Kromulok Posted March 31, 2009 ID:68980 Share Posted March 31, 2009 Hello all,Just curious if there is any truth to some of the hype regarding the april fools day conficker worm and curious if malwarebytes has any updated definitions to deal with the threat if it is in fact real. Just thought I would start a discussion on this to see whats up. Link to post Share on other sites More sharing options...
DaChew Posted March 31, 2009 ID:68984 Share Posted March 31, 2009 https://forums2.symantec.com/t5/blogs/bloga.../article-id/252http://www.symantec.com/content/en/us/ente...p_codex_ed1.pdfHype?Looks pretty real to me Link to post Share on other sites More sharing options...
YoKenny1 Posted March 31, 2009 ID:68986 Share Posted March 31, 2009 60 Minutes did an article about it with interesting comments: The Internet Is Infectedhttp://www.cbsnews.com/video/watch/?id=4901282n Link to post Share on other sites More sharing options...
swagger Posted March 31, 2009 ID:68988 Share Posted March 31, 2009 This is a very real threat. Not sure if MBAM can do much but design some heuristics to try and detect the new variant. No one knows what the new variant will look like or do YET. In the meantime, get your system patched and updated through Windows Update. Link to post Share on other sites More sharing options...
Kromulok Posted March 31, 2009 Author ID:68996 Share Posted March 31, 2009 Here's another perspective...http://www.networkworld.com/news/2009/0327...t-is.html?t51hb Link to post Share on other sites More sharing options...
DaChew Posted March 31, 2009 ID:68998 Share Posted March 31, 2009 the jan norton's map of B? variant worldwide distribution is very interesting Link to post Share on other sites More sharing options...
PCGeek Posted March 31, 2009 ID:69083 Share Posted March 31, 2009 Hopefully this is a hype . I hope MBAM can destroy it. Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted March 31, 2009 Root Admin ID:69110 Share Posted March 31, 2009 I personally think it is an elaborate plot to distract everybody while they kidnap Bruce, our lead researcher. But that's just me. Link to post Share on other sites More sharing options...
Raid Posted April 1, 2009 ID:69203 Share Posted April 1, 2009 They'll give him back when they find out how much red bull he drinks everyday; Gets expensive. Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted April 1, 2009 Root Admin ID:69248 Share Posted April 1, 2009 Agreed. I wish Malwarebytes wouldn't be in debt because we buy so many energy drinks for him . Link to post Share on other sites More sharing options...
GT500 Posted April 1, 2009 ID:69289 Share Posted April 1, 2009 He's an expensive asset, but well worth it. Link to post Share on other sites More sharing options...
sho-dan Posted April 1, 2009 ID:69317 Share Posted April 1, 2009 Bruces town car. Link to post Share on other sites More sharing options...
YoKenny1 Posted April 1, 2009 ID:69322 Share Posted April 1, 2009 Hopefully this is a hype . I hope MBAM can destroy it.Bill Pytlovany of WinPatrol's experienceWednesday, April 01, 2009Conficker Activity on April Fools Day Everyone has been talking about the Conficker worm and predicting what will happen on April Fools Day. As a security researcher I have left one honeypot system infected with Conficker.c to see what would happen.Just after midnight, my windows desktop wall paper was drastically changed. No other changes were detected yet. I really feel violated. http://billpstudios.blogspot.com/2009/03/c...-fools-day.html Link to post Share on other sites More sharing options...
TerryS Posted April 7, 2009 ID:71082 Share Posted April 7, 2009 I read briefly, a few weeks ago, that they didn't expect it to be so big as originally feared because ISPs were able to somewhat block the spread with special real-time detection software for the behavior of data travelling though their system.Apparently, they did well. Link to post Share on other sites More sharing options...
exile360 Posted April 8, 2009 ID:71590 Share Posted April 8, 2009 I turned off the Server service long ago (and do every time I install Windows) as well as disabled the default admin shares so I'm immune from any variants I've seen so far. I'm not on a network either and all my flash drives use a custom autorun.inf file, so if it got infected and overwritten by conficker, I'd know it. Of course, my OS is fully patched as well. Link to post Share on other sites More sharing options...
paranoidsoul Posted April 12, 2009 ID:72656 Share Posted April 12, 2009 I turned off the Server service long ago (and do every time I install Windows) as well as disabled the default admin shares so I'm immune from any variants I've seen so far. I'm not on a network either and all my flash drives use a custom autorun.inf file, so if it got infected and overwritten by conficker, I'd know it. Of course, my OS is fully patched as well.Excuse me but what exactly does the server service do? Will it affect internet connection? Link to post Share on other sites More sharing options...
