Conficker

[Saiyaman 0]

In an event that hits the computer world only once every few years, security experts are racing against time to mitigate the impact of a bit of malware which is set to wreak havoc on a hard-coded date. As is often the case, that date is April 1.

Malware creators love to target April Fool's Day with their wares, and the latest worm, called Conficker C, could be one of the most damaging attacks we've seen in years.

Conficker first bubbled up in late 2008 and began making headlines in January as known infections topped 9 million computers. Now in its third variant, Conficker C, the worm has grown incredibly complicated, powerful, and virulent... though no one is quite sure exactly what it will do when D-Day arrives.

Thanks in part to a quarter-million-dollar bounty on the head of the writer of the worm, offered by Microsoft, security researchers are aggressively digging into the worm's code as they attempt to engineer a cure or find the writer before the deadline. What's known so far is that on April 1, all infected computers will come under the control of a master machine located somewhere across the web, at which point anything's possible. Will the zombie machines become denial of service attack pawns, steal personal information, wipe hard drives, or simply manifest more traditional malware pop-ups and extortion-like come-ons designed to sell you phony security software? No one knows.

Conficker is clever in the way it hides its tracks because it uses an enormous number of URLs to communicate with HQ. The first version of Conficker used just 250 addresses each day -- which security researchers and ICANN simply bought and/or disabled -- but Conficker C will up the ante to 50,000 addresses a day when it goes active, a number which simply can't be tracked and disabled by hand.

At this point, you should be extra vigilant about protecting your PC: Patch Windows completely through Windows Update and update your anti-malware software as well. Make sure your antivirus software is actually running too, as Conficker may have disabled it.

Just a warning for you who don't know about it.

I advise you all to update

http://www.microsoft.com/technet/security/...n/MS08-067.mspx

[EarthwormJim 1]

not a problem for my new pc as its never been online.... or even had anything installed on it....

has been switched on tho

but yeah irst thing i do when i first connect it is update everything

[hscitpe 6]

I'm unplugging all of my internet connected computers before I leave for Florida (Universal Studios, I'll post pics of the Clocktower)

[«PC» 0]

FAIL

[EarthwormJim 1]

hscitpe the clocktowers in LA, i been there.

[hscitpe 6]

I know but I thought they had a duplicate at US Florida? If not F that I'm not going

[«PC» 0]

FAIL

IT was already installed back in February 11, 2009 by Windows Update.

[Orgcon 11]

I'd still go, it can't be as bad as Univesal Studios, England XD No rides, no sets nothing! It was like THE most boring museum of replicas I've ever had the misfortune to lay my eyes upon Even Granada Studios was better

[EarthwormJim 1]

you were going to florida JUST to see the clocktower?

DUUUUUUUUUUUUUUUUUUUUUUUUUUUURRRRRRRR

back on topic guys

Edited March 27, 2009 by EarthwormJim

[Orgcon 11]

I've warned all my friends about Conflicker, whatever good that'll do they know nothing about computers

Do you reacon it'll cause a Firesale?

[Joe Statler 0]

Well, I wonder if it's going to be dead here on the 1st. Since some ppl won't be willing to go online, it seems. Maybe even me. I may just forget about the whole damn thing.

[archer9234 20]

The article was posted in Oct of last year. So if you update normally, you already have it.

[♠Grim♂ Reaper 1666◙ 17]

i m at school on the 1st i m going to be on the internet for as long as i can

muh ha ha ha...

and my computer is going to be off and unplugged.

[raybob 0]

Definetly better to be safe than sorry, but these people all seem to think that it's fake:

http://www.thegtaplace.com/forums/index.php?showtopic=22573

[daangelo29 5]

@raybob: Let them be. About 10 websites I visited, this forum site included as well as websites like Yahoo!, already warned me numerous times about an "April Fool's Day virus". Also, a friend of mine already became a victim of the same virus last year. The thing was hard to remove.

I really don't know how the virus works, but don't feel so lucky, even if you're using Windows Vista and other OS's that has "compatibility problems" because you guys think that the virus will just make programs crash and all because of the "incompatibility".

Speaking of which, a p***ed off friend of mine sent me a similar virus before via email. When it was sent and activated my anti-viruses can't detect it, and it allowed him to gain full access to my PC's OS (including the mouse). It's probably the most powerful virus I've ever encountered. I was in 3rd year high school when it happened, and a lot of screw-ups happened after that. Now, I'm beginning to think he's one of those who made the Conflicker C virus.

[Joe Statler 0]

@angleo....

Also I response your responses, I do feel they are a little longe. This forming from a from font a... OK O Gove ip, screw it, I don't car, let the care it care what it what it will be be,,,,

Keep in mind I'm really brunk, so don't dank this. serioisely,,,,

WOOH. I Can see the air!

