1

Someone appears to be logging into my machine remotely, I am running Avast anti virus with Comodo Firewall both report no attacks.I only noticed this because on my router security logs I see the following.

I have scanned the machine with 6 different anti virus scanners and all report the machine is clean, so it's probably a zero day attack. It happened after I stupidly downloaded a .doc from a torrent. I suspect a Trojan on my machine, is there anyway I can block this attack and find out manually which program is dialing home to the attacker?

Router Logs

Line 4: [LAN access from remote] from 221.163.250.228:3389 to 192.168.1.58:2345, Thursday, March 26,2015 19:59:59
Line 5: [LAN access from remote] from 142.4.215.8:27010 to 192.168.1.58:27015, Thursday, March 26,2015 19:59:34
Line 6: [LAN access from remote] from 188.138.9.50:36877 to 192.168.1.58:2323, Thursday, March 26,2015 19:13:36
Line 26: [LAN access from remote] from 221.163.250.228:3389 to 192.168.1.58:2345, Thursday, March 26,2015 00:15:44
Line 53: [LAN access from remote] from 223.130.239.89:1010 to 192.168.1.58:2345, Wednesday, March 25,2015 01:39:57
Line 76: [LAN access from remote] from 223.130.239.89:1010 to 192.168.1.58:2345, Tuesday, March 24,2015 17:28:28
Line 81: [LAN access from remote] from 103.249.103.31:6003 to 192.168.1.58:2345, Tuesday, March 24,2015 16:01:15
Line 86: [LAN access from remote] from 107.20.201.237:4244 to 192.168.1.58:60615, Tuesday, March 24,2015 11:38:33
  • Have you disabled 'Remote Management' on your router and enabled firewall and other security features? Easy fix would be to do a System Restore on Windows with a restore point from a few days before the attack started. – Joseph Mar 26 '15 at 21:01
  • System restore will only restore the OS files, it doesn't touch user created files, it's not great at dealing with virii. – Ninja2k Mar 27 '15 at 15:00
3

First, the firewall will not identify it as an attack if the traffic is allowed.

Second, in the logs, you can see the port numbers that the communication is destined for. You can correlate those ports with the binaries that are listening to those ports on your machine. Look for the netstat command for your OS and version.

Third, you should configure your firewalls to reject incoming connection requests to that machine (or in general, depending on your needs).

  • Thank you for your help, netstat reported port 27015 as open, but it was just AppleMobileDeviceService.exe I will keep trying, if I can't stop it I will have to rebuild my OS. – Ninja2k Mar 26 '15 at 21:32
  • netstat should show more than that - use the -a switch to see everything? Then correlate with the most recent firewall log (the most recent port used). hopefully, something should show on port 2345. – schroeder Mar 26 '15 at 21:39
  • This is the weird thing it isn't showing up, perhaps it is set to only activate the port at certain times to avoid detection? – Ninja2k Mar 26 '15 at 21:42
2

Every single time I have seen something odd in the firewall logs, it has been completely benign behavior that comes to light after about an hour of total panic ;-)

If your router is not set up to forward those ports and uPnP is not enabled then they must be started by some software on 192.168.1.58. Use netstat -a -n -o to show network activity including the PID, and then a program like Sysinternals Process Explorer to corroborate what that PID is and what it might be doing. If there is a trojan, there will likely be a port or two listening for connections just in case the system is accessible to the outside, in addition to the activity seen where it is apparently phoning home. Then. use Wireshark to listen for the traffic and see if it is identifiable and if there is other suspicious traffic alongside it not being shown in the log.

Worst case, use a Live CD from Bitdefender or similar, to boot the infected system into a completely clean environment and then scan everything on it for known viruses.

If all of this doesn't turn anything up then you are probably looking at an artifact of torrent software or some other app you have running. Given the high value of true 0-day exploits and their targeted nature, you are honestly not likely to have found one in a torrent doc. If you were fully patched up and your virus scanner was up to date when you opened it, you are probably fine.

  • +1 for "Given the high value of true 0-day exploits..." – KnightHawk Mar 30 '15 at 15:04
1

I don't know how you should get rid of the eventual trojan virus, but as a start you should block and disable remote access!

If you have any port forwards there could be a vulnerability then disable those too!

  • Port forwards have been disabled and no remote access is enabled on the client or router. – Ninja2k Mar 27 '15 at 14:59
1

Try getting free help from https://forums.malwarebytes.org/index.php?/forum/7-malware-removal-help/ , they have volunteers there that have you run security tools and post the logs, it is very effective and having read hundreds of cases, you are likely to find a solution there. You'll have to make an account first, but that is also free.

I'd try installing a good firewall and manually setting it to block those specific IP's, and reset all my banking passwords from an uncompromised computer.

0

An update yesterday to Avast Anti virus detected a root kit running on my machine, I removed that and removed all forwarded ports to be on the safe side, the attacks seem to have gone away but I will keep an eye on it, looks like there are some good tips here for potential security threats, thanks everyone for contributing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.