Expert: Worm spreading in many ways becoming an epidemic
A worm that spreads via removable devices, network shares, and weak administrator passwords--in addition to exploiting a critical Windows vulnerability--is spreading so fast it is becoming an epidemic, a security researcher said on Thursday.
The worm, known as Kido, Conficker, or Downadup, initially exploited MS08-067, a vulnerability considered critical for Windows 2000, XP, and Server 2003. It was patched in October.
Newer variants have been configured to give the worm the ability to infect via other means to get onto the network, said Roel Schouwenberg, a senior antivirus researcher at Kaspersky Lab.
"The Kido authors are trying to get into these networks by infected removable devices and by using other Trojans to install Kido on a computer, which will then try to infect other machines on the local network," he said in an e-mail statement. The worm "is currently causing an epidemic."
An estimated 3.5 million computers are believed to be infected with the worm, ZDNet reports.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
http://tech.blorge.com/Structure:%20/2009/01/17/beware-the-windows-worm-conficker-downadup-kido-rampant/
http://www.webmasterworld.com/microsoft_windows_os/3827789.htm
Let's see some details of what it does. I like to stay in the loop when I can.
So, how many of these 3.5 million infected machines run OSX or Linux?
Okay, that was cheap, but I just had to... :)
Back to the serious note though - I'd like to see what other vulns this thing is trying to exploit. They only list one, but say that others are present... which others?
Being the #1 o/s by about a million to one sure puts Windoze in the bad guys cross hairs.
Lucky for those marginal operating systems . (sorry, couldn't help it)
(...and while we're at it, if your logic actually held water my dear fanboi, then 10% of all malware out there would be Mac-oriented, and 65% of all web/public server-oriented malware would be targeting Linux... the figure is more like 0% at this time - on either count. Please, explain that if you would ;) ).
?This malware mostly spreads within corporations but also was reported by several hundred home users. It opens a random port between port 1024 and 10000 and acts like a web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP using the random port opened by the worm. The worm often uses a .JPG extension when copied over and then it is saved to the local system folder as a random named dll. It is also interesting to note that the worm patches the vulnerable API in memory so the machine will not be vulnerable anymore. It is not that the malware authors care so much about the computer as they want to make sure that other malware will not take it over too.?
Reference link: http://blogs.zdnet.com/security/?p=2228
Keep in mind this vuln (MS08-067) was patched a few months ago, so if you've kept up with the patch cycle you should be ok against this.
Lucky for those marginal operating systems . (sorry, couldn't help it)"
Could help what? Being an idiot?
This couldn't happen on the higher end OS's because they have a superior architecture.
and pen...your arguement about 10% market share should have 10% the malware is an absolute joke. why waste time on such small segment, and dont say its due to the fact that osx is harder to crack, cause any user that thinks they are totally secure and without exploit, be it linux or osx is in a dreamworld. any system can be exploited.
and msslayer....superior, then why doesnt everyone have one..................
there are security flaws that effect osx. its just that nobody takes advantage of them. windows has the larger marketshare and a stranglehold on the business market. thats where the money is. and to say that because macs have 10 percent market share therefore 10 percent of malware shoud target macs is the logic of a child. pcs are the targets with all the rootkits available and most of the grunt work done when creating malware. there is no reason to take the path less traveled when that path will only lead to a 10 percent of the market.
An atheist who believes very strong science is near-to-proving ID in biological life. (Flame away evolution believers, you clearly have more faith than I do to believe in the evolution fairy tale.)
Oh, wait, I see now you have updated the story to remove the word EVOLVED. Congrats, common sense prevails.
I know which fairy tale I'd rather believe.
As for the worm, I don't really care what it worships. It's a bad thing anyway. Will it burn in hades because it's bad or because it doesn't believe in the right deity?
What's more likely.... that the natural world has order... or that some mystical being known only to us "designed" us.. bad knees and all.
Windows users please upgrade to Vista or switch to the Mac OS like I did (or Linux if you are adventurous). Vista Home edition is cheap and can install and run on hardware purchased in the last 5 years easy. I have it on my Mac too via Bootcamp and it isn't bad at all.
A storm is brewing because MS is incompetent.
Bedsides the flaw that this worn is using was released for 200, XP, server 2003, and yes Vista.
That 'ding' you just heard is telling you the fries are ready.
Hint: Patch management is normally run on its own separate server (e.g. MSFT's System Center Config Manager if you're using 'doze workstations).
no matter how "secure" youre apple system is and how great you think it is, its not made for large work environments, and not made for wide use applications.
