Recommended Posts

I take care of my mom's computer and several others with LogMeIn. This morning she called me and said she was having a problem with random popups after getting a message on Facebook. After some poking around I found an odd process called "bill106.exe" that I found out comes from the Koobface worm. I killed the process, deleted the file (it was marked as hidden) and now the random popups are gone. I ran CCleaner's registry cleaner to get rid of any odd registry keys it may have generated and I have the latest McAfee Stinger searching for remnants of it as well as whatever else it can find. However I'm still having a problem. She's having problems accessing anything having to do with security. I've seen this before in other computers and I always just reformatted them because it was too much of a hassle. However this computer is about 3,000 miles away. I installed the latest version of McAfee Security Center (I get it free from work) but it won't connect to the update server. I tried Spybot S&D but it won't connect to its update server. The only way I managed to get Stinger to it was by downloading it with my Linux PC and dropping it into a shared folder me and her have on our Dropbox.com accounts. Whenever I try to google the virus on her computer to show her information about it, it won't let me go to any websites that have to do with "anti-virus" type stuff. I can't spot any rogue processes and nothing looks out of the ordinary in her msconfig. I mean she can't even check out McAfee's Facebook page, lol. Can anybody help me out? Attached is a screenshot showing what I mean, I've got McAfee's site open in a tab on my machine, and her internet access is good because I'm controlling her from logmein and she can go to some sites, just nothing security oriented.

post-125978-12708817215708.png

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/
Share on other sites

Well I ended up deleting all of her restore points because one of them was infected. I ran MSE about a dozen various viruses and removed them all, including koobface. She's still not able to access any sites or services that have to do with "anti-virus". It didn't modify browser settings, she can't even ping mcafee.com. I pinged it and got the IP and plugged that into her browser though and she could get to McAfee's site using the IP. Other sites I've found that are blocked are Microsoft.com, Symantec.com, Myspace.com, Her hosts file hasn't been modified, so I'm not sure what else a virus could do to affect hostname resolution. There is no DNS server to poison, all she really has is a wireless router with her own computer. Her other computer on the same network can access these sites without issue. Any ideas?

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467468
Share on other sites

I pinged it and got the IP and plugged that into her browser though and she could get to McAfee's site using the IP.

Open command prompt and type "ipconfig /flushdns" without the quotes. Also try start > run > "inetcpl.cpl" (again no quotes) > connections > LAN settings button and make sure that there are no proxies set up. 127.0.0.1:5555 is a common one set by malware. Just erase the values if there are any. As a last option, you could open command prompt and type "netsh winsock reset" but you will lose the network connection and have to reboot the PC to connect again.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467490
Share on other sites

Tried all these, still getting redirected to random phishing sites when I try to go to certain sites. It either redirects me to a phishing site, or just blocks access altogether. MSE catches a virus once and a while when it redirects me to a phishing site but it always successfully removes them. I also checked the IP settings of all the connections and there's no static DNS settings, everything is still dynamic like it should be.

Edit: Can't find any processes that look out of place either.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467612
Share on other sites

If McAfee and Spybot can't update (I'm assuming they use IPs to connect, not names) there must be a proxy or an active infection that's still filtering the connection. There doesn't have to be an obvious process running, the infection is more than likely running in explorer, IE, or some other system process. It could even be a fake driver that's being loaded at boot.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467636
Share on other sites

Please run comborfix from bleepingcomputer and post the log file if she still cannot access antivirus sites. May want to run malwarebytes on top of that then run combofix again for the logging. I'll help you remove it but will need that log file.

Malwarebytes SUPERAntispyware was one of the things originally infected in the first place. I didn't install it on her machine but somehow it got there and as soon as I hit "uninstall" I got spammed with like 5 windows telling me to reinstall it and that I was infected...

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467680
Share on other sites

Ok so I looked through the Services.msc list of services and nothing seemed out of place, no weird processes running in the background, and I even looked up Koobface DNS on trendmicro and found a registry key they said it would edit and everything there looked good. I'll post the output from those programs as soon as I can.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592487842
Share on other sites

For the future, I'd probably transition her to a Standard user account. Unless she needs daily admin access for whatever reason. This will not be the last time.

Yeah she's mailing the computer to me, I'm just going to wipe it and then set her up with a standard limited account.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592509716
Share on other sites

this site should have some useful tools http://www.pcwintech.com/shanes-toolbox, also if she has xp and if running as limited user then some apps won't work and you could have her browsers clear there temp files when they are closed.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592516672
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I'd say the first one failed to be as popular as Apple anticipated, but the easy adjustment here is to make fewer of them next time around. It would only be a "flop" if it isn't possible for Apple to recover the design and factory tooling costs given the number of units sold, which I doubt would be the case. It isn't like no one bought them; it just failed to become the new hot phone of the year.
    • You're right that it does not follow the plain meaning of the word, but in this context, it is a legal term defined in 49 U.S.C. Kind of how "wire fraud" laws apply even if a physical wire was not used. Given that it is codified in law, and it isn't just automotive journalists that don't understand evolving technology, I highly doubt congress would change a well understood term just because technology makes the term slightly less actuate.
    • This is exactly why I keep saying we are not ready for human free self-driving. These little "bugs" are may seem like random one-offs. There was also the Waymo that drove between police with drawn weapons and the suspect they were pointing them at. From a software perspective it is easy to understand how those extremely rare situations may not have been programed for, but that is the point. If AI needs to be told to watch out for every possible contingency, then it can never be successful. There will always be the possibility of a first encounter that the AI needs to understand to avoid.
    • TeraCopy 4.0 Final by Razvan Serea TeraCopy is a compact program designed to copy and move files at the maximum possible speed, also providing you with a lot of features. Copy files faster. TeraCopy uses dynamically adjusted buffers to reduce seek times. Asynchronous copy speeds up file transfer between two physical hard drives. Pause and resume transfers. Pause copy process at any time to free up system resources and continue with a single click. Error recovery. In case of copy error, TeraCopy will try several times and in the worse case just skips the file, not terminating the entire transfer. Interactive file list. TeraCopy shows failed file transfers and lets you fix the problem and recopy only problem files. Shell integration. TeraCopy can completely replace Explorer copy and move functions, allowing you work with files as usual. TeraCopy is free for non-commercial use only. For commercial use you need to buy a license. The paid version of the program includes the following features: Copy/move to your favorite folders. Save reports as HTML and CSV files. Select files with the same extension/folder. Remove the selected files from the copy queue. Download: TeraCopy 4.0 | 14.6MB (Freeware, paid upgrade available) View: TeraCopy Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Week One Done
      Eurosoft10 earned a badge
      Week One Done
    • One Month Later
      Eurosoft10 earned a badge
      One Month Later
    • One Year In
      Skeet Campbell earned a badge
      One Year In
    • One Month Later
      Sharbel earned a badge
      One Month Later
    • First Post
      BizSAR earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      586
    2. 2
      +Edouard
      187
    3. 3
      Michael Scrip
      74
    4. 4
      PsYcHoKiLLa
      72
    5. 5
      neufuse
      69
  • Tell a friend

    Love Neowin? Tell a friend!