Update... While running Malwarebytes I get a AVG Multiple threat detection alert... Malwarebytes still runs clean. File... C:\WINNT\system32\mkueu.dl
Main Topics
Browse All TopicsA business I do IT for purchased a new Turn Key Business System that came with 8 new servers, 3 desktops, 5 "Professional" installers along with 3 of their laptops. All 11 of the new systems were preloaded with software packages at other locations, but they did not include any antivirus software programs on them. Shortly after their arrival our Purchased (not free) AVG Network Addition detected random attacks on several existing machines with the following information.:
I-worm/Generic.CJT
C:Windows\system32\jqauku.
Process:
C:\windows\system32\svchos
Process ID: 1080
Detected on open.
AVG caught these and sent them to the virus vault. The .dll file name changed and I continued to see these pop up over the next few hours. Trying to find the source it was then I discovered that the new servers had no virus protection. They swore that the laptops did, but I'm not so sure.... Anyway I'm not having any issues with the machines that had virus protection. I have installed AVG on the ones that didn't, but I cannot get to AVG's site to get the latest update files... I also checked, symantec, norton, mcaffee, and malwarebytes and I am unable to get to any of these sites to update. I downloaded malwarebytes and it has a definition file dated Feb 11th and it runs clean on the machines. No malware found... I cannot get to the malwarebytes site to update the definitions from these machines. AVG runs clean with a definition file dated around Feb 27th... I have a hijackthis log that I ran through the hijackthis.de site that really doesn' show anything either.... Any ideas on where to go from here? I have attached the hijackthis.log file...
Thanks...
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Update... While running Malwarebytes I get a AVG Multiple threat detection alert... Malwarebytes still runs clean. File... C:\WINNT\system32\mkueu.dl
Matt... I did check the hosts file on the client (it is actually a Windows 2000 server running a Kerio Winroute Firewall) that I am working with and it was not changed... As for the DNS file are you talking about a specific file or the DNS entry(s) in the Network connections within the control panel? The DNS entries are correct there....
Thanks...
Using another pc, try and download Combofix into a USB and rename before installing into the infected pc in case it won't run and show us the logfile and we'l see if it finds any threats.
Please download ComboFix by sUBs:
http://download.bleep
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepin
I am working with a VPN connection this evening, so the combo fix via USB will have to wait until tomorrow. This is a bank, so the stakes are high.... Anyone have any idea with what I am dealing with here? Is it a possible security risk? I have all of the new servers and machines shut down at the moment as they are not going live until next month.
personally i don't think its even worth spending more than 30 minutes trying to clean a PC. Once its infected you can never be 100% sure that its fully clean again. Better to just backup any local data and rebuild the machine - this way you know you won't spend a couple hours per week fixing reminants of a virus.
Matt...
I'm not sure that I agree with that line of thought.... I have had success with cleaning other machines recently.... And you need to understand that we are not talking about a single PC here... We are talking about multiple database and application servers as well as PC's.... Not an easy task to simply just rebuild them.... If they HAVE to be rebuilt then so be it, but I need to explore other options and not just jump to the "rebuild" option....... Thanks for your input though.....
It seems this might be the Downadup/Conficker infection.
Based from what AVG flags as I-worm/Generic.CJT
Other scanners flag it as Downadup/conficker virus:
F-Secure detects it as Worm:Win32/Downadup.BJ [Orion]
Symantec detects it as W32.Downadup.B
TrendMicro flags it as WORM_DOWNAD.AD
Fortinet as W32/Conficker.FO!worm.im
So
You might like to run these tools too.
F-Secure Removal tool:
1. ftp://ftp.f-secure.com/ant
ftp
http://www.f-secure.com/v-
2. Symantec's W32.Downadup Removal Tool:
http://www.symantec.c
3. MS Malicous Removal tool also claims to remove Downadup/conficker:
http://
And then the MS Patch mentioned in the link if you haven't yet.
http://www.microsoft.c
This could be suspected as a Conficker infection. The latest variant of this virus even blocks access to these sites.
Please download and run the most recent Removal Tool by bitdefender:
Direct Link: http://www.bdtools.net/bd_
Extract the file, execute and then restart.
For further instructions, go to: http://www.bdtools.net/.
Po
Hi,
1) You can scan your network for all hosts that don't have the MS08-067 patch installed using Nessus (http://www.nessus.org/dow
2) I've created a batch file that would do the following:
The batch will do the following:
1) Re-enable and start the following services:
Background Intelligent Transfer Service
Windows Automatic Update Service
Windows Security Center Service
Windows Defender Service
Windows Error Reporting Service
2) Check MS WSUS for any missed updates (Due to disabling/stopping of windows update service during infection period)
3) Run Symantec FixDownadup tool
download from here (http://www.symantec.com/s
4) Install MS08-067 patch
download from here (http://www.microsoft.com/
5) Reboot system
This batch covers the following OS versions:
1) Windows 2000
2) Windows XP
3) Windows 2003
4) Windows Vista SP0/SP1
Note: Some OS versions or 64-bit are not supported by this batch, may be soon.
- Download all patches + Symantec fix tool and save them to a shared folder
- To use the script, change the "Server name" + "shared folder name"
- Use Psexec (http://download.sysintern
You need to scan your network for the machine names/IPs and save them in a text file, then Psexec to import the text file and execute the remediation script on them, one by one.
so, for example (run this as domain admin):
c:\psexec @infected.txt -d -c clean.bat
infected.txt should contains one name/ip per line, like:
...
192.168.1.2
192.168.1.3
192.168.1.4
...
Use netscan to ping a range of IP's and save the results as a text file (http://www.softperfect.co
See attached script
A Symantec Certified Specialist @ your service
It turns out that it was indeed the Downadup/conficker virus... The latest MS Malicous Removal tool cleaned it.... AVG would sometimes detect it and say it moved it to the vault, but several machines were still infected even though AVG was running on them. If I ran an AVG scan on infected machines though it would not alway get it. I also ran Symantec Endpoint on a couple servers and it did not pick it up.
Business Accounts
Answer for Membership
by: MattShadboltPosted on 2009-03-15 at 20:17:48ID: 23894532
check your DNS and hosts files on the clients. Some viruses and malware will change the hosts file or DNS server so that you can't get to other AV sites - even after you've cleaned the machines the AV wont change the hosts/DNS back