KoobFace Worm

[Gerowen]

I take care of my mom's computer and several others with LogMeIn. This morning she called me and said she was having a problem with random popups after getting a message on Facebook. After some poking around I found an odd process called "bill106.exe" that I found out comes from the Koobface worm. I killed the process, deleted the file (it was marked as hidden) and now the random popups are gone. I ran CCleaner's registry cleaner to get rid of any odd registry keys it may have generated and I have the latest McAfee Stinger searching for remnants of it as well as whatever else it can find. However I'm still having a problem. She's having problems accessing anything having to do with security. I've seen this before in other computers and I always just reformatted them because it was too much of a hassle. However this computer is about 3,000 miles away. I installed the latest version of McAfee Security Center (I get it free from work) but it won't connect to the update server. I tried Spybot S&D but it won't connect to its update server. The only way I managed to get Stinger to it was by downloading it with my Linux PC and dropping it into a shared folder me and her have on our Dropbox.com accounts. Whenever I try to google the virus on her computer to show her information about it, it won't let me go to any websites that have to do with "anti-virus" type stuff. I can't spot any rogue processes and nothing looks out of the ordinary in her msconfig. I mean she can't even check out McAfee's Facebook page, lol. Can anybody help me out? Attached is a screenshot showing what I mean, I've got McAfee's site open in a tab on my machine, and her internet access is good because I'm controlling her from logmein and she can go to some sites, just nothing security oriented.

[Gerowen]

P.S. Her hosts file is fine and un-modified.

C:\Windows\system32\drivers\etc\hosts

[Wanderermy]

Download MSE

Then download offline definition update file.

Then scan.

[amon91]

At the very last resort you could also try System Restore if the problem didn't start too long ago. Good luck.

[Gerowen]

Well I ended up deleting all of her restore points because one of them was infected. I ran MSE about a dozen various viruses and removed them all, including koobface. She's still not able to access any sites or services that have to do with "anti-virus". It didn't modify browser settings, she can't even ping mcafee.com. I pinged it and got the IP and plugged that into her browser though and she could get to McAfee's site using the IP. Other sites I've found that are blocked are Microsoft.com, Symantec.com, Myspace.com, Her hosts file hasn't been modified, so I'm not sure what else a virus could do to affect hostname resolution. There is no DNS server to poison, all she really has is a wireless router with her own computer. Her other computer on the same network can access these sites without issue. Any ideas?

[gdodson]

I pinged it and got the IP and plugged that into her browser though and she could get to McAfee's site using the IP.

Open command prompt and type "ipconfig /flushdns" without the quotes. Also try start > run > "inetcpl.cpl" (again no quotes) > connections > LAN settings button and make sure that there are no proxies set up. 127.0.0.1:5555 is a common one set by malware. Just erase the values if there are any. As a last option, you could open command prompt and type "netsh winsock reset" but you will lose the network connection and have to reboot the PC to connect again.

[Gerowen]

Tried all these, still getting redirected to random phishing sites when I try to go to certain sites. It either redirects me to a phishing site, or just blocks access altogether. MSE catches a virus once and a while when it redirects me to a phishing site but it always successfully removes them. I also checked the IP settings of all the connections and there's no static DNS settings, everything is still dynamic like it should be.

Edit: Can't find any processes that look out of place either.

[Wanderermy]

Can you boot it into safe mode?

[gdodson]

If McAfee and Spybot can't update (I'm assuming they use IPs to connect, not names) there must be a proxy or an active infection that's still filtering the connection. There doesn't have to be an obvious process running, the infection is more than likely running in explorer, IE, or some other system process. It could even be a fake driver that's being loaded at boot.

[Gerowen]

Can you boot it into safe mode?

Yes, she can boot it into Safe Mode. I've got her running another full scan with MSE while it's in Safe Mode.

[sc302 Veteran]

Please run comborfix from bleepingcomputer and post the log file if she still cannot access antivirus sites. May want to run malwarebytes on top of that then run combofix again for the logging. I'll help you remove it but will need that log file.

[Gerowen]

Please run comborfix from bleepingcomputer and post the log file if she still cannot access antivirus sites. May want to run malwarebytes on top of that then run combofix again for the logging. I'll help you remove it but will need that log file.

Malwarebytes SUPERAntispyware was one of the things originally infected in the first place. I didn't install it on her machine but somehow it got there and as soon as I hit "uninstall" I got spammed with like 5 windows telling me to reinstall it and that I was infected...

[hjf288]

Malwarebytes should be anti-malware not Superantispyware...

Try running autoruns from sysinternal and fine comb the system

[Phenom II]

Check the LAN Proxy settings, it most likely set a stupid IP in the proxy settings

[sc302 Veteran]

Malwarebytes and superantispyware are antimalware programs. They are not one and the same. They do not spam you. You have other issues going on. If you want help run combofix and post the log.

[ad!k1337]

post your combofix or hijackthis log, then we will start from there, looks like you moms pc is infected by a rogue av/antimalware ... you can also download malwarebytes (the legit one) and run it and see if it catches anything.

[ZakO]

I cleared koobface off a friends computer - it installs a DNS service (I can't remember what it was called), make sure you disable it in Services.

[Gerowen]

Ok so I looked through the Services.msc list of services and nothing seemed out of place, no weird processes running in the background, and I even looked up Koobface DNS on trendmicro and found a registry key they said it would edit and everything there looked good. I'll post the output from those programs as soon as I can.

[presence06]

Koobface is a nasty little pest.

Combofix + Malwarebytes +SuperAntiSpyware FTW. Disable System Restore, CCleaner. Should be fine after that.

[ObiWanToby]

For the future, I'd probably transition her to a Standard user account. Unless she needs daily admin access for whatever reason. This will not be the last time.

[Gerowen]

For the future, I'd probably transition her to a Standard user account. Unless she needs daily admin access for whatever reason. This will not be the last time.

Yeah she's mailing the computer to me, I'm just going to wipe it and then set her up with a standard limited account.

[soldier1st]

this site should have some useful tools http://www.pcwintech.com/shanes-toolbox, also if she has xp and if running as limited user then some apps won't work and you could have her browsers clear there temp files when they are closed.