http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.pnghttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/How to diagnose and defeat the dangerous Conficker wormhttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/en-usMon, 06 Apr 2009 00:17:53 GMTMon, 06 Apr 2009 00:17:53 GMTEvNet (EvNet, Version=1.0.3608.3122, Culture=neutral, PublicKeyToken=null)<P>Pfft.&nbsp; I disable Autorun and do start &gt; run &gt; g:\&nbsp;&nbsp; , as I almost universally plugged it in to xfer files.</P>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463892Mon, 06 Apr 2009 00:17:54 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4638920http://channel9.msdn.com/463892/WebViewBug.aspx?EVT=0Pfft.&nbsp; I disable Autorun and do start &gt; run &gt; g:\&nbsp;&nbsp; , as I almost universally plugged it in to xfer files.SlackmasterK0http://channel9.msdn.com/463892/Trackback.aspxUnfortunately I tend to use a kind of mental recognition system on such dialogues:<br><br>It pops up, my brains almost instantly recognises it as the auto run dialogue, and I move my mouse straight to the relevant icon without reading through the text and I click through it too quickly to spot something's amis (or if I do it'll only register in my brain after I've dismissed the dialogue).<br><br>So it would be very easy for me to be bitten by this. :(<br>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463798Sun, 05 Apr 2009 12:34:28 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4637980http://channel9.msdn.com/463798/WebViewBug.aspx?EVT=0Unfortunately I tend to use a kind of mental recognition system on such dialogues:It pops up, my brains almost instantly recognises it as the auto run dialogue, and I move my mouse straight to the relevant icon without reading through the text and I click through it too quickly to spot something's&#8230;GoddersUK0http://channel9.msdn.com/463798/Trackback.aspxThis is why I always install MSDN locally. <a href="http://www.microsoft.com/downloads/details.aspx?displaylang=en&amp;FamilyID=7bbe5eda-5062-4ebb-83c7-d3c5ff92a373">You can too</a> :)<br>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463502Thu, 02 Apr 2009 07:57:37 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4635020http://channel9.msdn.com/463502/WebViewBug.aspx?EVT=0This is why I always install MSDN locally. You can too :)blowdart0http://channel9.msdn.com/463502/Trackback.aspx<STRONG>luckily I have the entire .net framework memorized so I don't need msdn<BR></STRONG><BR>I made a back-up of the Internet, just to be safe.http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463485Thu, 02 Apr 2009 03:17:34 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4634850http://channel9.msdn.com/463485/WebViewBug.aspx?EVT=0luckily I have the entire .net framework memorized so I don't need msdnI made a back-up of the Internet, just to be safe.Elmer0http://channel9.msdn.com/463485/Trackback.aspx<P>Hehe, I see why some people gets infected. Tricky.<BR></P>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463445Wed, 01 Apr 2009 21:46:55 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4634450http://channel9.msdn.com/463445/WebViewBug.aspx?EVT=0Hehe, I see why some people gets infected. Tricky.magicalclick0http://channel9.msdn.com/463445/Trackback.aspxI've actually almost been bitten by an autorun virus myself before, and it wasn't through that dialog (which is designed to make it easy to spot that something suspicious is going on).&nbsp; I had canceled the dialog and double-clicked the drive in Explorer, which (in XP, at least) runs the program designated to automatically run without prompting (even on a flash drive).&nbsp; AVG's on-access scanning saved my rear from that one--&nbsp; it's actually the only time I've seen a legitimate virus detected on my own machine (I've had a couple of false positives, but those don't count).<br><br>Does Vista show the dialog when you double-click on the drive in Explorer?<br>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463419Wed, 01 Apr 2009 19:17:56 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4634190http://channel9.msdn.com/463419/WebViewBug.aspx?EVT=0I've actually almost been bitten by an autorun virus myself before, and it wasn't through that dialog (which is designed to make it easy to spot that something suspicious is going on).&nbsp; I had canceled the dialog and double-clicked the drive in Explorer, which (in XP, at least) runs the program&#8230;JonathonW0http://channel9.msdn.com/463419/Trackback.aspxIt's an ISP thing here , luckily I have the entire .net framework memorized so I don't need msdn.http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463415Wed, 01 Apr 2009 18:42:40 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4634150http://channel9.msdn.com/463415/WebViewBug.aspx?EVT=0It's an ISP thing here , luckily I have the entire .net framework memorized so I don't need msdn.harumscarum0http://channel9.msdn.com/463415/Trackback.aspxMicrosoft.com is working just fine :)http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463359Wed, 01 Apr 2009 14:58:32 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633590http://channel9.msdn.com/463359/WebViewBug.aspx?EVT=0Microsoft.com is working just fine :)PaoloM0http://channel9.msdn.com/463359/Trackback.aspxMicrosoft.com is down so I wonder if it is from Conficker.http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463352Wed, 01 Apr 2009 14:44:12 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633520http://channel9.msdn.com/463352/WebViewBug.aspx?EVT=0Microsoft.com is down