 15:23
2  
@TheCapn I guess the silver lining is that this box is a great way to promote better security. –  Polynomial Dec 12 '12 at 15:27
    
Oh it definitely is. I've written up a good ol' report that can go to management. Long story short though, this isn't exactly the type of PC you'd want random people prying with. –  TheCapn Dec 12 '12 at 16:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.