Win32:Confi [Wrm]

Viruses and worms
1

Hello,
recently my father started experiencing problems on his laptop - his taskbar freezes. We sent it to service and all they did was install avast and do a scan. They said there was a virus and the scan cleaned it. After that the problem still continued to occur. Few hours after the laptop is switched on an error report message would appear and when we click “Don’t send” the taskbar stops working. The message can be safely ignored and the laptop can continue working normally, but after a while the message closes itself, so the problem is unavoidable.

Here is the message:

http://i39.tinypic.com/2v3h1c4.jpg

When the taskbar stops working the laptop becomes really slow in general, it also takes a lot of time for the task manager to appear, if it appears at all. I managed to get it working again by stopping the explorer.exe proccess and starting it again, but I had to be very persistent, since at first nothing happens when I try to stop the process.

During all this time avast didn’t pick up anything, but today it detected the threat mentioned in the topic title after the “don’t send” button was clicked. The same alert appeared three times in a row.

I started performing the scans mentioned in the stickied thread. When I installed MbAM this message started appearing roughly every minute and still appears as I’m writing this.:

Successfully blocked access to a potentially malicious webite: 111.111.111.111

Type: outgoing


On one occasion the IP was 59.34.197.185 instead of 111.111.111.111

Below I have attached the results from adwcleaner, MbAM, and OTL.

2

do you also have the aswMBR log ?

it seems you may have a conficker worm infection…

Malware removers are notified, it may take some time before they arrive

3

Security Doesn’t Need to be Complicated posted May 2, 2012
http://blogs.norman.com/2012/security-exposed/security-doesnt-need-to-be-complicated

4

Hi,

  1. Download ComboFix from here and save it to your Desktop.
    If you are unsure how ComboFix works please read this guide carefully.
    note: ComboFix must be downloaded to your Desktop.

  2. Temporarily disable your AntiVirus program.
    If you are unsure how to do this please read this or this Instruction.

How to disable avast:

[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.

[*]Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.

  1. Run ComboFix. Click on I Agree!
    ComboFix will check if there is a newer version of ComboFix available.
    Click Yes if prompted to download.
    ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
    Click Yes to allow ComboFix to continue.
    If Recovery Console is not installed, ComboFix will offer download & installation.
    Click Yes to allow ComboFix to install Recovery Console.
    Note:Do not mouse-click Combofix’s window while it is running.
    If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.

  2. When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
    Attach log reports ( ComboFix.txt) back to topic.

THEN …

Re-check:

Please download Farbar Recovery Scan Tool and save it to your desktop.

[color=green]Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

5

Here is Log.txt from ComboFix;
FRST.txt and Addition.txt from FRST;
aswMBR.txt from aswMBR (done after the previous two)

The MbAM messages still appear.

ComboFix didn’t tell me to reboot the PC, so I didn’t.

6

Hi,

Download file from here, unpack it and install it.
http://wikisend.com/download/544456/WindowsXP-KB894391-x86-ENU.rar

THEN

  1. Open notepad and copy/paste the text present inside the code box below.
    To do this highlight the contents of the box and right click on it. Paste this into the open notepad.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


START
File: c:\program files\Google\Update\GoogleUpdate.exe
File: C:\WINDOWS\Datecs\Flex2K.exe
File: C:\WINDOWS\system32\msfeedssync.exe
CMD: IPConfig /FlushDNS
END

  1. Save notepad as fixlist.txt
    NOTE. It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

  2. Run FRST/FRST64 and press the Fix button just once and wait.
    If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
    The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.

Note: If the tool warned you about the outdated version please download and run the updated version.

7

I unpacked and ran the file. It said:

Setup has detected that the Service Pack version of this system is newer than the update you are applying.

There is no need to install this update.

The tool produced the attached log.
It did not prompt me to restart.
I still see the MbAM message mentioned in the first post.

8

Ok, I don’t see malware here. We will run additional check for rootkits:

Download TDSSKiller and save it to your desktop

Execute [b]TDSSKiller.exe[/b] by doubleclicking on it.

[*] Press Start Scan

[*] If Suspicious object is detected, the default action will be Skip, click on Continue.
[*] If Malicious objects are found, select Cure.

Once complete, a log will be produced at the root drive which is typically C:\ ,for example, [b]C:\TDSSKiller.<version_date_time>log.txt[/b]

Please post the contents of that log in your next reply.

9

If you run Windows Update, download & install latest updates from Microsoft, your problem should be solved.

10

Here is the log.
I do not have windows updates enabled, because they keep piling up in my C: drive and eventually take all the space and I end up having to reinstall Windows every month.

I don’t know if I should try restarting the PC, because some of the software I installed from this thread, like ComboFix, might interfere and make things worse. After one hour I’ll need to shut it down.

11

Windows Update was not the cause of it.

Your Page File takes HDD space. PageFile is space taken from your HDD for your system ( RAM memory ). Use google to see how to control pagefile and how to configure it at your will.

From OTL:
3,84 Gb Paging File | 3,33 Gb Available in Paging File | 86,69% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

I don’t see malware here. You may remove used tools.
As I tell you, Windows Update should solve the problem. Sorry, I can’t help you wit non-updated Windwos.

12

It is necessary to uninstall ComboFix :

[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.

On Windows7 or Vista you may use Start Search field if Run is not available.

[*] In the line of text type in (Copy) the following:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

[*] then click OK (or press Enter ).

Wait for the uninstall process is complete.

13
I do not have windows updates enabled,
did you read the link i posted in my reply #2