Virus alert about the Win32/Conficker.B worm

[Kelly]

If your computer is infected with this worm, you may not experience any
symptoms, or you may experience any of the following symptoms:
http://support.microsoft.com/kb/962007


Run the Malicious Software Removal tool:

You can download the MSRT from either of the following Microsoft Web sites:
http://www.update.microsoft.com (http://www.update.microsoft.com)
http://support.microsoft.com/kb/890830
(http://support.microsoft.com/kb/890830)


--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

 

[PA Bear [MS MVP]]

More about this here: http://aumha.net/viewtopic.php?f=48&t=37919

 

[C]

I have been experiencing some really weird things on my PC for about the
last 3 weeks. It started with my McAfee virus software being disabled
sporadically. Initially, all I had to do was simply click the "Fix it"
button in my McAfee Security Center screen and the features that were
disabled would be enabled again. Gradually, I started noticing that my
PC's performance was degrading and about 2 weeks ago, it got to the
point that even starting up windows xp would take over 5 minutes to
completely start up! The PC also started hanging and on numerous
occasions, I would have to manually turn it off and back on. This is
when I began to suspect "foul play". I began troubleshooting by
checking event logs, running tasks, etc., and noticed that many tasks
were being duplicated many times over and suspect that this was why my
pc was running so slow. I downloaded some microsoft updates and when I
tried installing them, the installations would fail. At this point, my
McAfee software is disabled and cannot be enabled. Trying to start the
services manually results in them being automatically disabled
immediately.

I tried running the microsoft safety scan online and it also fails.
I've also gotten error messages stating that failed installations were
due to "policy changes by the system administrator that prevent the
installation". Whether in SAFE mode or Normal mode, the results are the
same - I cannot install any software that is intended for finding
viruses and removing them! I can install other types of software but
nothing that deals with either applying windows updates or scanning for
viruses.

So this is where I stand at the current time: I can't install any
virus tools or windows updates, my PC is running dismally slow and some
of my existing installed software won't run (I get errors like "Cannot
run this program at this time", etc.).

Since I can't install any tool to detect and remove any viruses, I'm
thinking that the only available option is to MANUALLY find and remove
any/all files, processes, registry entries, etc., that may pertain to
the issue(s) I'm experiencing. The problem is that I don't know what to
look for or where to look!

Can anyone in this forum provide me with info/guidance on what and
where I should look and what actions I need to take? Any help will be
greatly appreciated!

Format your hard drive. Reinstall Windows. It will be quicker and you'll
know everything is gone. DON'T reinstall McAfee. Use Avast or Microsoft
Security Essentials.

I trust you already have vital data backed up.

 

[Paul]

I have been experiencing some really weird things on my PC for about the
last 3 weeks. It started with my McAfee virus software being disabled
sporadically. Initially, all I had to do was simply click the "Fix it"
button in my McAfee Security Center screen and the features that were
disabled would be enabled again. Gradually, I started noticing that my
PC's performance was degrading and about 2 weeks ago, it got to the
point that even starting up windows xp would take over 5 minutes to
completely start up! The PC also started hanging and on numerous
occasions, I would have to manually turn it off and back on. This is
when I began to suspect "foul play". I began troubleshooting by
checking event logs, running tasks, etc., and noticed that many tasks
were being duplicated many times over and suspect that this was why my
pc was running so slow. I downloaded some microsoft updates and when I
tried installing them, the installations would fail. At this point, my
McAfee software is disabled and cannot be enabled. Trying to start the
services manually results in them being automatically disabled
immediately.

I tried running the microsoft safety scan online and it also fails.
I've also gotten error messages stating that failed installations were
due to "policy changes by the system administrator that prevent the
installation". Whether in SAFE mode or Normal mode, the results are the
same - I cannot install any software that is intended for finding
viruses and removing them! I can install other types of software but
nothing that deals with either applying windows updates or scanning for
viruses.

So this is where I stand at the current time: I can't install any
virus tools or windows updates, my PC is running dismally slow and some
of my existing installed software won't run (I get errors like "Cannot
run this program at this time", etc.).

Since I can't install any tool to detect and remove any viruses, I'm
thinking that the only available option is to MANUALLY find and remove
any/all files, processes, registry entries, etc., that may pertain to
the issue(s) I'm experiencing. The problem is that I don't know what to
look for or where to look!

Can anyone in this forum provide me with info/guidance on what and
where I should look and what actions I need to take? Any help will be
greatly appreciated!

Purely for your amusement, burn this CD on another computer. This
is a virus scanner that runs outside Windows, and it doesn't care of
you even *have* a registry.

http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk/

23 Jun 2009 10:05:01 119,701,504 bytes kav_rescue_2008.iso

That is an ISO9660 file. Use a program that knows how to convert an
ISO into a bootable CD. (You don't just "copy" the file to the CD,
the burner program has to know how to parse the ISO.) I use Nero
for that, but there are also free burner programs that can do it.
Wikipedia has a list of free burner programs.

