Hi.

A friend's windows 2000 game server was remotely administered via VNC. Unfortunately, it was an old version, and he hadn't used any encryption on it. So, two days ago, someone broke in and started screwing around with it. Luckily, we were there at the time and noticed within a couple of hours, and disconnected it.

The perp had apparently been using it as a proxy/gateway for a yahoo VoIP service, registering a dozen virtual phone numbers on the service with a probably stolen credit card number and making a number of short calls to numbers in the US. When we kicked him off, the yahoo windows were still open and logged in, so we were able to save out a load of info on what accouts were opened and when, the phone numbers, the numbers called, the email address, and so on. I also saved the history of the command line buffer, which had some IP addresses of interest as well.

All this information will be passed on to Yahoo's abuse department, so they can ignore it/deal with it, depending on their whim.

Anyway, having deleted everything we could find that he had installed (an IRC trojan seemed to be most of it, in addition to the VoIP app), we removed and reinstalled all the virus checkers, rootkit detectors, spyware removers, and so on. The machine was thoroughly sanitised, and is now running UltraVNC with RC4 encryption tunneled over SSH with different encryption. It should be fairly difficult to compromise it again, I hope.

However, there is a process that keeps popping up in the task manager, named vjvl.exe. Neither of us can think of anything legitimate it could be, and google draws a blank. I'm going to hunt it down and kill it, but does anyone know what it is?

pca

I'd reinstall from scratch. You can never be 100% sure that everything was cleaned out without going through every file. If you're doing that then you might as well reinstall as it'll be quicker.

Looks like the rootkit downloaded/installed something with a random file name to make it harder to identify. Anything of interest actually inside the file?

We had thought this would be necessary but wanted to avoid the pain in the arse job it will be. However, you're both right, annoyingly The server has been dropped off with me, and at some point in the next week or so I get to reinstall 150GB of OS and apps. Hooray. Yippee. And so on...

On the upside, it's going to end up with a terabye of hard drives to future proof it. It's already got a striped array of 10K RPM ultrawide SCSI drives which will have the OS installed on, so it should go rather faster. The data will be on the SATA drives.

Dual 2.8GHz Xeon processors in a nice server motherboard, slightly overkill for running half a dozen different dedicated game servers with a total of about 6 users, but none of us like to wait

pca

Firstly, I agree with what has been proposed and agreed here already as the best course of remedial action....

Quote:
vjvl.exe. Neither of us can think of anything legitimate it could be, and google draws a blank. I'm going to hunt it down and kill it, but does anyone know what it is?

You might gain some insight into what that .exe is by attempting to copy it to other systems to see what their AV/malware scanners report (if anything).

So where was it running from?

User it's running under?

It's not changing it's name I guess from your description but possibly generated that random name itself when it installed to prevent identification. That's certainly not rare or new...

These two online scanners are pretty comprehensive:

http://virusscan.jotti.org/
http://www.virustotal.com/