How to diagnose and defeat the dangerous Conficker worm | The Coffeehouse

Raghavendra_Mudugal
This is how it feels when you do not upgrade to the latest technology...

Thought might help.

Link; http://m.usatoday.com/Tech/230384/1/

Conficker (a computer worm that surfaced in October 2008...?)

"That’s because Conficker blocks you from reaching any web address that includes Microsoft, Symantec, McAfee, AVG, Kaspersky, Trend Micro, F-Secure, Panda, Sophos, SecureWorks or Sunbelt in the URL. It also blocks URLs that contain 103 other names and phrases that relate to security. You can see the full list by clicking to SRI International's report here and scrolling down to the table listed under "domain lookup prevention."

You definitely want to check -- and disinfect -- before April 1. On that date all Conficker-infected PCs will begin trying to connect to 50,000 web domains to receive further instructions. Two schools of thought exist about what Conficker will do next."

I just runned a scan with this recent which i got on microsoft and found safe.

Smiley

vesuvius
Das Glasperlenspiel

Who is at risk?

Users whose computers are not configured to receive patches and updates from Microsoft and who are not running an up to date antivirus product are most at risk. Users who do not have a genuine version of Windows from Microsoft are most at risk since pirated system usually cannot get Microsoft updates and patches.

That should rule out everybody here on Channel 9.

CannotResolveSymbol
{insert caption here}

In reply to vesuvius

#Apr 1st @ 6:36 AM

I thought pirated systems could still get security updates (for this exact reason: to prevent the spread of worms like this one across the internet).

vesuvius
Das Glasperlenspiel

In reply to CannotResolveSymbol

#Apr 1st @ 6:41 AM

No so according to sysadmin. UAC or not running as administrator on XP usuallly cures a lot of ills. this is like the millenum bug that never emerged.

Hot air!

PS: April fools has been and gone now in Yorkshire.

Thank goodness.

Dodo
I'm your creativity creator™ :)

In reply to vesuvius

#Apr 1st @ 6:36 AM

I'm not running an antivirus, but I doubt Conficker can do much of an RPC stack exploit behind a Linux powered NAT device that I call router. Of course the ports for the Windows File Sharing Service are not forwarded to the open. Therefore me not downloading or manually executing a Conficker file won't do any harm. Good, I'm safe. Smiley

How does that even work? This worming into the network? AFAIK you need an open port and data to send to the network application listening on that port that does execute some weird stuff for unexpected data streams, right? So how do all those people even get a worm on their computer, except for being stupid and opening files they don't know what they are?

Dr Herbie
Horses for courses

In reply to Dodo

#Apr 1st @ 7:21 AM

I was just reading about this in the last PCPro magazine -- conficker seems to have several variants, but one of it's tricks in installing itself on a USB stick ...

If you've kept your PC patched you'll be OK, it's mainly affected in businesses where they don't patch PCs for fear of the patches breaking stuff. I don't think I've ever had a patch break stuff so I keep up to date all the time.

Herbie

Dodo
I'm your creativity creator™ :)

In reply to Dr Herbie

#Apr 1st @ 7:35 AM

The USB thing looks like this:

The option Open folder to view files — Publisher not specified was added by the worm.

And I doubt that you wouldn't think there's something strange...

harumscarum
out of memory

Microsoft.com is down so I wonder if it is from Conficker.

PaoloM
Hypermediocrity

In reply to harumscarum

#Apr 1st @ 7:44 AM

Microsoft.com is working just fine Smiley

harumscarum
out of memory

In reply to PaoloM

#Apr 1st @ 7:58 AM

It's an ISP thing here , luckily I have the entire .net framework memorized so I don't need msdn.

CannotResolveSymbol
{insert caption here}

In reply to Dodo

#Apr 1st @ 7:40 AM

I've actually almost been bitten by an autorun virus myself before, and it wasn't through that dialog (which is designed to make it easy to spot that something suspicious is going on). I had canceled the dialog and double-clicked the drive in Explorer, which (in XP, at least) runs the program designated to automatically run without prompting (even on a flash drive). AVG's on-access scanning saved my rear from that one-- it's actually the only time I've seen a legitimate virus detected on my own machine (I've had a couple of false positives, but those don't count).

Does Vista show the dialog when you double-click on the drive in Explorer?

magicalclick

In reply to Dodo

#Apr 1st @ 7:40 AM

Hehe, I see why some people gets infected. Tricky.

elmer
I'm on my very last life.

In reply to harumscarum

#Apr 1st @ 11:42 AM

luckily I have the entire .net framework memorized so I don't need msdn

I made a back-up of the Internet, just to be safe.

blowdart
Peek-a-boo

In reply to harumscarum

#Apr 1st @ 11:42 AM

This is why I always install MSDN locally. You can too Smiley

GoddersUK
I CAN has cheezburger and you CAN'T has stop me!

In reply to Dodo

#Apr 1st @ 7:40 AM

Unfortunately I tend to use a kind of mental recognition system on such dialogues:

It pops up, my brains almost instantly recognises it as the auto run dialogue, and I move my mouse straight to the relevant icon without reading through the text and I click through it too quickly to spot something's amis (or if I do it'll only register in my brain after I've dismissed the dialogue).

So it would be very easy for me to be bitten by this. Sad

SlackmasterK
I write my OWN blogging engines

In reply to GoddersUK

#Apr 5th @ 5:34 AM

Pfft. I disable Autorun and do start > run > g:\ , as I almost universally plugged it in to xfer files.