Solved

Virus: locate infected machine

Posted on 2011-09-06
11
705 Views
Last Modified: 2012-05-12
Hi,
We have Trend Micro Installed on our network PC's. Does anyone know how I can Identify the source of the infection (see attached).
The messages are popping up on lots of PC's.
Trend-Micro.bmp
0
Comment
Question by:HKFuey
  • 5
  • 2
  • 2
  • +2
11 Comments
 
LVL 48

Expert Comment

by:dbrunton
ID: 36487815
Looks like Conflicker.

See http://esupport.trendmicro.com/solution/en-us/1039145.aspx

Not sure if their advice will apply to your network system or not.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 36487962
When you say "source of the infection", are you trying to establish which of the computers was infected first before it proliferated through the network (ie. find out what user opened a bad email or inserted a usb flash drive), OR do you mean as dbrunton has assumed (ie. what the actual name of the virus is)?
0
 
LVL 9

Expert Comment

by:Ashok Dewan
ID: 36488029
you can see the path in that infected column looks like C:\windows\system32\
scan that file online.
www.virustotal.com or virscan.org  you will get the name of virus then you can find more information on that virus and also removal instructions.
0
U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

 

Assisted Solution

by:HKFuey
HKFuey earned 0 total points
ID: 36488300
We have used Wireshark to identify the IP of the machine that is proliferating the virus.

This PC is used by a machine in the Factory and is supported externally so the engineers have been called in.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 36488303
Downad.AD is the Conficker Worm (as stated by dbrunton), and Mal_DownadJ is the part of it that created the scheduled task so it could execute at a scheduled time and date.
0
 
LVL 62

Accepted Solution

by:
☠ MASQ ☠ earned 250 total points
ID: 36488308
This is a worm using a Windows exploit that was patched some time ago. Are you using any other active AV scanning on your network?

Guide to network removal here
http://www.bdtools.net/how-to-remove-downadup.php
0
 
LVL 62

Expert Comment

by:☠ MASQ ☠
ID: 36488318
Too slow!  Good you found the culprit but still could do with closing this particular door to stop it arriving via a different route.
0
 
LVL 38

Expert Comment

by:BillDL
ID: 36488328
Good call with WireShark.  I was actually just in the process of checking out Network Sniffers after reading up again on the details of the number of URLs and Servers that it connects to/with.  I was looking for a Video on the Sophos site by their chief engineer demonstration WireShark at work so I could post back here with the link.  Seems you beat me to it ;-)
0
 
LVL 38

Assisted Solution

by:BillDL
BillDL earned 250 total points
ID: 36488370
".... Good you found the culprit but still could do with closing this particular door to stop it arriving via a different route" ..... and perhaps also close the front door firmly behind or onto the person who (probably) introduced it with a USB Flash Drive, and who definitely needs to be summarily dismissed with loss of wages, pension, and company car ;-)
0
 

Author Closing Comment

by:HKFuey
ID: 36518356
Thanks for the help!

If you have the same problem, try this: -
http://www.wireshark.org/download.html
0
 
LVL 38

Expert Comment

by:BillDL
ID: 36518681
Thank you HKFuey, even though I was too late in suggesting the same utility you actually used yourself to pin down the source.  Just for completeness, if anyone else happens upon this question, the Sophos video that I was originally looking for is here:
http://www.youtube.com/user/SophosLabs#p/u/48/nPKYubm7yeA
Or a better version from the Main Menu > "Adobe Reader Vulnerability Demo" here:
http://www.sophos.com/en-us/security-news-trends/anatomy-of-an-attack.aspx
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How to check for a virus on a remote machine? 11 59
Windows 7 and Pro update issues 5 89
Can’t delete a file 14 163
Defence against Ransomeware on Remote Desktop Server 5 31
By the time you finish reading this article, you may have already lost all your money because you don't know the simple steps to securing your BitCoin wallet. BitCoin is an incredible invention. It is a decentralized currency system, which is the…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question