Author Topic: VIRUS ALERT Cornficker to activate April 1st (Read 38948 times)

BlackNMild2k1 · « **on:** March 31, 2009, 03:51:20 AM »

Quote

First scan your pc with this, it should detect all variants. This is a tool made by Microsoft and it's free:
http://onecare.live.com/site/en-us/default.htm

Keep your windows installation updated, for gods sake. You have no excuse!

Quote
Conficker, also known as Downup, Downadup and Kido, is a computer worm that surfaced in October 2008 and targets the Microsoft Windows operating system.[1] The worm exploits a previously patched vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, Windows 7 Beta, and Windows Server 2008 R2 Beta.[2] The worm has been unusually difficult for network operators and law enforcement to counter because of its combined use of advanced malware techniques.[3][4]
http://en.wikipedia.org/wiki/Conficker

Quote
Experts say it is the worst infection since 2003's SQL Slammer.[14] Estimates of the number of computers infected range from almost 9 million PCs[15][16] to 15 million computers.[17]

Quote
The worm has several mechanisms for pushing or pulling executable payloads over the network. To prevent payloads from being hijacked, variant A payloads are RC4-encrypted with a 512-bit key and RSA signed with a 1024-bit key; the payload is unpacked and executed only if the signature verifies with a public key embedded in the worm. Variant B increases the size of the RSA key to 4096 bits. So far, this has been used only to propagate newer versions of the worm.

* Variant A generates a list of 250 domain names every day across 5 Top-level domains (TLD). It attempts an HTTP connection to each in turn, expecting from any of them a signed payload.[4] As a countermeasure, ICANN and several TLD registrars began in February 2009 a coordinated barring of transfers and registrations for these domains.
o Variant C contains code to sidestep these countermeasures by generating an expanded daily list of 50000 domains across 110 TLDs. This new pull mechanism, however, is disabled until April 1.[7][10][3]
* Variant B creates a named pipe, over which it can push URLs for downloadable payloads to other infected hosts on a local area network.[10]
* Variant C creates an ad-hoc peer-to-peer network to push and pull payloads over the wider Internet. This aspect of the worm is heavily obfuscated in code and not fully understood, but has been observed to use large-scale UDP scanning to build up a peer list of infected hosts and TCP for subsequent transfers of signed payloads. To make analysis more difficult, port numbers for connections are hashed from the Internet Protocol address of each peer.[10]

So nobody really knows whats going to happen on April 1st. I would recommend everybody to scan and update their systems, as to not risk being part of the giant zombie botnet that will start looking for instruction in two days. Patch your stuff!

http://onecare.live.com/site/en-us/v...32/Conficker.B
More detailed info about the worm....

http://www.microsoft.com/technet/sec.../MS08-067.mspx
Just pick your OS out of the table of links and update.

[/size]

I found this on another site. Just thought I would share.
Links to more details at the bottom of quote.
all of this is found on the MS website

Plugabugz · « **Reply #1 on:** March 31, 2009, 05:32:23 AM »

Yes this thing was a total pain to get rid of. I had up to date anti virus and it still got like that.

http://forums.majorgeeks.com/showthread.php?t=139313

This may help

EasyCure · « **Reply #2 on:** March 31, 2009, 09:32:21 PM »

guess I'm screwed. that free scan won't work for me and I've tried nearly 10 times.

I'll see you guys when i decide to spend money on adequate anti-virus programs!

GoldenPhoenix · « **Reply #3 on:** March 31, 2009, 09:41:30 PM »

Quote from: EasyCure on March 31, 2009, 09:32:21 PM

guess I'm screwed. that free scan won't work for me and I've tried nearly 10 times.

I'll see you guys when i decide to spend money on adequate anti-virus programs!

The world will be over after tomorrow. So you may NEVER see us again! Supposedly this virus may be controlled by a central system which will in turn create SkyNet which means ARMAGEDDON. Be scared!

stevey · « **Reply #4 on:** March 31, 2009, 09:54:37 PM »

Y2k #2?

~~seriously, why not just set you're clocks ahead a day?~~

never mind....

NWR_pap64 · « **Reply #5 on:** March 31, 2009, 10:12:46 PM »

Uh yeaaaaaaaahh no.

I'll gladly take my chances.

BlackNMild2k1 · « **Reply #6 on:** March 31, 2009, 10:13:27 PM »

Quote from: EasyCure on March 31, 2009, 09:32:21 PM

guess I'm screwed. that free scan won't work for me and I've tried nearly 10 times.

I'll see you guys when i decide to spend money on adequate anti-virus programs!

