Network Infected with W32.DownAdUp.B - How to Remove

[allanc]

A new client contacted me yesterday with a network of about 50 PCs and 8 servers protected with Symantec EndPoint.
Apparently, the PCs and servers are infected with W32.DownAdUp.B (according to Symantec EndPoint).

The Network Administrator had used a Symantec removal tool on the PCs and servers (Windows 2003/2008 all 32-bit).
Symantec EndPoint did not detect any issues for about 6 hours after using the tool and then it started detecting the W32.DownAdUp.B virus on many PCs and the servers.
Now, I am being called in to remove this virus.

What I have done so far on one PC in regular mode is:
Process Explorer and AutoRuns which both seem to be OK.
Disabled Symantec EndPoint
RKill - nothing.
TDSSKILLER & TDSS_TDL4 - nothing
GMer - message is displayed 'GMer stopped working'. Runs to completion in SAFE mode with no issues.
HitManPro - nothing
MalwareBytes & SuperAntiSpyware - nothing

The only program that seemed to find anything is ComboFix (regular mode).
In the category of 'other deletions' the following files were found:
C:\windows\system32\spool\prtprocs\w32x86\x5pp.dll
C:\windows\system32\spool\prtprocs\w32x86\xpd5pp.dll
c:\windows\winhelp.ini

This company is a health care facility and are willing to shut down the complete network during the day only if I can guarantee that the virus will be removed and not reappear (assuming that they do not introduce it again).
Otherwise, the network is only available after 5 PM.
They are located about 1.5 hours away so I would like to really get a handle on the resolution before traveling to their location again.

Thank you in advance for suggestions.

 

[Cambridge PC Support]

have you had a look on BleepingComputer for removal info?

 

[cheapfire]

Will this help out

http://www.bleepingcomputer.com/virus-removal/remove-downadup-conficker

 

[coreyspeed]

have seen this on a network before, it afects usb pens, and removable media as well as network locations.
what we did was to scan every computer with endpoint every server and every usb device in the location and it cleared it up.

scan all removable media from one computer and then you can iolate that computer form the network

 

[allanc]

have you had a look on BleepingComputer for removal info?

Yes, however I was searching for the 'name' that Symantec provided which was 'W32.DownAdUp.B'.
Nothing was found ... see my reply to next post.

 

[allanc]

have seen this on a network before, it afects usb pens, and removable media as well as network locations.
what we did was to scan every computer with endpoint every server and every usb device in the location and it cleared it up.

scan all removable media from one computer and then you can iolate that computer form the network

I wasted 4.5 hours there yesterday (a paid waste that is).
The Admin. said that all service packs and patches were up to date.
The computer that he thinks infected the network is running XP 32-bit SP2!

 

[allanc]

Will this help out

http://www.bleepingcomputer.com/virus-removal/remove-downadup-conficker

Yes, Bingo!
Thank you so much.

 

[allanc]

have seen this on a network before, it afects usb pens, and removable media as well as network locations.
what we did was to scan every computer with endpoint every server and every usb device in the location and it cleared it up.

scan all removable media from one computer and then you can iolate that computer form the network

A couple of questions:
1. How effective (if at all) is Symantec EndPoint if the notebook is removed from the network and connected to a home network?
2. I assume that the computers were still connected to the network while you scanned their hard drives and the removable media?

 

[coreyspeed]

1, It works the same apart from it is not managed, still scans, gets updates etc.

2, yep most computers were connected to the network, we scanned all removable media on one machine which was not connected to the network, scanned all servers as well. affected our storage drives.

 

[iisjman07]

I think that's conficker. You could probably find some removal tools specifically for conficker but you need to make sure the machines don't reinfect each other or get reinfected by USB sticks. Good Luck.

 

[allanc]

I think that's conficker. You could probably find some removal tools specifically for conficker but you need to make sure the machines don't reinfect each other or get reinfected by USB sticks. Good Luck.

I would also use the W32.Worm.DownAdUp.B removal also, correct?

 

[iisjman07]

Yup, check out:
ESET Removal Guide
Bitdefender Downadup Removal Tool
Symantec W32.Downadup Removal Tool
8 Tools Kido/Conficker/Downadup Removal

 

[allanc]

Yup, check out:
ESET Removal Guide
Bitdefender Downadup Removal Tool
Symantec W32.Downadup Removal Tool
8 Tools Kido/Conficker/Downadup Removal

Bleeping computer mentions using the BitDefender version at
http://www.bleepingcomputer.com/virus-removal/remove-downadup-conficker
In addition, the service packs on a ton of computers / servers have to be checked / installed.
Also patches are missing.
Should I be rubbing my hands together?

 

[ljtechservices]

Should I be rubbing my hands together?

Take some help if you can. Or press gang some of the staff into service.

It's going to be a long profitable day regardless.

Have fun!

 

[allanc]

have seen this on a network before, it afects usb pens, and removable media as well as network locations.
what we did was to scan every computer with endpoint every server and every usb device in the location and it cleared it up.

scan all removable media from one computer and then you can iolate that computer form the network

How about using the BitDefender Removal Tool or maybe both (BD and EndPoint)?

 

[iisjman07]

There are different versions of conficker; see if any of the removal tools have command line switches - that way you could automate running them consecutively.

Rumour has it that the Windows Malicous Software Removal Tool can take this. Also when battling this foe, apply this security patch and disable autorun to help prevent reinfection.

 

[dbdawn]

Ah, this is a fun one to clean up after, there was one site last year where a bunch of computer got hit. Not fun, but a lot of work

 

[allanc]

Ah, this is a fun one to clean up after, there was one site last year where a bunch of computer got hit. Not fun, but a lot of work

I am very interested in any tips / traps you would like to share

Thank you in advance.