68.178.232.99/Wpad.dat

Viruses and worms
1

Hello Forum,

This is my first post so I hope Im doing this correctly and in the correct forum.

I have been getting a warning from Avast on two machines. both started about a week ago. Both machines are tied together in my home network with file sharing. Here is a photo of the warning.

https://picasaweb.google.com/112322821992129567320/AvastWarning#5591806558962175090

Both machines go to the same Ip number. Im running Avast internet security version 6.0.1000 Definitions 110404-0.
I run a scan daily with everything turned on and Avast is not able to find a thing, though every 30-90 minutes or so I will get these messages saying it blocked the traffic. Looking at a few forums it is sounding like a maybe some unknown bot roaming around.

http://www.pprune.org/archive/index.php/t-340216.html

I contacted Avast tech support over the weekend and got some guys in India. They were not helpful and assured me that avast stopped the intrusion. Since that is all they could tell me and show me the same thing over and over, I felt totally confident in their understanding of what was actually causing the problem. They told me everything was fine and not to worry cause it was being caught. What was being caught they failed to understand. I know the Wpad.dat is somehow used in proxy autodiscovery protocol for Internet explorer. Though I dont use IE anywhere. I only use Firefox and both machines are currently on 3.6.16. One machine is running MS Outlook 2007 (12.0.6550.5003) SP2 MSO (12.0.6545.5004), the other does not run anything other then google mail in firefox.

Im guessing this is a bot, but far from a expert. Does anyone have any suggestions?

Thank you
Matt

2
  • Disable proxy autoconfiguration in your browsers
  • Read the sticky posts in this section and attach MBAM and OTS logs.
3

Doktornotor,

Here are the log files. Let me know what you think.

The OTS file is 350K. I cant upload it or upload a .zip of it. Should I email it to you or somewhere else?

Thank you
Matt

4

Leaving this for essexboy, 3 AM here. :stuck_out_tongue:

Should have saved it as ANSI, not UTF-8. Would be about half size then.

5

Thanks for the Help. Get some sleep. Ill look into saving it as ansi.

Thanks Again.
Matt

6

Doktornotor,

Here is the OTS in ANSI.

Thank you
Matt

7

Nothing apparent there so lets look for the offender

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

[*]Double-click SystemLook.exe to run it.
[*]Copy the content of the following codebox into the main textfield:

:filefind
wpad.*

[*]Click the Look button to start the scan.
[*]When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

8

Thanks Essexboy,

Looks like it did not find anything. Attached log. Ran the 32 and 64 bit versions.

Thanks
Matt

9

Please attach the output of the following:

ipconfig /all > %HOMEDRIVE%\%HOMEPATH%\Desktop\ipconfig.txt

(The file will be saved in your desktop)

10

Hi Doktornotor,

Here is the file. I am at work at the moment, and have not seen the message while at work. But when I got home last night and powered back up it popped up again as being blocked. So basically the ipconfig will be different then what I have at home.

Thanks
Matt

11

Well, then you can delete the file as well and make a new one once you came home. This comes from your DHCP/DNS server, not really anything local it seems.

12
and have not seen the message while at work. But when I got home last night and powered back up it popped up again as being blocked. So basically the ipconfig will be different then what I have at home.
To me this would indicate an infected router

Reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled “reset” located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).

13

Agreed. Other notes here (after doing the above) would include:

  • flash latest firmware
  • and of course change the default credentials
14

Great Ill give that a shot. Its a cisco ASA5505. Im surprised. I was thinking those things are bullet proof. I guess not?

Thank you
Matt

15

Another possibility… his work router and firewall may be filtering stuff and not allowing it to get to his PC. That might account for why there are no issues at work.

16

Isnt this threat a outbound threat from my computer headed out to that IP#?

17

Work router is a Cisco asa5510.

18

That threat comes from proxy autoconfiguration function in browsers. Proxy autoconfiguration is done via DNS/DHCP server. As noted above, there is no sign of local infection on the machine, which pretty much matches what I have explained.

19

Ok, Thanks Doktornotor.