Hi all,
I have had the same problem with the :
Mwvsta.exe found in c:\windows\system32
and
Ponoas.exe c:\windows\system32
although
rundll16.exe c:\windows\system23 was not present in my PC, obviously
rundll32.exe is there anyway (it may serve the same purpose, probably).
I observed the Mwvsta.exe running through my "task manager" and it was
constantly acting, even after a new reboot it was launched again. I spotted the
file name in the registry in :
HKCU/Software/Microsoft/Windows/CurrentVersion/Run
Which is obviously launched at boot time.
I succeded to kill it by blocking the access of Mwvsta.exe with a firewall tool
(in fact: McAffee) and then deleting the registry key and rebooting afterwards.
After I erased that key from the registry the previous constant outgoing FTP
flow, through port 139 (as you mentioned), to lots of different IPs was
finished (in my opinion it may be a "spamming" program or something similar).
Before that, I also received a constant flow of information and that is all I
observed before starting my attack against it.
As additional information I attach this proof of evidence which I have obtained
after deleting that Mwvsta.exe.
It seems it is still trying to continue with its activitu althoug it cannot
enter now.
Firewall Log Table (copied form my Linksys router)... just a small part of it,
it was going mad constantly...
NO. Time Packet Information Reason Action
001 Jun 0806 21:01:23 From:205.177.79.126:1901 To: my IP TCP default permit
<2,00> block
003 Jun 0806 21:01:26 From:205.177.79.126:1901 To: my IP TCP default permit
<2,00> block
005 Jun 0806 21:01:28 From:81.177.37.67:51502 To: my IP TCP default permit
<2,00> block
007 Jun 0806 21:01:32 From:205.177.79.126:1901 To: my IP TCP default
permit <2,00> block
008 Jun 0806 21:01:37 From:81.177.37.68:49969 To: my IP TCP default permit
<2,00> block
009 Jun 0806 21:01:41 From:67.159.22.107:4878 To: my IP TCP default permit
<2,00> block
010 Jun 0806 21:01:46 From:81.177.37.68:49969 To: my IP TCP default permit
<2,00> block
011 Jun 0806 21:01:48 From:81.177.37.67:53683 To: my IP TCP default permit
<2,00> block
012 Jun 0806 21:01:50 From:67.159.22.107:4878 To: my IP TCP default permit
<2,00> block
013 Jun 0806 21:01:51 From:81.177.37.67:53683 To: my IP TCP default permit
<2,00> block
014 Jun 0806 21:01:51 From:66.185.126.84:4115 To: my IP TCP default permit
<2,00> block
...end of my story...
...hope it helps finding that PHANTOM ATTACK.
If I get it again I will be more cautious and study it carefully before
deleting it.
Kind regards to all for your hints.
David
------------------------------------------------------------------------------
This List Sponsored by: Black Hat
Attend the Black Hat Briefings & Training USA, July 29. August 3 in Las Vegas.
World renowned security experts reveal tomorrow.s threats today. Free of
vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference
tracks, networking opportunities with over 2,500 delegates from 40+ nations.
http://www.blackhat.com
------------------------------------------------------------------------------
