Recommended Posts

I take care of my mom's computer and several others with LogMeIn. This morning she called me and said she was having a problem with random popups after getting a message on Facebook. After some poking around I found an odd process called "bill106.exe" that I found out comes from the Koobface worm. I killed the process, deleted the file (it was marked as hidden) and now the random popups are gone. I ran CCleaner's registry cleaner to get rid of any odd registry keys it may have generated and I have the latest McAfee Stinger searching for remnants of it as well as whatever else it can find. However I'm still having a problem. She's having problems accessing anything having to do with security. I've seen this before in other computers and I always just reformatted them because it was too much of a hassle. However this computer is about 3,000 miles away. I installed the latest version of McAfee Security Center (I get it free from work) but it won't connect to the update server. I tried Spybot S&D but it won't connect to its update server. The only way I managed to get Stinger to it was by downloading it with my Linux PC and dropping it into a shared folder me and her have on our Dropbox.com accounts. Whenever I try to google the virus on her computer to show her information about it, it won't let me go to any websites that have to do with "anti-virus" type stuff. I can't spot any rogue processes and nothing looks out of the ordinary in her msconfig. I mean she can't even check out McAfee's Facebook page, lol. Can anybody help me out? Attached is a screenshot showing what I mean, I've got McAfee's site open in a tab on my machine, and her internet access is good because I'm controlling her from logmein and she can go to some sites, just nothing security oriented.

post-125978-12708817215708.png

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/
Share on other sites

Well I ended up deleting all of her restore points because one of them was infected. I ran MSE about a dozen various viruses and removed them all, including koobface. She's still not able to access any sites or services that have to do with "anti-virus". It didn't modify browser settings, she can't even ping mcafee.com. I pinged it and got the IP and plugged that into her browser though and she could get to McAfee's site using the IP. Other sites I've found that are blocked are Microsoft.com, Symantec.com, Myspace.com, Her hosts file hasn't been modified, so I'm not sure what else a virus could do to affect hostname resolution. There is no DNS server to poison, all she really has is a wireless router with her own computer. Her other computer on the same network can access these sites without issue. Any ideas?

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467468
Share on other sites

I pinged it and got the IP and plugged that into her browser though and she could get to McAfee's site using the IP.

Open command prompt and type "ipconfig /flushdns" without the quotes. Also try start > run > "inetcpl.cpl" (again no quotes) > connections > LAN settings button and make sure that there are no proxies set up. 127.0.0.1:5555 is a common one set by malware. Just erase the values if there are any. As a last option, you could open command prompt and type "netsh winsock reset" but you will lose the network connection and have to reboot the PC to connect again.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467490
Share on other sites

Tried all these, still getting redirected to random phishing sites when I try to go to certain sites. It either redirects me to a phishing site, or just blocks access altogether. MSE catches a virus once and a while when it redirects me to a phishing site but it always successfully removes them. I also checked the IP settings of all the connections and there's no static DNS settings, everything is still dynamic like it should be.

Edit: Can't find any processes that look out of place either.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467612
Share on other sites

If McAfee and Spybot can't update (I'm assuming they use IPs to connect, not names) there must be a proxy or an active infection that's still filtering the connection. There doesn't have to be an obvious process running, the infection is more than likely running in explorer, IE, or some other system process. It could even be a fake driver that's being loaded at boot.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467636
Share on other sites

Please run comborfix from bleepingcomputer and post the log file if she still cannot access antivirus sites. May want to run malwarebytes on top of that then run combofix again for the logging. I'll help you remove it but will need that log file.

Malwarebytes SUPERAntispyware was one of the things originally infected in the first place. I didn't install it on her machine but somehow it got there and as soon as I hit "uninstall" I got spammed with like 5 windows telling me to reinstall it and that I was infected...

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592467680
Share on other sites

Ok so I looked through the Services.msc list of services and nothing seemed out of place, no weird processes running in the background, and I even looked up Koobface DNS on trendmicro and found a registry key they said it would edit and everything there looked good. I'll post the output from those programs as soon as I can.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592487842
Share on other sites

For the future, I'd probably transition her to a Standard user account. Unless she needs daily admin access for whatever reason. This will not be the last time.

Yeah she's mailing the computer to me, I'm just going to wipe it and then set her up with a standard limited account.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592509716
Share on other sites

this site should have some useful tools http://www.pcwintech.com/shanes-toolbox, also if she has xp and if running as limited user then some apps won't work and you could have her browsers clear there temp files when they are closed.

