Virus: locate infected machine

We have Trend Micro Installed on our network PC's. Does anyone know how I can Identify the source of the infection (see attached).
The messages are popping up on lots of PC's.
Who is Participating?
☠ MASQ ☠Connect With a Mentor Commented:
This is a worm using a Windows exploit that was patched some time ago. Are you using any other active AV scanning on your network?

Guide to network removal here
Looks like Conflicker.


Not sure if their advice will apply to your network system or not.
When you say "source of the infection", are you trying to establish which of the computers was infected first before it proliferated through the network (ie. find out what user opened a bad email or inserted a usb flash drive), OR do you mean as dbrunton has assumed (ie. what the actual name of the virus is)?
WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

Ashok DewanFreelancerCommented:
you can see the path in that infected column looks like C:\windows\system32\
scan that file online. or  you will get the name of virus then you can find more information on that virus and also removal instructions.
HKFueyConnect With a Mentor Author Commented:
We have used Wireshark to identify the IP of the machine that is proliferating the virus.

This PC is used by a machine in the Factory and is supported externally so the engineers have been called in.
Downad.AD is the Conficker Worm (as stated by dbrunton), and Mal_DownadJ is the part of it that created the scheduled task so it could execute at a scheduled time and date.
☠ MASQ ☠Commented:
Too slow!  Good you found the culprit but still could do with closing this particular door to stop it arriving via a different route.
Good call with WireShark.  I was actually just in the process of checking out Network Sniffers after reading up again on the details of the number of URLs and Servers that it connects to/with.  I was looking for a Video on the Sophos site by their chief engineer demonstration WireShark at work so I could post back here with the link.  Seems you beat me to it ;-)
BillDLConnect With a Mentor Commented:
".... Good you found the culprit but still could do with closing this particular door to stop it arriving via a different route" ..... and perhaps also close the front door firmly behind or onto the person who (probably) introduced it with a USB Flash Drive, and who definitely needs to be summarily dismissed with loss of wages, pension, and company car ;-)
HKFueyAuthor Commented:
Thanks for the help!

If you have the same problem, try this: -
Thank you HKFuey, even though I was too late in suggesting the same utility you actually used yourself to pin down the source.  Just for completeness, if anyone else happens upon this question, the Sophos video that I was originally looking for is here:
Or a better version from the Main Menu > "Adobe Reader Vulnerability Demo" here:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.