Tricky trojan?

November 24, 2009 5:50 AM

Please help me get rid of this annoying virus/spyware infection on my laptop

I'm abroad and, after letting a bunch of people at a conference copy my PPT to their USBs, I noticed that the computer was behaving a bit strangely, so now that I am online I tried to download McAfee stringer, but the site wouldn't open, the same goes for the other usual online-scanner programs, Kaparszky, Panda etc. None of the pages open.

As for now, trying to download the torrents, but this goes impossibly slow and in the meantime I need to work.

Does anyone have any suggestions short of going to an internet café and downloading it to a memory stick?I tried to get my girlfriend to send stinger over gmail, but it is too big even when zipped.

Running ClamWin now, but so far nothing.


I wonder if there are some mirror sites or some other solution to this problem.

Thanks a lot!

posted by mateuslee to technology (10 comments total)

Sounds like it might be one of the conficker viruses (it easily spreads with usb sticks, slows comps down, and prevents you from accessing the websites of security software)

You're going to need to try and find a way to download security software from a clean computer. Even if that means an internet cafe (although, you can't guarantee those are clean).
posted by royalsong at 6:01 AM on November 24, 2009

ClamWin just found Worm Autorun 1792 -- even if I set ClamWin to autmoatically remove the infected files, it keeps fiinding this same Worm everytime I run ClamWin
posted by mateuslee at 6:11 AM on November 24, 2009

My go to software for troubles of all sorts is Malwarebytes.

I downloaded the free version and uploaded it to mediafire, for you:

http://www.mediafire.com/file/r2yx2kdejtf/mbam-setup.exe

You may need to rename the installer or the installed .exe in order to get the program to run. Failing that, you can also install it via safe mode.
posted by royalsong at 6:16 AM on November 24, 2009

avast worked well for me when others didn't. try to run your computer in safe mode and then run avast. Or try a restore point?
posted by bunny hugger at 6:21 AM on November 24, 2009

Thanks a lot Royalsong, I sure do appreciate it! Giving it a try now...
posted by mateuslee at 6:23 AM on November 24, 2009

Ah shoot. That is the Conflicker virus according to ClamWin's forums.

"(this code was used by Worm.Kido aka Worm.Conficker and detected as Worm.Autorun-1792)"

Hope the information here helps: http://gizmodo.com/5192951/reminder-how-to-fix-conficker
posted by royalsong at 6:27 AM on November 24, 2009

@bunnyhugger - no luck with Avast.
@ royalsong - still waiting for that mediafire page to open, computer very slow! Checking out Gizmodo now... thanks again!
posted by mateuslee at 6:42 AM on November 24, 2009

Run the MS MSRT tool or do the manual steps to remove it:

http://support.microsoft.com/kb/962007#Manualsteps
posted by damn dirty ape at 6:50 AM on November 24, 2009

I usually go to http://www.filehippo.com and download Malwarebytes

It's not usually covered by the block that gets installed by malware.
posted by so_ at 8:51 AM on November 24, 2009

As I usually come in here and post, take a gander at my profile for the instructions I use and suggest.
posted by deezil at 12:22 PM on November 24, 2009