Balmesh
http://macdailynews.com/index.php/weblog/comments/19773/
MS wouldn't do such a thing!
(I'd sue them!)
A team of security researchers headed by Dr. Muddassar Farooq at Next Generation Intelligent Networks Research Center (nexGIN RC, http://www.nexginrc.org), FAST National University Islamabad, Pakistan have been working on a next-generation anti-malware solution that has the ability to detect a given malware without a priori information about it. Consequently, it successfully detects a "zero-day malware". The product prototype of the solution is expected to be rolled out in near future. Researchers have collected samples of Conficker from a well-known malware consultancy firm OffseniveComputing.Org (based in the US) and scanned it using the developed prototype. Their solution not only detects Conficker and its variants but also provides useful forensic information about its functionality. Researchers believe that this groundbreaking achievement is made possible by a novel approach that--in contrast to the existing antivirus products--does not require any signature updates. They envision that the product, once fully developed, can realize "once-deployed-forever-protected" dream.
The on-going project is funded by National ICT R&D fund, Ministry of Information Technology, Pakistan (http://www.ictrdf.org.pk). The link to project can be found at: http://www.nexginrc.org/index.php?option=com_content&view=article&id=3&Itemid=35
I've got this virus, and could use a little help. I'm on my home computer, and whereas I know enough to install a video card, play around with my configuration settings or set up a proxy server; "MS08-067", "vulnerable API in memory"...Over my head.
I can't get rid of this thing, and would appreciate any ideas you might have.
I've tried numerous anti-viral and anti-spyware programs that you can download here at Cnet, either they won't install, or they won't run. Spyware Terminator runs, detects a "backdoor" and an "affiliated cookie", but says it can't be removed. I can't remove them manually, because the file does not exist where Spyware Terminator says it is.
Microsoft OneCare online scan did the same thing; found some files it declared high risk, but said it could not remove them. I actually did find the indicated files, and recycle bin'd 'em, but the effects of the virus remain: DSL internet connection that gets progressively slower over a short period of time...Google, or other search engines redirecting to "Cyberdefender" or "Stopzilla" when you click on search results for antiviral programs, eventually getting redirected to other sites, no matter what you are searching for..."Connection failed" whenever you directly type in the URL for anti-viral sites, whether using Firefox or Explorer...
Listen, for awhile it got so bad, that when I restarted my computer, it would'nt restart, not even in safe mode! I could only get it to boot up in "directory Services Repair", whatever the hell that is. And I STILL could'nt get antivirus sites to connect or download.
ANyway, I finally got clever, and had my buddy download WIndows Malicious Software removal tool,(which is supposed to remove Conflicker) and AVG 8.0, rename them, and send them to me.
I got them installed, was ecstatic about getting this virus that's been screwing up my computer for a week off my machine, and...
The Windows tool has declared my system clean; Every time I try to update AVG, it won't allow a connection to be established. I could be online already, and it still says that.
Does anybody know of like, maybe a mirror site? One that could update AVG, that dose'nt have the phrase "AVG" in the URL? Would that even work?
I have even tried reloading WIndows itself, (XP, by the way) and risked the loss of all the games I have installed...It won't let me re-install WIndows even!! Whether I try to reload with it already running, or try to reboot from the disk with that "F8" thing, it locks up with only an MS-DOS looking underscore at the top of the screen, and it stays like that, even if you wait for like 30 minutes.
So, like I said, if anyone had any ideas, please let me know
Like I said, I'm no expert, I'll tell you what's in my computer, if that helps to diagnose the problem...
Windows XP sp2 (or 3, the virus screwed that update as well)
Intel Core 2 Duo Processor E6750 2.66GHz 1333MHz 4MB LGA775 CPU
Asus P5B SE LGA775 motherboard
Western Digital WD2500KS 250GB SATA2 7200rpm 16MB Hard Drive
KINGSTON 2GB DDR2 800MHZ PC6400
nVidia GeForce 8600GTS 512MB 2DVI/HDTV PCI-Express Video Card
Creative Labs Sound Blaster Audigy SE 7.1 24-bit Sound Card
ROSEWILL 10/100/1000 Mbps PCI Adapter
I know (I think) that hardware items can't get infected with viruses, but how could this thing evade so many cleaning programs? I just pasted my system specs here, maybe one of these devices is susceptible to a problem? Obviously I'm desperate.
Thanks in advance for any advice you have.
Im a PC NOT!!!!!
- by Brando2494 February 5, 2009 7:35 PM PST
- Ok so its clear there is an epidemic. The question is what program will protect my computer!!
- Like this Reply to this comment
-
Showing 1 of 2 pages (49 Comments)