Maurice Naggar Posted April 12, 2009 ID:72667 Share Posted April 12, 2009 Theirs been plenty of media "buzz" about this malware and more than a fair share of scares.The latest variants of Conficker are bringing along some other rootkits to add to the mess.But, as a pc owner, pc user, your job 1 is to make sure your system is protected !Make sure to have applied the KB958644 Security Update, which Microsoft released last October 2008 !If you bring up Add-or-Remove programs, make sure it Shows all updates, do you see an entry Security Update for Windows (KB958644) ?If it is listed, the fix takes care of the vulnerability that Conficker depends on.If you do not have this fix, do this immediately:You may get the fix by clicking the link for your Windows version at this MS webpagehttp://www.microsoft.com/technet/security/...n/MS08-067.mspxor by making a direct visit to Windows Updatehttp://update.microsoft.comFor a quick visual test to see if your system is vulnarable to Conficker, visit this page at the Conficker Working Gouphttp://www.confickerworkinggroup.org/infec...cfeyechart.htmland also this page at the University of Bonnhttp://iv.cs.uni-bonn.de/fileadmin/user_up...ner/cfdetector/Then, as always, keep your antivirus and anti-malware and security apps up-to-date.Practice safe computing.Always keep up with Windows Updates. Link to post Share on other sites More sharing options...
Staff TeMerc Posted April 12, 2009 Staff ID:72680 Share Posted April 12, 2009 The most enlightening thing about all this Conficker nonsense is that 99% of the news is all about detailed analysis, not wide spread infection, of which to date, there has not been by any stretch. Link to post Share on other sites More sharing options...
TOM-J-LAEL Posted April 12, 2009 ID:72682 Share Posted April 12, 2009 honestly...doesn't every infection out there really have the potential to do what Conficker does? also, doesn't every worm already traverse the internet the same way? i mean, exploiting unpatched systems who are hooked straight into the internet, etc?where's the news exactly? you know? Link to post Share on other sites More sharing options...
exile360 Posted April 13, 2009 ID:72950 Share Posted April 13, 2009 Excuse me but what exactly does the server service do? Will it affect internet connection?Nope, it's used for sharing files, folders, and printers over a network, which I don't do since I use a standalone PC, so it is unneeded for me.honestly...doesn't every infection out there really have the potential to do what Conficker does? also, doesn't every worm already traverse the internet the same way? i mean, exploiting unpatched systems who are hooked straight into the internet, etc?where's the news exactly? you know?The danger in Conficker is the rate at which it propogates, the fact that it can crack network passwords, and has multiple attack vectors (ie networks, flash drives as well as the net). It's multitiered nature is what makes it so risky. Link to post Share on other sites More sharing options...
exile360 Posted April 27, 2009 ID:76454 Share Posted April 27, 2009 New info on Conficker Link to post Share on other sites More sharing options...
swagger Posted April 27, 2009 ID:76491 Share Posted April 27, 2009 Thanks for the update exile... I honestly thought it might have had a more severe plan than just spam and malware but I guess we can consider ourselves lucky. Especially with as many computers that are infected right now. Link to post Share on other sites More sharing options...
exile360 Posted April 27, 2009 ID:76492 Share Posted April 27, 2009 Yes, I thought so too. But with the estimated revenues being drawn from spam distribution and identity theft it does make a lot of sense. Just consider the most common targets of MBAM: Rogues and Trojans, both are designed to steal cash or scam cash out of infected users. It's a big money market in an otherwise hurting economy. Link to post Share on other sites More sharing options...
swagger Posted April 27, 2009 ID:76510 Share Posted April 27, 2009 It just baffles me, how many people open up their wallets or purses and pay for this stuff... I know it looks pretty legit but for something to just pop up out of no where, would kind of throw up red flags to me. Link to post Share on other sites More sharing options...
mountaintree16 Posted May 26, 2009 ID:83700 Share Posted May 26, 2009 I was just reading through this thread and I just wanted to ask you exactly what you mean by this?I'd like to be able to do it to my computer if possible.I turned off the Server service long ago (and do every time I install Windows) as well as disabled the default admin shares so I'm immune from any variants I've seen so far. I'm not on a network either and all my flash drives use a custom autorun.inf file, so if it got infected and overwritten by conficker, I'd know it. Of course, my OS is fully patched as well. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now