Curse

Akuma · Jan 24, 2009, 08:38 PM // 20:38

should i get rid of my shared folders

Abedeus · Jan 25, 2009, 08:32 AM // 08:32

No?

Just scan your PC with a good antivir.

And for me, just to be on a safe side, I downloaded that remover and it has found nothing.

Nothing in registry, too.

Shadowfox1125 · Jan 26, 2009, 06:51 AM // 06:51

I'm scanning at the moment, but looking into my registry, I found:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Netman\Parameters\"ServiceDll"

It's not the \netsvcs\Parameters\"ServiceDll" but looks like I'll be downloading the remover just in case.

Snograt · Jan 26, 2009, 08:48 AM // 08:48

That's the key for the Network Connections service and is therefore safe.

And shouldn't be deleted

Lord Sojar · Jan 26, 2009, 10:08 PM // 22:08

Bad news guys and girls. The virus Conficker.B (the network virulent strain with USB autoplay infection) has some additional removal steps. You need to check out this article for exact methods to remove it. I am adding it to the opening post as well.

http://support.microsoft.com/kb/962007

^ Double check registry as they instruct.

Also, current infection rates are in. Estimates are 15 million PCs on the most conservative estimates, 25 million on the most liberal. That said, it is safe to assume 19-21M PCs are current infected with Conficker. That accounts for 1 in every 10-11 PCs.

Tarun · Jan 27, 2009, 12:53 AM // 00:53

More notes on Conficker:
http://www.microsoft.com/security/po...32%2fConficker

Mister Me · Jan 28, 2009, 08:03 PM // 20:03

How/where can you update your "Windows Install"? I really don't know what that is...

My Antivirus is fine, still auto-updates. Now I'm doing one of those full deep scans.
My anti-virus is NOD32, I know that you normally have to pay for it, but I've the trial version, normally that's the same, just for free for a certain amount of days.

<font color="FireBrick"><strong>Moderator Edit: </font></strong> References to illegal software have been removed. We don't discuss that in the Tech Corner. Thanks!

Wynthyst · Jan 28, 2009, 09:50 PM // 21:50

Quote:

Originally Posted by Mister Me

My Antivirus is fine, still auto-updates. Now I'm doing one of those full deep scans.
My anti-virus is NOD32, I know that you normally have to pay for it, but I've the trial version, normally that's the same, just for free for a certain amount of days. Removed reference to illegal software.

We don't promote or recommend hacking any software. Hacked software is very likely not to work at 100%, and this should be kept in mind especially when dealing with the security of your system and network. I would recommend that you either purchase a legitimate subscription, or use one of the valid free anti-virus software packages that are available.

Snograt · Jan 28, 2009, 10:07 PM // 22:07

Quote:

Originally Posted by Mister Me

How/where can you update your "Windows Install"? I really don't know what that is...

That means run Windows Update. If you don't know how to do that, the quickest way to explain it is to direct you to http://update.microsoft.com/microsof...6/default.aspx

And lose that pirated NOD32 - seriously.

MisterB · Jan 28, 2009, 10:50 PM // 22:50

Quote:

Originally Posted by Mister Me

My Antivirus is fine, still auto-updates. Now I'm doing one of those full deep scans.
My anti-virus is NOD32, I know that you normally have to pay for it, but I've the trial version, normally that's the same, just for free for a certain amount of days. Removed reference to illegal software.

Avira AntiVir Personal is free, uses minimal resources, has regular updates, and it has proven to have a consistent high detection rate. Removed reference to software manipulation.

TheGuildWarsPenguin · Jan 29, 2009, 05:41 AM // 05:41

Can I assume that I don't have the worm if I can access the security websites the worm blocks?

Lord Sojar · Jan 29, 2009, 06:19 AM // 06:19

Quote:

Originally Posted by TheGuildWarsPenguin

Can I assume that I don't have the worm if I can access the security websites the worm blocks?

No, you can never make assumptions regarding your online security. If after checking the registry as indicated in the link from Microsoft, being able to access F-Secure's site, and running a full deep anti virus scan of ALL your drives, then you can be sure you don't have it.

Mister Me · Jan 29, 2009, 11:44 PM // 23:44

Quote:

Originally Posted by Snograt

That means run Windows Update. If you don't know how to do that, the quickest way to explain it is to direct you to http://update.microsoft.com/microsof...6/default.aspx

And lose that pirated NOD32 - seriously.

I'm sorry about the illegal thingy, won't talk about it's details again on this forum.
Thank you for the link!
And I'll think about changing my virus-scanner.(came from AVG Free, so this was sooo much better, I didn't like AVG Free, cause it's pop ups were terrible -.-)

viper11025 · Jan 30, 2009, 12:13 AM // 00:13

Um, no one read my post then, yeah I tihnk I had the virus....

