What steps can I take to identify what type of compromise of my computer has occured

Question

I got involved in a strange scenario today :-) . Some 'UDPAgent.exe' file/worm/virus was trying to access my collegue's system and the antivirum program was showing that this particular thing is coming from my ip though I had no idea aboutt he particular trojan/worm/virus.

Any ideas/guesses/helps in identifying the issue would be highly appreciated?

---

After Rory's reply, my questions would be: 1 - Anyone in the forum had seen such programs/scripts before? 2 - what investigation can I carry out on my computer when I suspect it is compromised?

Thanks Rory!

Answer 1

From your mention of udpagent.exe it sounds like you got hit with a chinese based exploit kit payload, udpagent.exe is a very common tool that is additionally downloaded after the true payload has been run to attempt to compromise more machines on a LAN. I tend to see it most commonly with malware payloads out of china. I agree with the majority of Ormis's suggestions above as Hijackthis is a great tool for determining the locations of the infection and hopefully removal with the guidance of a Forum Mod on the Hijackthis Forums. Though, following my own set of rules when dealing with malware these days i would suggest removing the machine from any network connection, changing all user names and passwords from a clean machine and running DBAN on the box www.dban.org. I deal with hundreds of cases like this daily and more often than not we see VERY persistent executable's, bypassing AV and ex-filtrating all worthwhile data by the time they get removed via AV, Combofix, Hijackthis, specialized rootkit removers and the like. So to sum it up, nuke the drive.

Answer 2

Alright, so I'm not going to outline an entire incident response procedure, but I will give you a place to start.

Download and run this tool. It is basically an in-depth snapshot of running processes on your machine. If you do have something running on your machine, 9.5 chances out of 10 it will come up in the hijackthis report. Now I will also say that if you're new to this type of thing, the resulting report i fairly hard to process, but if you're on other forums talking about this, than they're going to want to see that report.

Also, i recommend that you take a look at the proposed answers to this question which outline some general steps that one can take to mitigate threats. Like the responses there say, the only foolproof way to make sure you're not infected is to start from scratch; Wipe the disk and start over.

One last comment, if you do happen to find out that you have x or y rootkit/malware you can then research for the tool that removes it best. I know there have been a bunch of times where kaspersky rootkit removal tools have saved my rear-end. But I must again caution that if you remove one entity it does not mean that you've solved your problem. When you are able to remove malware you have no way to know if that's the initial attack, the result of a bigger issue, or the only case of malware on the machine.