Conficker Flaw Found: Security Experts Say Detection Now Easier

rookietrucker · Mar 30, 2009

Conficker Flaw Found: Security Experts Say Detection Now Easier

Gregg Keizer, Computerworld
Mar 30, 2009 1:54 pm

Just days before the Conficker worm is set to contact its controllers for new instructions, security researchers have discovered a flaw in the worm that makes it much easier for users to detect infected PCs.

Tillmann Werner and Felix Leder, members of the Honeynet Project, an all-volunteer organization that monitors Internet threats, have discovered that Conficker-infected PCs return unusual errors when sent specially crafted Remote Procedure Call (RPC) messages, according to preliminary information they have posted on the Web.

There's a growing urgency in the battle against Conficker as Wednesday approaches. PCs infected with Conficker.c, the third version of the worm, will use a new communication scheme starting April 1 to establish a link to the command-and-control servers operated by the hackers. What's troubling to researchers is that they have no clue about what orders the worm's makers will give those machines.

More here>> Conficker Flaw Found: Security Experts Say Detection Now Easier
Click to expand...

This is good news, hopefully they will have a patch out before midnight tomorrow night.

Cybergal · Mar 31, 2009

Last-minute Conficker survival guide
3/31/09

Tomorrow -- April 1 -- is D-Day for Conficker, as whatever nasty payload it's packing is currently set to activate. What happens come midnight is a mystery: Will it turn the millions of infected computers into spam-sending zombie robots? Or will it start capturing everything you type -- passwords, credit card numbers, etc. -- and send that information back to its masters?
No one knows, but we'll probably find out soon.
Or not. As Slate notes, Conficker is scheduled to go "live" on April 1, but whoever's controlling it could choose not to wreak havoc but instead do absolutely nothing, waiting for a time when there's less heat. They can do this because the way Conficker is designed is extremely clever: Rather than containing a list of specific, static instructions, Conficker reaches out to the web to receive updated marching orders via a huge list of websites it creates. Conficker.C -- the latest bad boy -- will start checking 50,000 different semi-randomly-generated sites a day looking for instructions, so there's no way to shut down all of them. If just one of those sites goes live with legitimate instructions, Conficker keeps on trucking.
http://tech.yahoo.com/blogs/null/132464
Click to expand...

rookietrucker · Mar 31, 2009

I hope everyone has there anti-virus updated before midnight or go in and manually get it to update. I hope this is just another flop like W2K.

rookietrucker · Apr 1, 2009

Last-minute Conficker survival guide

Tue Mar 31, 2009 1:42PM EDT

Conficker's a nasty little worm that takes serious efforts to bypass your security defenses, but you aren't without some tools in your arsenal to protect yourself.

Your first step should be the tools you already have: Windows Update, to make sure your computer is fully patched, and your current antivirus software, to make sure anything that slips through the cracks is caught.

But if Conficker's already on your machine, it may bypass certain subsystems and updating Windows and your antivirus at this point may not work. If you are worried about anything being amiss -- try booting into Safe Mode, which Conficker prevents, to check -- you should run a specialized tool to get rid of Conficker.

Microsoft offers a web-based scanner (note that some users have reported it crashed their machines; I had no trouble with it), so you might try one of these downloadable options instead: Symantec's Conflicker (aka Downadup) tool, Trend Micro's Cleanup Engine, or Malwarebytes.

Conficker may prevent your machine from accessing any of these websites, so you may have to download these tools from a known non-infected computer if you need them. Follow the instructions given on each site to run them successfully. (Also note: None of these tools should harm your computer if you don't have Conficker.)

As a final safety note, all users -- whether they're worried about an infection or know for sure they're clean -- are also wise to make a full data backup today.

What won't work? Turning your PC off tonight and back on on April 2 will not protect you from the worm (sorry to the dozens of people who wrote me asking if this would do the trick). Temporarily disconnecting your computer from the web won't help if the malware is already on your machine -- it will simply activate once you connect again. Changing the date on your PC will likely have no helpful effect, either. And yes, Macs are immune this time out. Follow the above instructions to detect and remove the worm.

More here>> http://tech.yahoo.com/blogs/null/132464/last-minute-conficker-survival-guide/
Click to expand...

Cybergal · Apr 1, 2009

Feared PC Virus Activates Harmlessly -- So Far
4/1/09

Computer experts watched warily Wednesday as a virus infecting millions of PCs activated itself as predicted on April 1.
But fears of Internet chaos have proven unfounded so far as machines infected with the Conficker worm tried to establish a link to command servers, as expected beginning at midnight, to no ill effect.
http://www.foxnews.com/story/0,2933,512000,00.html
Click to expand...

tucker · Apr 1, 2009

I cleaned up my computer files and ran the anti-virus last night and me so happy it worked today.
I didn't like that second story up there CyberGal, I hope they catch that man.

Cybergal · Apr 1, 2009

tucker said: ↑

I cleaned up my computer files and ran the anti-virus last night and me so happy it worked today.
I didn't like that second story up there CyberGal, I hope they catch that man.
Click to expand...

I hope so too..........

Log in or Sign up

Forums

Find Trucking Jobs

Conficker Flaw Found: Security Experts Say Detection Now Easier

rookietrucker Trucker Forum STAFF Staff Member

Trucking Jobs in 30 seconds

Wait, employers can't reach you!

Cybergal Road Train Member

rookietrucker Trucker Forum STAFF Staff Member

rookietrucker Trucker Forum STAFF Staff Member

Cybergal Road Train Member

tucker Road Train Member

Cybergal Road Train Member

Trucking Jobs in 30 seconds

Wait, employers can't reach you!

Log in or Sign up

Useful Searches

Find Trucking Jobs

Conficker Flaw Found: Security Experts Say Detection Now Easier

rookietrucker Trucker Forum STAFF Staff Member

Wait, employers can't reach you!

Cybergal Road Train Member

rookietrucker Trucker Forum STAFF Staff Member

rookietrucker Trucker Forum STAFF Staff Member

Cybergal Road Train Member

tucker Road Train Member

Cybergal Road Train Member

Wait, employers can't reach you!