Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We got blocked because we were listed in CBL for the following reason:

This IP is infected with, or is NATting for a machine infected with Torpig, also known by Symantec as Anserin.

This was detected by observing this IP attempting to make contact to a Torpig Command and Control server at, with contents unique to Torpig C&C command protocols.

The computer is in a NATted network connected to the internet with a dedicated IP. The firewall and DHCP logs pointed us to the right computer.

I scanned the computer using MBAM, Norman, TDDS Killer, Norton, Super Anti Spyware, Symantec Root Kit Killer and from Ubuntu with Clamav but none of them found a virus.

So, was my computer really infected? I won't take any risk and will reformat the computer, but this is really weird that a virus can exist on my computer and 7 AV products will not find it.

share|improve this question
up vote 1 down vote accepted

Scanning from a separate OS is a good idea, especially when an active rootkit has to be expected, but ClamAV might not be the best choice to hunt down such an infection. I suggest to use a product with better detection rates for malware files found on infected machines, e. g. Avira's Rescue System, which runs from a boot cd or a flashdrive:

Or maybe this system is not infected at all and you made a mistake while tracking the source of the request? Are you sure about the association of ip address and machine?

share|improve this answer
I am 100% definately sure about the IP/machine. I have formatted and reinstalled the OS on the machine but will keep your tip for next time – jao May 7 '12 at 9:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.