20

I recently received an e-mail from Virgin Media indicating that I might have the Citadel virus. It obviously sounds like a fake e-mail, but I am almost certain it is genuine, as they had my name and account number, and a generic version of the e-mail available on virginmedia.com, here:

http://my.virginmedia.com/customer-news/articles/malware_email.html

I went to the bitdefender website to do the free online scan, and after thirty seconds it told me I was safe, but I wasn't too reassured that it could check my whole drive so quickly.

I don't have any sort of security software, as I am normally quite careful about what I download and what sites I visit, but in the past when I've made mistakes I've been able to find the files installed and uninstall them, but all my searches can't tell me what to look for, and if this is a proper virus rather than just the normal adware it might be more complicated than I thought.

Can anyone recommend what I should do, apparently this virus is quite good at hiding from antiviruses, but if the only way to find out for sure if it's on my machine is to download a clever one and run it in safe mode I will.

Improve this question
4
  • 1
    I believe that windows 8 has it's own inbuilt and free antivirus i.e. windows defender. I find it quite efficient.
    – hrkrshnn
    Sep 8, 2014 at 17:11
  • 5
    Actually pretty commendable of Virgin Media to send you an email and host a generic version on their website to prove its authenticity. Quite nice!
    – Konerak
    Sep 9, 2014 at 4:43
  • 2
    As a general comment, the days of 'watching what you download' has had very little impact on your security since the 90's. It's quite easy to hit a compromised website (or advert on a website) and pick something up without downloading anything at all.
    – James Snell
    Sep 9, 2014 at 8:21
  • @Konerak, it's actually not that unusual as in the recent past people who didn't have images turned on would get broken emails. Typically people would include an image near the top of the email with an alt tag that read something to the effect of "Having trouble viewing? Try clicking here." which would link off to their website in a full browser. If you had images enabled it wouldn't show the message since it'd be a 1x1px image. It's still a fairly common practice, if less needed thanks to more and more email clients using better protections and enabling images by default.
    – Matthew Scharley
    Sep 10, 2014 at 6:10

3 Answers 3

Reset to default
25

If you dont like to install an antivirus you can always use a rescue disk to scan your system.

  • They require no installation
  • They are usually free
  • They can hunt and remove the virus even when it's attached to a system file, something you cant usually do on a live system

Kaspersky Rescue Disk http://support.kaspersky.co.uk/viruses/rescuedisk/

Avira Rescue System http://www.avira.com/en/download/product/avira-rescue-system

Bitdefender Rescue CD http://download.bitdefender.com/rescue_cd/

AVG Rescue CD http://www.avg.com/us-en/avg-rescue-cd-download

Dr. Web LiveDisk http://www.freedrweb.com/livedisk/?lng=en

Improve this answer
3
  • Also worth adding Windows Defender Offline: windows.microsoft.com/en-US/windows/…
    – James Snell
    Sep 9, 2014 at 8:03
  • Also (also) make sure to scan all the machines that use the connection otherwise they may start infecting one another.
    – James Snell
    Sep 9, 2014 at 8:22
  • Thanks, I scanned my system and apparently it's all good. I had some friends round about ten days before I got the alert so I suspect it was one of them on my network and there was just a bit of a delay. I'll let them know.
    – Qiri
    Sep 9, 2014 at 17:47
23

Citadel is a stealthy trojan and not easy to detect. Your ISP detected this based on the fact that the IP assigned to you is making outbound network connections to to IP addresses which are known to host Citadel C&C traffic.

You can verify this on your own by monitoring your outbound traffic to some of the IP's listed below.

Please note I found this list on: http://www.surfright.nl/en/citadel and this list may be outdated. I performed a reverse lookup of the listed domains online.

92.53.97.205, 91.243.115.83, 206.208.115.125, 107.22.60.126

You can verify this by using netstat. Open command prompt and type:

netstat -an 1 | find "92.53.97.205 91.243.115.83 206.208.115.125 107.22.60.126"

This will continuously monitor all traffic from your host to the above listed IP's.

If you see any hits for example "SYN Sent" then it means that your system is infected with this trojan. Your chances of detecting this traffic are purely based on the match against the above listed IP's.

Follow basic guidelines and change all user account password accessed from your host.

Improve this answer
2
  • 10
    Be aware that some sophisticated rootkits (unsure if citadel is one of them) have been known to install patched versions of netstat (see the fyodor nmap book for examples) so it may be worth hashing your copy and checking it against that of a known good build if you choose to go this way. Alternatively use a port sniffer like wireshark on another device or functionality on your router / firewall.
    – Stu W
    Sep 8, 2014 at 9:50
  • 12
    so it may be worth hashing your copy and checking it against that of a known good build if you choose to go this way But then again, they may have installed patched version of hashing tools too...
    – Cthulhu
    Sep 8, 2014 at 13:19
3

Connect to the internet through another computer with 2 NICs (or a router on which you have shell access and can run tcpdump), then run a packet capture (if you're on a computer you can use the graphical Wireshark which is easier to use) and then look for suspicious traffic directed towards the malware's C&C servers.

This method is extremely effective since no rootkit can hide its traffic from the eyes of another non-compromised machine. Not entirely bulletproof either, but good enough against most malware.

Improve this answer
1
  • This is essentially what the ISP has done in this case. It may be worth doing (if you have the hardware) to double check anyway.
    – Chris Murray
    Sep 9, 2014 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .