Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Dec 1st, 2008, 7:57pm
   Mischel Internet Security Forum
   Malware
   Trojans (Moderators: Helena, Gavin_Coe, Magnus)
   Can anyone help me identify a possible Trojan?		 « Previous topic | Next topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: Can anyone help me identify a possible Trojan?  (Read 932 times)
John J. Smith
 Guest

Email
Can anyone help me identify a possible Trojan?
« on: Aug 31st, 2003, 10:38am »		 Quote Quote  Modify Modify   Remove Remove
Last night while browsing the internet, I got a windows message that an application named "mads.exe" had performed an illegal operation and would be terminated.  Not know what that exe was, I searched for it and saw it was created on my hard disk only a minute or so earlier.  In the root of my C: drive.
 
Further investigation located two html files in my browser cache that were stamped with the very same minute and were clearly related.  One was javascript that loaded the other, and that second one ran a .jar file.  I'm not even sure what that is.  It also used the "BlackBox.class" which searches seemed to indicate was a library used in the creation of Trojans.
 
So I ran my McAfee virus scan after updating the definitions file and then did the same for TrojanHunter.  Niether one found anything out of the ordinary, but clearly someone did at least TRY to install something covertly on my PC.
 
If I could identify what Trojan this is, I might be able to do some specific checks to make sure it's not running at the moment.  I have the html documents and the mads.exe file still if that would help anyone determine which Trojan this is or what it was trying to do.
 
Forgive me if I'm asking a common question also.  I am very new to this, so I may have just missed something obvious.
 
Is there anyone that could maybe give some assistance and perhaps provide me with some peace of mind?
 
Thanks in advance.
 
John
IP Logged
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #1 on: Aug 31st, 2003, 3:34pm »		 Quote Quote  Modify Modify
Best get a firewall set to block the app, whatever.
 
I found this reference for mads.exe:-
http://mads.pge.com/
which describes a HTTP file grabber, or data metering service (http://mads.pge.com/MADS-UM.htm).
 
They refer to compounded names from mads.exe, but my strong guess is they're akin. The application may have legitimate uses - check https://mads.pge.com/m/Nph-mads.exe? for a long list of authorised collectors (?) of data - you might be a customer of one of these, or have visted their site.
 
Blackbox.class can be used as a remote mouse tracker. It also appears in various forms as malware.
 
Here's a quote fromhttp://www.nickles.de/static_cache/537475650.html, a German language forum. The reply is not a very good translation (BabelFish, I'm afraid Grin), but is in response to a similar 'find' to yours: Quote:
Those are Java applet, which try, to use various safety gaps in the Java VM. Since however even each Hinterwaeldler has ' ne sufficient current JVM, in which this error does not arise any longer, can it you and also the AV program be actually all the same. P.S.: One finds regularly with the attendance from XXX sides.
That last line makes me think the application may have been used to monitor/grab information and selections on your PC.
 
If you still have them all, zip them together and mail them to Magnus at submit@trojanhunter.com. I reckon vampirefo1 will also be interested and may also ask you for a look.
IP Logged
... but crap arrives pretty much straight away.
John J. Smith
 Guest

Email
Re: Can anyone help me identify a possible Trojan?
« Reply #2 on: Aug 31st, 2003, 6:56pm »		 Quote Quote  Modify Modify   Remove Remove
Well, I tried to zip it all up and send it to Magnus as you requested, but my mail was rejected with a "Sender address rejected" message.   Sad
 
Thank you for your response, Ian.  I don't think this has anything to do with the first reference you found to mads.  It is much more likely the second, as the javascript did check the version of the Java VM before trying to run.  And yes, mine was out of date, so I must have had the exploitable flaw.
 
I wish there was some way to see what this executable was trying to do so I could reverse each step or at least know what happened.  Is such a thing even possible?
 
Also, how do I know if it's running right now?  As I said, my virus scan and trojanhunter came up clean.  It's scary to think that it's running and someone has access to my file system.  I have no idea to tell whether or not that is happening though.
 
Well, if anyone at all can help me with this, I would veyr much appreciate it.
 
John
 
IP Logged
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #3 on: Sep 2nd, 2003, 6:52pm »		 Quote Quote  Modify Modify
Progress of sorts, then!
 
The address thing is as quoted on the TH contacts page (http://www.misec.net/contact/) so the problem lies elsewhere...
 
To see if something is currently running, the easiest way is to hit CTRL-ALT-DEL to bring up the Task Manager - in Win98 this is done straight away as the keys are pressed, but be careful not to press them twice... Look for the process name in the list of programs shown. Now, there are some programs that hide form this, or run under the cover of other stuff (such as IE), in which case, this isn't going to show.  
 
This page http://www.teamcti.com/pview/prcview.htm lets you download a more comprehensive process viewer. This page http://www.liutilities.com/products/wintaskspro/whitepapers/paper8/ explains things a little better, but links to a commercial program that can give greater insight.
 
Stopping the process running: Hmm... At the very least, a firewall should protect any 'network-aware' util from trying to access the Interent etc. Good ones to try are ZoneAlarm, Sygate and Agnitum Outpost. IMO Sygate checks system processes a little tighter than Zonealarm, so go for the free one and see all those 'shouts' made by the mouse driver, Explorer and other 'background' stuff. If/when mads or whatever pops up, just deny it access and also server rights and the hole should be plugged.
 
If nothing else uses it, you could disable JavaScript (using the Security and Options pages in IE Properties). Full Java can be left enabled if you like, but javascript is definitely a common thing in virus writers' toolkits.
IP Logged
... but crap arrives pretty much straight away.
John J. Smith
 Guest

Email
Re: Can anyone help me identify a possible Trojan?
« Reply #4 on: Sep 2nd, 2003, 9:40pm »		 Quote Quote  Modify Modify   Remove Remove
I don't think that mads.exe is the actual Trojan.  I have never seen this run other than the one time it was created.  It's a small exe (44K) and I immediately renamed it.  It didn't appear to exist anywhere else on my system and it's not set to automatically run anywhere that I can see.  My belief is that is was the delivery system only and was meant to run only once.  The fact that it executed an illegal operation gives me hope that perhaps it was not able to do it's job.
 
I use Win98.  Looking in the App Log directory under Windows, I saw the log left when this exe ran.  It's very short, but I really don't know how to read it.  I do see that it appears to have done something to win.ini (I think), but I see no changes to that file and the modify date is a fair amount of time ago.  In particular I looked to see if it added anything to the "run=" line, but it's still as blank as it ever was.  It doesn't look like it did anything, but perhaps all it wanted to do was read it.
 
So what did this mads.exe intend to do?  It could have read system information and sent it somewhere else, or perhaps it could have hidden some file elsewhere on my system.  That's what I'm most worried about; that there is some file that will allow remote access to my computer or even gather and transmit information whenever it feels like it.  What I would most like to know it what this exe did or intended to do.
 
I am not sure, but I wonder if it overwrote or replaced a system file, or copied a new file to some location on my pc, would it show up in this app log file?  Because the only files that appear to be listed there are itself (mads.exe) and win.ini.  Since my virus scan (McAfee Online) and TH both came up empty (and continue to) I feel somewhat good about my system still being free, but mads could have done some damage that still remains hidden as it DID have the chance to run.
 
I use a dial up, so it can't do any harm if I don't log in, but I sort of want to be able to log in and use my pc the way I used to.  I need to connect at some point as that's sort of the machine's sole purpose.
 
I even tried opening the exe in notepad to see if I could pick out any plain text file names or something, but all I could find was what turned out to be a reference to a exe compression tool that must have been run on mads.exe.
 
It would be cool if someone could tell me "Hey, mads.exe hides a file in windows/system and it's called this", that way I could go and delete it, but is it even possible to get this sort of information from the exe itself?  Or should I just set up the firewall and let my computer back online?  It sounds like that's not a bad idea really, but it would be nice to know what MIGHT have happened.
 
Thanks for you interest, Ian.
 
John
IP Logged
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #5 on: Sep 2nd, 2003, 10:02pm »		 Quote Quote  Modify Modify
No trouble - it's something of interest to me since I'm also on Win98, plus the question of tracking and deciphering logfiles is a problem many users face (not just with MS stuff - there's a ready market for tools that make firewall logs more intelligible, for example).
 
I found this explanation of applog and some examples to help understand it's contents:- http://www.winforums.org/viewthread.php?tid=1050.
 