[daangelo29 5]

Just edited it. Ironically, I tend to make longer posts when I'm tired/drowsy/sleepy.

And next time, don't post if you're drunk. It will just make people think you're spamming. Other than making screwed up posts, you're easy to influence by any person in the internet -- for instance, during a Y!M conversation my couz made a friend of mine bunny hop and do other stuff that ticked me off in front of her webcam. She felt really embarrassed the following days that she never touched the computer or went online at all for 3 weeks. You better stay off the computer if you don't want the same thing to happen.

[Joe Statler 0]

@angleo....

Also I response your responses, I do feel they are a little longe. This forming from a from font a... OK O Gove ip, screw it, I don't car, let the care it care what it what it will be be,,,,

Keep in mind I'm really brunk, so don't dank this. serioisely,,,,

WOOH. I Can see the air!

Wow! I don't remember posting that. And I can't believe that I type like that when I am drunk. I gotta lay off the brandy.

[Billz 0]

Anyway.

So I should already have the Conflicker Blocker patch from Microsoft (heard about this virus in a newspaper, go figure ) since I have never turned Microsoft Automatic Updates off on this computer (Windows Vista Home Premium SP1)?

Is there any other way to make sure that my computer doesnt get infected? I heard AVG 8 is good for removing Conflicker. I've had AVG 8 for months and it has blocked almost every attack on my PC. A small trojan got through once but that was easily removed.

Edited March 29, 2009 by Billz

[daangelo29 5]

I'm currently having a conversation with my HLS team about the virus, since many of us (including forum members) are speculating that it's fake, and April 1 is near. One of the Australian team members even gave a sample of the virus to the annoying forum member that kept spamming us that the virus is fake. Deserves him anyway.

Also we're not sure which April 1 is it, since we all have different time zones. The virus creator's time zone could be ahead of ours or behind ours. Whatever it is, it would be wise to know 'cause we might experience the virus attacking at a non-April 1 date.

Conficker is named either one of the following. If any of these names pop-up in your anti-virus, you have it:

1. Win32/Conficker.A
   
2. W32.Downadup (Symantec)
   
3. W32/Downadup.A (F-Secure)
   
4. Conficker.A (Panda)
   
5. Net-Worm.Win32.Kido.bt (Kaspersky)
   
6. W32/Conficker.worm (McAfee)
   
7. Win32.Worm.Downadup.Gen
   

UPDATE: I just found the Conficker virus itself in my friend's flash drive. The virus completely fooled Vista's/Win7's, where I begin to see two "Open folder to view files" options in Autoplay, one of which is under the "Install or run program" and says "Publisher not specified" in its subtitle. Also I'm beginning to receive suspicious group messages from my friends in Yahoo! Messenger that have links in it, and the same group messages are repeated by others -- it was though as if they are AUTOMATICALLY sent. I later found out that my friend might have received the virus via one of those group messages, and somehow the virus made a duplicate on his flash drive. This virus is more powerful than I thought.

[Billz 0]

So, no hope against blocking it altogether then for any of us?

[daangelo29 5]

So, no hope against blocking it altogether then for any of us?

Install the "Conficker" patch provided by Microsoft. Update your anti-viruses. Scan for viruses. Remove the Conficker virus. And/Or you can close your internet during April 1. That's about everything you can do at the moment.

Note that Conficker only affects Windows OS's. Mac users and Linux users are safe from this virus (that's good news to me; most of my important personal data are stored in my Mac).

EDIT: Who renamed the topic to "Conflicker"? The correct spelling of the name is "Conficker" (without the L).

[Joe Statler 0]

maybe I should just run Linux on april fools day. Since it is on my slave. Well anyways that's the day I'm getting an Endoscopy (camera shoved down my throat) and I'll be under heavy sedation. So I probably won't be in any condition to go on the internet anyways.

[Billz 0]

maybe I should just run Linux on april fools day. Since it is on my slave. Well anyways that's the day I'm getting an Endoscopy (camera shoved down my throat) and I'll be under heavy sedation. So I probably won't be in any condition to go on the internet anyways.

Just be thankful its an Endoscopy and not a Colonoscopy (camera shoved up your back side). That is not pleasent, let me tell you.

Back on topic,

I'm pretty much upto date thanks to the auto updates from Microsoft then? In that case, I'll just disconnect from the internet before April 1st and stay disconnected until sometime April 2nd.

Following that, running a scan with AVG 8 just to make sure.

Is that pretty much what you suggest?

[Joe Statler 0]

I have a colonoscopy scheduled for friday, so...

This will be my 3rd one within a year.

But really I wouldn't recommend using AVG. I just ran a scan using it the other day and it found all these infections, but wasn't able to delete them, so I had to use HijackThis and SDFix to get rid of them. I think I may go back to using Avast.