so I wonder if it is from Conficker.harumscarum0http://channel9.msdn.com/463352/Trackback.aspxThe USB thing looks like this:<BR><A href="http://www.microsoft.com/protect/images/viruses/Autoplay.jpg" rel=lightbox><IMG border=0 alt=" The option Open folder to view files — Publisher not specified was added by the worm." src="http://www.microsoft.com/protect/images/viruses/Autoplay.jpg"></A>&nbsp;<BR>And I doubt that you wouldn't think there's something strange...http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463350Wed, 01 Apr 2009 14:40:53 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633500http://channel9.msdn.com/463350/WebViewBug.aspx?EVT=0The USB thing looks like this:&nbsp;And I doubt that you wouldn't think there's something strange...Dorian Muthig0http://channel9.msdn.com/463350/Trackback.aspxI was just reading about this in the last PCPro magazine -- conficker seems to have several variants, but one of it's tricks in installing itself&nbsp;on a USB stick ...<BR><BR>If you've kept your PC patched you'll be OK, it's mainly affected in businesses where they don't patch PCs for fear of the patches breaking stuff.&nbsp; I don't think I've ever had a patch break stuff so I keep up to date all the time.<BR><BR>Herbie<BR>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463348Wed, 01 Apr 2009 14:35:04 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633480http://channel9.msdn.com/463348/WebViewBug.aspx?EVT=0I was just reading about this in the last PCPro magazine -- conficker seems to have several variants, but one of it's tricks in installing itself&nbsp;on a USB stick ...If you've kept your PC patched you'll be OK, it's mainly affected in businesses where they don't patch PCs for fear of the patches&#8230;Herbie Smith0http://channel9.msdn.com/463348/Trackback.aspxI'm not running an antivirus, but I doubt Conficker can do much of an&nbsp;RPC stack exploit behind a Linux powered NAT device that I call router. Of course the ports for the&nbsp;Windows File Sharing Service are not forwarded to the open.&nbsp;Therefore me not downloading or manually executing a Conficker file won't do any harm. Good, I'm safe. :)<BR><BR>How does that even work? This worming into the network? AFAIK you need an open port and data to send to the network application listening on that port that does execute some weird stuff for unexpected data streams, right? So how do all those people even get a worm on their computer, except for being stupid and opening files they don't know what they are?http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463345Wed, 01 Apr 2009 14:21:58 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633450http://channel9.msdn.com/463345/WebViewBug.aspx?EVT=0I'm not running an antivirus, but I doubt Conficker can do much of an&nbsp;RPC stack exploit behind a Linux powered NAT device that I call router. Of course the ports for the&nbsp;Windows File Sharing Service are not forwarded to the open.&nbsp;Therefore me not downloading or manually executing a&#8230;Dorian Muthig0http://channel9.msdn.com/463345/Trackback.aspxNo so according to <a href="http://www.asktheadmin.com/2009/03/april-1st-is-coming-beware-of-the-cornflicker-worm-and-impending-doom.html">sysadmin</a>. UAC or not running as administrator on XP usuallly cures a lot of ills. this is like the millenum bug that never emerged.<br><br>Hot air!<br><br>PS: April fools has been and gone now in Yorkshire.<br><br>Thank goodness.<br>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463340Wed, 01 Apr 2009 13:48:54 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633400http://channel9.msdn.com/463340/WebViewBug.aspx?EVT=0No so according to sysadmin. UAC or not running as administrator on XP usuallly cures a lot of ills. this is like the millenum bug that never emerged.Hot air!PS: April fools has been and gone now in Yorkshire.Thank goodness.vesuvius0http://channel9.msdn.com/463340/Trackback.aspxI thought pirated systems could still get security updates (for this exact reason:&nbsp; to prevent the spread of worms like this one across the internet).<br>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463338Wed, 01 Apr 2009 13:41:42 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633380http://channel9.msdn.com/463338/WebViewBug.aspx?EVT=0I thought pirated systems could still get security updates (for this exact reason:&nbsp; to prevent the spread of worms like this one across the internet).JonathonW0http://channel9.msdn.com/463338/Trackback.aspx<i>Who is at risk? <a name="risk"></a></i> <p><i>Users whose computers are not configured to receive patches and updates from Microsoft and who are not running an up to date antivirus product are most at risk. Users who do not have a genuine version of Windows from Microsoft are most at risk since pirated system usually cannot get Microsoft updates and patches.</i></p><p>That should rule out everybody here on Channel 9.<i><br></i></p>http://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=463336Wed, 01 Apr 2009 13:36:29 GMThttp://channel9.msdn.com/forums/Coffeehouse/463332-How-to-diagnose-and-defeat-the-dangerous-Conficker-worm/?CommentID=4633360http://channel9.msdn.com/463336/WebViewBug.aspx?EVT=0Who is at risk? Users whose computers are not configured to receive patches and updates from Microsoft and who are not running an up to date antivirus product are most at risk. Users who do not have a genuine version of Windows from Microsoft are most at risk since pirated system usually cannot get&#8230;vesuvius0http://channel9.msdn.com/463336/Trackback.aspx