Link to comment
https://www.neowin.net/forum/topic/891202-koobface-worm/#findComment-592516672
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Bose Ultra Open Earbuds are once again selling at their lowest price by Fiza Ali Amazon is once again offering the Bose Ultra Open Earbuds at their lowest price ever with a limited-time 33 percent discount on their original MSRP, ahead of Father's Day. So, you may want to check it out if you are looking for a gift or if you have been wanting to upgrade your device. The earbuds feature an open-ear design and Bose's OpenAudio technology that should deliver high-quality sound while helping keep audio private. The earbuds also support Bose Immersive Audio, which creates a spatialised listening experience designed to place sound around the listener for a more engaging experience. In terms of wireless connectivity, the earbuds features Bluetooth, Bluetooth Low Energy (BLE), A2DP audio streaming, HFP, AAC, and SBC support. Furthermore, they are compatible with Bose SimpleSync technology, allowing pairing with compatible Bose smart soundbars and speakers. They are also compatible with the Bose App for setup, customisation, and software updates. Moreover, they offer an IPX4 water-resistance rating that should provide protection against sweat and light splashes. When it comes to the battery performance, the Bose Ultra Open Earbuds should provide up to seven hours of battery life on a single charge while a full recharge should take approximately one hour. Specifications Detail Fit type Open-ear Noise cancelling No Microphone Built-in Wireless Bluetooth (A2DP, HFP, AAC, SBC, BLE) Multipoint Yes; 2 devices simultaneously Charging interface USB-C Earbud size 0.73"x0.67" x 1.07" (0.014lb) Case size 1.65"x2.56" x 1.04" (0.097 lb) Materials PC-ABS plastic, metal, silicone, gold plating App support Bose app; adjustable EQ, SimpleSync Audio tech OpenAudio, immersive/spatialized sound Bose Ultra Open Earbuds: $199 (Amazon US) - 33% off Good to know This Amazon deal is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
    • After enabling it in about:config, customize, density, compact; the toolbar/address bar gets smaller vertically. I enabled Nova, I notice the tab bar/title bar is a bit larger vertically now? Everything always becomes a waste of space.
    • Microsoft's Copilot Cowork now generally available with usage-based billing by Pradeep Viswanathan Back in March, Microsoft first revealed Copilot Cowork, a new agentic AI experience in Microsoft 365 Copilot through which users can assign tasks to AI to complete in the background. After testing the service with a limited set of customers in Research Preview for a few weeks, Microsoft announced the general availability of Copilot Cowork to customers in the Frontier program on March 30. Today, Microsoft announced the general availability of Copilot Cowork worldwide for Microsoft 365 Copilot customers. The company also highlighted that Cowork became the fastest-growing feature in the history of its Frontier program. Unlike regular Copilot Chat, Copilot Cowork can run complex, long-running, multi-tool tasks from start to finish in the cloud by using organizational context through Work IQ. When compared to Claude Cowork, Microsoft claims that Copilot Cowork will be 30% to 40% cheaper on average with its Microsoft 365 connector. For now, Copilot Cowork runs on Anthropic models, including Opus 4.8 and Sonnet 4.6. However, Frontier customers can now use GPT-5.5. Microsoft also announced Cowork 1, a secure fine-tuned model coming in the next few weeks, which is designed to handle everyday Copilot tasks at a lower cost. To access Copilot Cowork, a Microsoft 365 Copilot user subscription is required. Usage is billed separately through Copilot Credits, based on model use, context retrieval, tool calls, and runtime. Pay-as-you-go pricing is set at $0.01 per Copilot Credit. To offer IT teams full control over usage costs, Microsoft provides spending limits, usage alerts, user-level controls, reporting, and prepaid usage plans for organizations. Usage-based billing begins today. However, Frontier customers who used Cowork between March 30 and June 16 will not be billed until July 1, 2026. The Microsoft 365 Copilot app now includes a toggle to enter the full Cowork experience. Microsoft is also adding partner plugins, with Enosix, Harvey, LSEG, Miro, monday.com, Moody’s, Morningstar, S&P Global Energy, and TeamsMaestro available now. Adobe, Atlassian, Box, Canva, Databricks, and others are coming soon.
    • With Nova enabled I am not seeing a difference with compactmode.show?
    • HOLY THREAD REVIVAL   But yes, look for browser.nova.enabled and set it to true
  • Recent Achievements

    • One Year In
      Console General earned a badge
      One Year In
    • One Year In
      Twozo Technologies earned a badge
      One Year In
    • One Month Later
      Twozo Technologies earned a badge
      One Month Later
    • Week One Done
      Twozo Technologies earned a badge
      Week One Done
    • Veteran
      branfont went up a rank
      Veteran
  • Popular Contributors

    1. 1
      +primortal
      522
    2. 2
      +Edouard
      196
    3. 3
      PsYcHoKiLLa
      111
    4. 4
      Steven P.
      90
    5. 5
      Nick H.
      71
  • Tell a friend

    Love Neowin? Tell a friend!