When you boot the infected PC with that CD, the OS on the CD uses
DHCP for networking. For example, my ADSL modem and router have DHCP
capability, automatically giving an IP address, DNS addresses and the
like, to a connected computer. Your networking setup must support
automatic connection to the Internet, so that the program can get its
virus updates. You can see from the date of the CD, that the CD is not
updated daily. The very first step the program carries out, is contacting
Kaspersky to get updates. If it cannot set up the network interface
on the computer, that step may fail. And that would reduce your fun
measurably. (Without updates, it may miss stuff.)

The AV scanner interface has "drive letters". They might show C:, D:,
and so on. Those are *not* the drive letters you would normally be
using on the PC. They're a simple enumeration alphabetically of the
visible partitions. The program can access FAT32 or NTFS partitions,
so that isn't a problem. For example, on one machine I scanned here,
my Windows C: drive was "F:" in the program interface. You can open
a terminal window in that environment, and cd to the disk in question
and use "ls" to list the contents at the top level. That is how
I figured out the partition label scheme.

Depending on the amount of data on the computer, you have the option
of ticking all the partition boxes, so every partition gets scanned.
That eliminates the need to figure out the lettering.

The program will pop up a window when a virus is detected. For example,
I placed a copy of EICAR on the C: drive, and the program found it. I
didn't test though, what happens to quarantined files. Some AV scanners
of this type, move the file to system memory, and you can lose all the
quarantine files when the computer is rebooted. For a first scan,
it may suffice to simply take note of the malware it detects by name.
Or perhaps to store a copy of the virus report on a floppy.

The program gives itself write access to all partitions. It will even
use the pagefile, as swap for Linux (so make sure you properly shut
down WinXP before running it - don't hibernate WinXP and run the scan).
If you know a bit of Linux, you could also attempt other things while
in there. But for the moment, I recommend this tool just for a quick
evaluation. As the other poster "C" suggests, there may be enough malware
on there, to just reinstall Windows. It all depends on how much time you
have to spend, and whether you can find a good malware buster private web
forum, to go through the necessary steps for cleanup.

I think there may be a BitDefender CD, that works along the same lines.

Good luck,
Paul

 

[John Doue]

Purely for your amusement, burn this CD on another computer. This
is a virus scanner that runs outside Windows, and it doesn't care of
you even *have* a registry.

http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk/

23 Jun 2009 10:05:01 119,701,504 bytes kav_rescue_2008.iso

That is an ISO9660 file. Use a program that knows how to convert an
ISO into a bootable CD. (You don't just "copy" the file to the CD,
the burner program has to know how to parse the ISO.) I use Nero
for that, but there are also free burner programs that can do it.
Wikipedia has a list of free burner programs.

When you boot the infected PC with that CD, the OS on the CD uses
DHCP for networking. For example, my ADSL modem and router have DHCP
capability, automatically giving an IP address, DNS addresses and the
like, to a connected computer. Your networking setup must support
automatic connection to the Internet, so that the program can get its
virus updates. You can see from the date of the CD, that the CD is not
updated daily. The very first step the program carries out, is contacting
Kaspersky to get updates. If it cannot set up the network interface
on the computer, that step may fail. And that would reduce your fun
measurably. (Without updates, it may miss stuff.)

The AV scanner interface has "drive letters". They might show C:, D:,
and so on. Those are *not* the drive letters you would normally be
using on the PC. They're a simple enumeration alphabetically of the
visible partitions. The program can access FAT32 or NTFS partitions,
so that isn't a problem. For example, on one machine I scanned here,
my Windows C: drive was "F:" in the program interface. You can open
a terminal window in that environment, and cd to the disk in question
and use "ls" to list the contents at the top level. That is how
I figured out the partition label scheme.

Depending on the amount of data on the computer, you have the option
of ticking all the partition boxes, so every partition gets scanned.
That eliminates the need to figure out the lettering.

The program will pop up a window when a virus is detected. For example,
I placed a copy of EICAR on the C: drive, and the program found it. I
didn't test though, what happens to quarantined files. Some AV scanners
of this type, move the file to system memory, and you can lose all the
quarantine files when the computer is rebooted. For a first scan,
it may suffice to simply take note of the malware it detects by name.
Or perhaps to store a copy of the virus report on a floppy.

The program gives itself write access to all partitions. It will even
use the pagefile, as swap for Linux (so make sure you properly shut
down WinXP before running it - don't hibernate WinXP and run the scan).
If you know a bit of Linux, you could also attempt other things while
in there. But for the moment, I recommend this tool just for a quick
evaluation. As the other poster "C" suggests, there may be enough malware
on there, to just reinstall Windows. It all depends on how much time you
have to spend, and whether you can find a good malware buster private web
forum, to go through the necessary steps for cleanup.

I think there may be a BitDefender CD, that works along the same lines.

Good luck,
Paul

Thanks for this advice. I hope I will never need to make good use of it
but one never knows ...

Formatting and reinstalling is the solution of *last resort*, when
everything else has failed and when one has a good backup of important data!

 

[PA Bear [MS MVP]]

To avoid confusion, please begin a new thread about your specific problems
instead of hijacking someone else's thread. State your IE version and full
Windows version (e.g., WinXP SP3; Vista SP1; Vista 64-bit SP2; Win7; Win7
64-bit) in your first post.