Quote from: Plugabugz on March 31, 2009, 05:32:23 AM

Yes this thing was a total pain to get rid of. I had up to date anti virus and it still got like that.

http://forums.majorgeeks.com/showthread.php?t=139313

This may help

NinGurl69 *huggles · « **Reply #7 on:** March 31, 2009, 10:18:06 PM »

Quote from: EasyCure on March 31, 2009, 09:32:21 PM

guess I'm screwed. that free scan won't work for me and I've tried nearly 10 times.

I'll see you guys when i decide to spend money on adequate anti-virus programs!

There's no such thing as adequate anti-virus programs, even paid ones.

The more "full-proof" the antivirus suite is, the bigger it is, the more obtrusive it is, the more anal it is, the more resources it takes up, and the more likely it'll run into false positives or unneeded security warnings. YOU'RE ABOUT TO VISIT...GONINTENDO.COM... ARE YOU SURE THIS IS SAFE? YES/NO

Just run your Windows Updates for now.

If you want to try a free AV tool, goto www.pctools.com. I only scan every other month; all other times I have the program disabled from startup (give me back my resources!).

If you think you might have naughty but dormant ad/spyware, or any other badware in general, try "Trojan Remover" -- this **** works. It's only a 30-day trial tho, but running once was enough to solve problems with different people's computers I offered to fix.

ShyGuy · « **Reply #8 on:** March 31, 2009, 10:36:52 PM »

Trojan remover is very very good. It's probably the fastest malware tool on the market and it has the added benefit or re-enabling the Windows policies if the attack has disabled them.

SuperAntiSpyware is also very good and fast.

BlackNMild2k1 · « **Reply #9 on:** March 31, 2009, 10:47:10 PM »

I also use Malwarebytes Anti-Malware

Stogi · « **Reply #10 on:** March 31, 2009, 10:48:15 PM »

TOO MUCH PR0N

ShyGuy · « **Reply #11 on:** March 31, 2009, 10:48:47 PM »

I would consider Malwarebytes Anti-Malware the third best right now. It is also good.

Stogi · « **Reply #12 on:** March 31, 2009, 10:59:49 PM »

So I did the scans and it looks like I don't have AIDS!

HURRAY!

GoldenPhoenix · « **Reply #13 on:** March 31, 2009, 11:03:30 PM »

Skynet/Conficker C begins to learn at a geometric rate. It becomes self-aware at 12:00am Eastern Time.

NinGurl69 *huggles · « **Reply #14 on:** March 31, 2009, 11:13:23 PM »

Quote from: Kashogi Y. Stogi on March 31, 2009, 10:48:15 PM

TOO MUCH PR0N

I learned a lot this way.

stevey · « **Reply #15 on:** March 31, 2009, 11:22:58 PM »

Quote from: Kashogi Y. Stogi on March 31, 2009, 10:48:15 PM

Not enough PR0N to fill up the Hard Drive

fix

NinGurl69 *huggles · « **Reply #16 on:** March 31, 2009, 11:28:07 PM »

stevey has massive hard drive

http://www.youtube.com/watch?v=OL5U6fbXCxU
THE WORM EXISTS

Stogi · « **Reply #17 on:** March 31, 2009, 11:30:23 PM »

HOLY ****!

NWR_pap64 · « **Reply #18 on:** April 01, 2009, 12:44:06 AM »

That made my skin crawl...for real.

ThePerm · « **Reply #19 on:** April 01, 2009, 12:55:49 AM »

**** this im installing linux. As software goes, grey ninja is always right!

NinGurl69 *huggles · « **Reply #20 on:** April 01, 2009, 01:01:00 AM »

Quote from: pap64 on April 01, 2009, 12:44:06 AM

That made my skin crawl...for real.

Water Temple BOSS

King of Twitch · « **Reply #21 on:** April 01, 2009, 01:10:03 AM »

I never allow windows to update, it'll just break something and take up space at the same time. Like on Wii

ThePerm · « **Reply #22 on:** April 01, 2009, 01:25:39 AM »

damnit installed the wrong version of linux! doesnt read my raid drive

ShyGuy · « **Reply #23 on:** April 01, 2009, 03:06:10 AM »

I'm waiting for the 9.04 version of Kubuntu.

NinGurl69 *huggles · « **Reply #24 on:** April 01, 2009, 03:25:56 AM »

Looks like the coast is clear.

GREENLIGHT THE PR0N

News:

Author Topic: **VIRUS ALERT** Cornficker to activate April 1st (Read 38948 times)

Author Topic: VIRUS ALERT Cornficker to activate April 1st (Read 38948 times)