As for actually seeing inside all those .lgc, .lgd, etc files, just open Word, close down any active document (otherwise it thinks you're linking to another file rather than wanting to open it) and then drag and drop the applog file relating to this incident onto the waiting Word workspace. Word shows that these files are full of coded references, as this example from my msaccess.lge file Quote:
{
o d6d19100 43 "E:\TEMPOR~1\DESKTOP.INI"
R d6d19100 0 43
C d6d19100
o d6d19100 43 "E:\TEMPOR~1\DESKTOP.INI"
R d6d19100 0 43
C d6d19100
}

 
Since it's just plain text with a funny file extension, I'm sure there'll be a viewer/decoder out there - back in a moment!
IP Logged
... but crap arrives pretty much straight away.
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #6 on: Sep 2nd, 2003, 10:12pm »		 Quote Quote  Modify Modify
Hmmm. Not so easy to find a decoder of those applog files. However, since applog is mainly used by the TaskMonitor, it may not hold too much information about what mads.exe did. Here's a snippet:- Quote:
The Task Monitor tool that is included with Windows 98 and Windows ME records the disk-access patterns of programs when they are started. Task Monitor stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster.

If you can drop its applog file into Word or Notepad, quote it here - I've seen a pattern in that the logfile always refers to disk access - it may list filenames if it created or altered anything (usually, the top-most entry is the file an app was working with, and any references lower down seem to refer to files that had been altered during the course of the app running).
IP Logged
... but crap arrives pretty much straight away.
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #7 on: Sep 2nd, 2003, 10:17pm »		 Quote Quote  Modify Modify
As for decoding .exe files, you need frhed - http://www.kibria.de/frhed.html - the download links are about 2/3 down the page.
 
This is an excellent hex editor, so it can take the binary .exe code and make more sense of them than notepad. In my experience, a program declares any dependancies at the beginning of the code and puts any personalised messages etc at the end.
IP Logged
... but crap arrives pretty much straight away.
Jamming
Stole All the Forum Stars
********




Remember when a Trojan was just for protection.

   


Gender: male
 Posts: 2039
Re: Can anyone help me identify a possible Trojan?
« Reply #8 on: Sep 3rd, 2003, 4:46am »		 Quote Quote  Modify Modify
Fhred is just great I have used it several times since I got it from you.
IP Logged
Team Z Member

Servare cives, major est virtus patriae patri.
- Lucius Annaeus Seneca
I was born an American; I live an American; I shall die an American!
- Daniel Webster
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #9 on: Sep 5th, 2003, 10:42am »		 Quote Quote  Modify Modify
Absolutely - it's now going down the GPL route and is available in 1.1beta (I still use 1.0.156 mostly). There's a rumour of a vastly improved version 2 some time this year...
IP Logged
... but crap arrives pretty much straight away.
BackdoorKid
 Guest

Email
Re: Can anyone help me identify a possible Trojan?
« Reply #10 on: Oct 9th, 2003, 10:21am »		 Quote Quote  Modify Modify   Remove Remove
Do you have the EXE still ? 44k is plenty big enough, send me a copy to backdoorkid@yahoo.com and the class file(s) too
IP Logged
Jamming
Stole All the Forum Stars
********




Remember when a Trojan was just for protection.

   


Gender: male
 Posts: 2039
Re: Can anyone help me identify a possible Trojan?
« Reply #11 on: Oct 10th, 2003, 9:32am »		 Quote Quote  Modify Modify
Like someone from an anti-trojan forum is going to send a possible trojan executible to an unregisted user named backdoorkid. Grin
IP Logged
Team Z Member

Servare cives, major est virtus patriae patri.
- Lucius Annaeus Seneca
I was born an American; I live an American; I shall die an American!
- Daniel Webster
MadAxe
Senior Member
****





   


Gender: male
 Posts: 319
Re: Can anyone help me identify a possible Trojan?
« Reply #12 on: Oct 10th, 2003, 1:31pm »		 Quote Quote  Modify Modify
Scary  Wink
IP Logged
Ian
Stole All the Forum Stars
********



Good things come to those who wait ...

   


Posts: 2913
Re: Can anyone help me identify a possible Trojan?
« Reply #13 on: Oct 10th, 2003, 7:46pm »		 Quote Quote  Modify Modify
on Oct 9th, 2003, 10:21am, BackdoorKid wrote:
Do you have the EXE still ? 44k is plenty big enough, send me a copy to backdoorkid@yahoo.com and the class file(s) too

Let's hope those class files aren't all the size of VBRUNxxx.dll... might be a tad bigger than 44KB  Grin  
 
Problem with an unregistered user trying to get in touch with another unreg'ed is that they've both got to lurk to spot the post. Maybe both could register, then drop requests by IM?
 
The BDK's not hard to find elsewhere on other Trojan forums and such, spotted on > http://www.rohitab.com/discuss/ and > http://www.sotmesc.org/. He's a member at Trojan Information Center (now closed, but was at http://azzazzin.no-ip.org/tic/).
IP Logged
... but crap arrives pretty much straight away.
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register