Beware Conficker worm come April 1

[Dimmauk]

Beware Conficker worm come April 1

Tue Mar 24, 2009 6:21PM EDT


In an event that hits the computer world only once every few years, security experts are racing against time to mitigate the impact of a bit of malware which is set to wreak havoc on a hard-coded date. As is often the case, that date is April 1.

Malware creators love to target April Fool's Day with their wares, and the latest worm, called Conficker C, could be one of the most damaging attacks we've seen in years.

Conficker first bubbled up in late 2008 and began making headlines in January as known infections topped 9 million computers. Now in its third variant, Conficker C, the worm has grown incredibly complicated, powerful, and virulent... though no one is quite sure exactly what it will do when D-Day arrives.

Thanks in part to a quarter-million-dollar bounty on the head of the writer of the worm, offered by Microsoft, security researchers are aggressively digging into the worm's code as they attempt to engineer a cure or find the writer before the deadline. What's known so far is that on April 1, all infected computers will come under the control of a master machine located somewhere across the web, at which point anything's possible. Will the zombie machines become denial of service attack pawns, steal personal information, wipe hard drives, or simply manifest more traditional malware pop-ups and extortion-like come-ons designed to sell you phony security software? No one knows.

Conficker is clever in the way it hides its tracks because it uses an enormous number of URLs to communicate with HQ. The first version of Conficker used just 250 addresses each day -- which security researchers and ICANN simply bought and/or disabled -- but Conficker C will up the ante to 50,000 addresses a day when it goes active, a number which simply can't be tracked and disabled by hand.

At this point, you should be extra vigilant about protecting your PC: Patch Windows completely through Windows Update and update your anti-malware software as well. Make sure your antivirus software is actually running too, as Conficker may have disabled it.

Microsoft also offers a free online safety scan Windows Live OneCare safety scanner: Free online tool for PC health and safety, which should be able to detect all Conficker versions.

Get Firefox and AVG etc....

[Ramor]

sounds like fun, i'm curious as to what is meant by coming under control of a single computer, wonder if the writer is just gonna be remotely dicking around people's computers, would be odd

[Devek]

I tried to download and run this worm, but I couldn't get it to work.

[Nuriko]

I could be mistaken, but didn't MS patch the exploit Conflicker uses late last year? Last I heard you were only vulnerable if you don't stay up to date on MS Security Updates.

[Gulkeeva]

Should be interesting to see what happens!

[Nekonaruto]

Skynet...wink wink.

[Kael]

I could be mistaken, but didn't MS patch the exploit Conflicker uses late last year? Last I heard you were only vulnerable if you don't stay up to date on MS Security Updates.

Apparently the virus was updated as well.

But they say that if you do your MS Security Updates then you should be safe.

[Zalius]

bill gates prolly wrote it

[Senoska]

Except bill gates cant write shit except stolen code.

[Koyuki]

Except bill gates cant write shit except stolen code.

Don't hate.

[Sythe]

Good thing all i DL is porn from seedy websites! Oh and torrents from strangers I guess.

[Chen]

lonely people will be hit hardest by this! lol

[Demosthenes]

Except bill gates cant write shit except stolen code.

The irony here is that his code is better than steve jobs.

[guartz]

boogy woogy, update windows so we know you have legit copy.

[MisterBob]

Except bill gates cant write shit except stolen code.

ITT people who have no clue about what they are talking about

[Devek]

Actually he can't really write code.

The only project he was personally involved with was basic. He did not do the majority of the work, but he did manage to steal the computer time to get it done which counts for something.

I could stomp bill gates in the ground when it comes to programming, but he can stomp me in the ground when it comes to business. One of us is rich beyond comprehension while the other one of us is in 6 digits of debt..

[MisterBob]

Actually he can't really write code.

The only project he was personally involved with was basic. He did not do the majority of the work, but he did manage to steal the computer time to get it done which counts for something.

I could stomp bill gates in the ground when it comes to programming, but he can stomp me in the ground when it comes to business. One of us is rich beyond comprehension while the other one of us is in 6 digits of debt..

That was kind of the point of what I said, but thanks.

[Olo401]

ITT people who have no clue about what they are talking about

Actually the only thing he's wrong about is his grammar. Most, if not all, of Microsoft's original batch of programs were made with hacked code from other companies, most notably IBM-DOS and the base code for OS/2 (which was eventually shaped into the Windows shell and NTFS).

[MisterBob]

Actually the only thing he's wrong about is his grammar. Most, if not all, of Microsoft's original batch of programs were made with hacked code from other companies, most notably IBM-DOS.

I think you're missing the point here

[Olo401]

That it doesn't matter?

As a person who values truth in historical facts, I tend to disagree.