Beware Conficker worm come April 1

[Devek]

When I go to system, there is not even anything about automatic updates.

[Nuriko]

Lots of things can break Windows Update so it's not a fool proof check. McAfee has a tool to specifically scan for Conficker if you want to try that:

Weblink for info: McAfee Threat Center
Direct Link to program: http://vil.nai.com/vil/conficker_sti...r_Coficker.exe

[Devek]

Well, I tried the McAfee tool and it didn't find anything, though I am pretty certain that I have more than 16k files on my machine so maybe the virus is messing with the scan tool?

http://img218.imageshack.us/img218/1894/mcafee.png

[Nuriko]

Yeah 16k does seem kind of low. From what I've read this virus isn't known to prevent anything other than the ability to connect to Windows Update and other well known security sites (probably including McAfee, Symantec, etc). You might have other issues that's causing the scanner to be unable to access other files on your computer or something, but that's just a shot in the dark.

[Darkhearted]

Crap, looks like I was infected.

Lol, on page 1 you were some great computer programmer. On page 2, you got owned. Maybe you can stomp Bill Gates programming into the ground like you claim, but I bet he didn't get this amateur worm.

[Devek]

inorite

[Kuya]

I'm pretty sure i got infected, wouldn't let me go to certain security sites. Went to a different computer and downloaded the windows tool to get rid of it.

[Aikar]

eh lot of confusion here with you guys lol.

The worm had already infected 10 million people BEFORE april first.

The scare was not about more people getting infected, the scare was what the owner was going to DO with those 10 million slaves.

Think of how much damage can be done with a 10 million strong botnet, the websites that could be shutdown, the level of propogation on scanning more IP addresses if a new exploit was found so the author could grow more.

Sniffing personal info such as CC/bank/other RL identifyable info.

Rogue application installation that asks you to pay for it.

The list goes on. The guy can hit many websites with ddos attacks, or steal millions of dollars.who knows what hes going to do, but he sure has ALOT of power.


------

t;dr: the april first was not some scare of people getting infected. It was a scare of what was going to happen to the 10 million people who were already infected.

[Norellicus]

Most virus-specific tools are trained to only look at specific files/locations instead of checking every file and folder for any possible threat, so that may explain the 16k filecount.

Also try going to update.microsoft.com from IE as opposed to using the control panel.

[Nuriko]

Majority of those millions of infected PCs are in China where most of the pirated copies of Windows are which can't even get the security updates due to WGA. I was reading an analysis by Symantec of the spread of version A of the worm and they noted 28.7% of all infected machines at the end of January were in China, 11.3% Argentina, 6.7% Taiwan, 6.2% Brazil, with the USA being significantly less.

edit: http://www.confickerworkinggroup.org...feyechart.html

[Dimmauk]

Christopher Null: The Working Guy

Conficker finally on the move

Last night, Conficker -- the computer worm that's had every computer user in a tizzy for weeks -- finally began to show signs of life. What exactly it's doing, no one's quite sure.

Here's the scoop: On April 8, Conficker began updating itself via Internet download, a process which became possible on the April 1 launch date. Before April 8, Conficker had been searching for updates but hadn't found any such instructions. Now they are finally being delivered.

What's in those instructions, though, remains a bit of a mystery: The downloaded programs are heavily encrypted, so they can't be analyzed in detail. We do know that, after installation, the instructions we can see are relatively benign: They tell the computer to check one of five random websites -- MySpace, eBay, AOL, CNN, and MSN -- in order to verify the computer has internet access. It then confirms the date and time.

After this, the downloaded software seemingly deletes itself, along with every trace that it had ever been installed (right down to the registry keys).

That doesn't mean it does delete itself, though. Some speculate that the downloaded software installs an as-yet undetectable rootkit on the machine that leaves the computer open for further compromise.

Curiously, the payload also includes instructions for Conficker to delete itself and stop running on May 3, though compromises already introduced -- and additional ones that may be downloaded over the next few weeks -- will leave any infected machine vulnerable to attack.

Research into exactly what's going on -- made difficult due to the encryption on the worm -- continues. (Trend Micro has more technical details if you're interested.) Stay tuned for more updates.