Mister Me · Jan 30, 2009, 04:02 PM // 16:02

Quote:

Originally Posted by MisterB

Avira AntiVir Personal is free, uses minimal resources, has regular updates, and it has proven to have a consistent high detection rate. Removed reference to software manipulation.

Ok, ty, I installed it and updated it to the last version.

But now I'm trying to uninstall NOD32, but when I restart my pc it just shows up again. Anyone knows why or what the problem is?

Lord Sojar · Jan 30, 2009, 09:07 PM // 21:07

Quote:

Originally Posted by viper11025

Um, no one read my post then, yeah I tihnk I had the virus....

Yeh, I read it. You formatted and got rid of it correct? Though, we can't confirm it was Conficker causing the issue and not Storm worm or another virulent trojan.

Lourens · Feb 04, 2009, 12:31 PM // 12:31

Any chance being infected while using a program like MSN ?

I suggest if you dont got a proper virus scanner ; Install AVG Free Edition

Zarnthal · Mar 18, 2009, 07:14 AM // 07:14

As a server Admin in a School District here in Arizona, I have been tasked with eliminating this worm from our systems which total about 1000 PC's and servers. A daunting task considering there are only 2 others in the tech department, plus the director.

We seem to have been infected as early as the 15th of January. We have been working on a "fix" for the better part of 2 weeks and are just about there. Let me give you some insight as to what we are up against at this stage of infection.

1. Running MSRT or Fixdownadup (symantec) does no good. the virus simply prevents them from running.

2. Updating our anti virus version (eset) from 2.7 to 3.0 or 4.0 will work without issue using push technology. However, most PC's will not update the updated virus signatures because they cannot access the AV site.

To update the AV packages, utilize the removal tool and Windows Updates, we must kill the svchost file(s). We must visit each PC manually and use a program called Process.exe. Running this kills all svchost processes, which destabilizes the system, and pops up the shutdown command. After disabling shutdown, we run that proces a few more times to make sure the svchost does not come back. Then we run the malware tool. We then reboot the system after the malware tool finds the virus (run under a deep scan) and eliminates it. After reboot, we begin to immediately update windows with SP3, and the 38 updates after SP3. We then check for the presence of the virus in the registry (SVCHOST - netsvcs). When that is completed, we re-apply the 3 separate patches that address the conficker vunerability (directly and indirectly). Reboot a third time and test the logon. Then we document the machine by room and move onto the next room, rinse and repeat.

The longer this virus remains in play, the more damage it causes. I have group policy logon scripts that no longer run. Manually running those scripts at this moment results in a 5 to 10 minute delay in execution of those scripts, if they run at all. They are visual basic scripts, not batch files. I am hoping as more computers are repaired, script functionality returns because I have seen nothing on how to restore script functionality on the internet. Time on each PC from start to finish takes about an hour depending on the # of files on the PC and how deeply infected the PC is.

It was decided by others to not update windows automatically because of the potential for a bad update to hurt various computers, or all of them. Let me tell you from experience and from what I and the other 2 people will be doing this entire weekend - Update your systems to the latest and greatest patches out there to keep your systems from becoming infected. A fully updated system with a fully updated AV will prevent reinfection.

Zarnthal · Mar 18, 2009, 07:34 AM // 07:34

Quote:

Originally Posted by lakatz

http://www.cnn.com/2009/TECH/ptech/0...ref=newssearch

So... I'm a little confused. I read this article a week ago that states the downadup worm is engineered to spread through corporate networks and, for that reason, corporate networked computers are more at risk than home computers.

No. Typically, Corporate network computers are not updated as frequently, if at all, as home based systems that rely on Automatic Updates. So the risk to home PC's is significantly reduced because they are updated more frequently.

Our PC's at the School District I work at arent updated beyond the image that was made for that particular computer model. After our Conficker disaster is under control, you can bet we will revisit that issue.

Zarnthal · Mar 18, 2009, 07:45 AM // 07:45

Our Anti Virus (NOD32) version 2.7 found the Conficker virus file and removed it each and every time, so we thought we were safe because the file was quarantined and deleted. *WRONG*

Our AV only prevented 1 method of infection. Conficker uses any one of at least 3 or 4 ways to infect a PC. This is why we got a late start on disinfecting our PC's because we thought our AV was catching it before it had a chance to do anything. It was only catching that one method of infection... Then after being infected for over a month, we started experiencing network congestion, domain controller slowdown, group policies not working, group policy scripts not running... yeah fun...
Never ASSUME your protected from Conficker. Verify!!!