Interworking with "intruders": Get to know NetBEUI under XP

During the two days of the holiday, my friend said that his computer was abnormal, as if he had been intruded. Because the holiday was originally less time-consuming, we rushed to a friend's house. We saw that WinXP PRO, SP2, Skynet, and Norton were the latest versions, and the security was quite strong. Okay. Check it step by step:
1. Check the logs of the local machine first. There are no suspicious system users, groups, management logon and other information. (Intruders generally do not leave useful logs for you)

2. NETSTAT. Check whether the port is working properly.

3. Check the enabled service and check that your friend's IPSEC security policy is enabled. In addition, you have some computer knowledge and configured an IP Security Policy. Now, the Remote Access Auto Connection Manager and Remote Access Connection Manager Services have been started. We all know that this service is used to establish a remote network connection when a program references a remote DNS or NETBIOS name or address, but this service is also enabled normally, no usable port is accessible, and a friend's 135,137,138,139,445 port is disabled.

4. check IPC $. A friend's IPC $ is enabled, which is dangerous. However, when I think of firewall and IP security policies, the possibility of connection is almost zero.

As an individual using a PC, the security of a friend is good. When I was about to look down, I saw a NB next to it. My friend said that the company's NB and I took it back to COPY the information. After reading NB, I installed 98 due to configuration problems, so I remembered the connection between 98 and XP. My friend estimated that the NETBEUI protocol was installed, So I continued to check.

The NETBIOS protocol has been installed and no NETBEUI has been installed. However, my friend said that the NETBIOS protocol has been installed but is uninstalled.

The NETBEUI protocol is actually a local extension of NETBIOS for intercommunication between different computer networks. However, I remember that the unmount of NETBEUI protocol is not so simple as it is removed from the Protocol group, as a result, we found some questionable points.

Check the log again and find the following suspicious points:

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7000

Date: 3/26/2005

Time: 9:54:24 AM

User: N/

Computer: KK

Description:

The NetBEUI Protocol service failed to start due to the following error:

The system cannot find the file specified.

The original protocol is still in the system. This is the startup failure information.

Check the Registry immediately:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNbf

The NETBEUI information is displayed. The system's NETBEUI has not been deleted.

We know that the system password verification is based on the sent length data. When sending a password authentication packet, you can set the length field to "1" and send a byte plaintext password, the verification program compares the sent password with the first byte of the Saved Password in plain text. If the match is found to have passed the verification. Especially for the NETBIOS protocol, the vulnerability is very high.

Check your friend's Internet connection. The NETBIOS on the TCP/IP is not disabled (Figure 6). At this time, you can find the root cause of the problem.

Scan software? In fact, you don't need to use the system port to listen. During the port listening process, it was found that port 7777 was being monitored (because the time was a bit long, my friend shouted during the sorting process and forgot to capture the picture). This was a bit abnormal, So I immediately watched the process, but there is no exception, and it is getting strange.

Therefore, TCPDUMP is used to capture packets and tcpdump: listening on 7777 is displayed. The port is occupied. It seems to be a background process. Therefore, TCP Connect () is used for scanning. Because the port is in the listening state, Connect () is successful. A large number of error messages are displayed. After a while, the system's LOGS file displays a series of connection error messages and then closes the service. (Connected in non-linear mode) at this time, it is not necessary to continue scanning tcp syn and tcp fin.

Then, return to the Registry and delete the NETBEUI protocol information, REBOOT, and connect. Everything works normally.

Looking back, the process was actually due to incorrect and unexpected handling of the NETBEUI Protocol by a friend, resulting in a conflict between the NETBEUI protocol and the NETBIOS protocol. In the past, a friend's machine had been infected with the YAI worm. Although the virus was successfully eliminated, the system's error settings remain unchanged.

TCP 7777 = NetSpy (YAI), the virus uses port 7777 of the system. At that time, NETBEUI was enabled. Although the Protocol disappears from the Protocol group, the Registry and configuration information were still in progress, therefore, when there is a TCP data connection, the system naturally enables port 7777 to find the data stream of the NETBEUI protocol, thus generating an error log.

In this way, my friend's problem has been solved, and the fear of "intruders" has been dispelled. It turns out that this small agreement is playing tricks. Haha, we are also confused about this "intruder.