Conficker Eye Chart Test

[Ron61]

I am not vouching for the accuracy of this test but it is pasted on the news page so I thought I would look at it. If nothing else you get to see the pictures.

http://www.baylor.edu/its/security/conficker/

Ron

[trularin]

Okay, I could see all three...and the advertising.

[Ron61]

Then you can put away the bottle of worm medicine that you bought in case your computer got that virus.

Ron

[computerworks]

Actually, that's a good little quick test.

Conficker (and certain other worms) tamper with your system's ability to reach certain web sites, specifically, any AntiVirus site that could possibly help you detect and remove it. So, if you have an infection like that, you would not see the images on that page that are sourced on the AV sites.

When diagnosing possible client infectons over the phone, we usually ask them to go to symantec.com or mcafee.com, just to see if they can view the web site. If they can't...but can see most other sites...it means they've caught something.

[trularin]

Morning Ron.

[computerworks]

hiya...

[Ron61]

Ron,

Is it also true that the Conficker worm will stop a computer from booting up in Safe Mode? I have only seen one around here that had it and I tried going to McAfee and Nortons and it wouldn't go but after we got it cleaned up I saw a post on one of the sites that it also stopped you from booting in Safe Mode. The cleaning tool we used didn't require us to boot into Safe Mode so I didn't try that. So far just one person that I know of has had anything on their computer so I think most people here had theirs all up to date.

Thanks,

Ron

[Joe Wicked]

I think my Step son went to a site on one of my computers and got something. I cannot hit the virus protection sites and a few others as well. I am trying to recover it, but can't seem to find the infection to remove it. I downloaded Microsoft's malicious tool, but it found nothing.

[427 S/O]

Joe, 'reset to an earlier date' might work?.

[Joe Wicked]

Originally Posted by 427 S/O

Joe, 'reset to an earlier date' might work?.

Tried it. It didn't work. I went all the way back to 3/15 last night and no settings were changed message was displayed. I did see something today on a java virus that blocks certain web sites that AVG did catch right before all this happened, so I think that maybe AVG deleting the virus, caused something else. Going to try to fix it when I get home. Hopefully this is it. If not, I think this weekend, I am just going to format and start over on that PC. I won't loose any data other than saved games, and the like, so no worries there.

[Joe Wicked]

Looks like I may have the conficker A/B variant. Now to figure out how to remove.

[Ron61]

Joe,

If you can't get to one of the AV sites to download their removal tools maybe I could do so and e-mail it to you.

Ron

[Joe Wicked]

I was able to get Microsofts Malicious tool, and it can't find anything. I was able to update AVG to the latest and it doesn't detect anything either. But the computer still acts as if it has the virus.

[Ron61]

The McAfee and Norton's removal tools are designed just for this virus, but if you have an older version I don't know if they will work or not. Can you boot up in Safe Mode. If you can, try running your detection tools and then run Hijack This and look at the log file it generates. Also look at your Auto runs Folders and see if anything had changed.

Also if you get it cleaned, disable your System Restore and do a disk clean and defrag to flush out and get rid of any of this stuff that may be saved in it. I have seen some guys clean their computer two or three times and then it would be right back because the system restore files had it in them. Once they did what I said above it never came back. Hope this helps some.

Ron

[Joe Wicked]

I'll give it a try. Worth a shot. I am ready to just format this damned thing. I have begun backing up my files. Just need to back up my email files and I will be ready.