Get Smart about Business Spending
Latest Conficker worm gets nastier
The authors of the latest variant of the Conficker worm are upping the ante against security vendors who are working to stop the spread and threat of the persistent program.
Conficker.C shuts down security services, blocks computers from connecting to security Web sites, and downloads a Trojan. It also is programmed to begin connecting to 50,000 different domains on April 1 to receive updated copies or other malware, as opposed to connecting to 250 domains a day as previous versions are doing, Ben Greenbaum, senior research manager for Symantec Security Response, said on Friday.
The authors of the code are "strengthening their hold on their collection of infected machines at the same time they are attempting to strengthen their ability to control those machines by moving to 50,000 domains," he said.
A self-described "cabal" of companies, including Microsoft, Symantec, and a host of domain registration providers, have been trying to thwart the efforts of Conficker by pre-registering and locking up the domain names being used by the worm to distribute updates.
Now that Conficker.C is targeting 50,000 domains, the group has its work cut out for it, Greenbaum said. Regardless, "it's unknown at this point whether (boosting the domains) is an effective sidestep around the cabal's actions," he said.
The worm, also called Kido or Downadup, was first detected in November and is believed to have infected more than 10,000 computers. The first two versions exploit a vulnerability that Microsoft patched in October.
The second variant, Conficker.B, was detected last month. It added the ability to spread through network shares and via removable storage devices, like USB drives, through the AutoRun function in Windows.
Among the domains targeted by Conficker was that of Southwest Airlines, which was expected to see an increase in traffic from the botnet on Friday, Sophos said last week. However, a Southwest spokesman said there had been no impact to the site from any additional traffic as a result of Conficker.
Experts are urging computer users to apply the Microsoft patch and update their antivirus software. And this week, Enigma Software Group and BitDefender announced free Conficker removal tools.
Conficker has proved to be such a nuisance that for information leading to an arrest in the Conficker case.
Symantec has more technical and historical details on Conficker on its Web site.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
I highly doubt that even CHINA would want to be connected with these idiots.
Imagine having all that power, millions of machines that could work together to crush your enemy.
And taking down websites isn't going to work out so easily, sadly.
They have a hard enough time killing IRC rooms with botnets connecting. (worse when it is public rooms that are completely innocent)
Creating the international agreement is much harder than you think, Russia for example already have very lax laws when it comes to the internet.
With websites, it's even easier to do, because you just have to go to the domain registrar and inform them "Hey, this site is being used for a botnet..... remove it from your listings permanently and lock the domain forever."
It could be me, it could be Elinor, it could be Bill Gates himself, they will just never be able to find this person. (and i'm not the kind of person who throws "never" around carelessly)
Somehow, i don't think Microsoft realize how easy it is to sneak into someone's wireless, inject some worm and that's it.
Props if they actually used a massive wireless hotspot (train stations, hotels, etc), so many people leave their connection easily open, shares, etc.
There are so many ways they could have gotten this thing online.
And lets say that they find a hotspot that it appears to be uploaded from (most likely scenario),
1) IDing the person is pretty slim,
2) You'd have to search every single person who goes through there, day in, day out,
3) It isn't exactly hard to have an innocent computer with some malicious code saved entirely in RAM, uploaded with a spoofed address, then RAM drive "self destructs" and shreds its own driver.
The chances of finding the creator are pretty much 0%.
The only chance is if the person admitted it.
It is better to say, not likely.
How would you know if you had one? Well I have written an application that will periodically check for SHA1 checksum of all the running applications and if the SHA1 checksum does change (via updates etc), then it will notify me. Then...you know or just monitor the applications that run in the background and registry settings etc
So basically, you're running a homemade antivirus without the possibility of moving it into quarantine or simply deleting it completely from your system.
You may argue that it does more. I agree, your program does more, but it's still doing the same job without some of the bells and whistles.
Another thing you are missing is that all anti-malware software is behind the curve, they are reactive, not proactive. If you are expecting them to save you, you will eventually be in for a rude surprise.
As to being reactive and not proactive...... yeah, they are, because that is the best way to do things without handing over processor cycles unnecessarily to these programs all the time.
1) don't use Windows
2) don't connect to any device or any service that is not already loaded onto your computer, including installing software, just in case the manufacturor of that software was infected prior to the creation and distribution of that software.
If you want to avoid this virus: be sure to scan anything you download from a 'flaky' source (and any site that you are not ABSOLUTELY SURE of the files coming off it like Download.com or MajorGeeks is a flaky source!). Also, use Vista with UAC running. This thing CANNOT get automatically installed on a Vista system with UAC on it, you would have to KNOWINGLY allow the program to run that has this thing attached to it.
OS X has trojans, no viruses though. Linux has viruses. They're well documented, there are even instructions on how to install them on your machine since they don't spread. I mean, the only way to get a virus on Linux is to build it yourself.
By the way, the thing you're talking about that can't get installed on a Vista machine with UAC on. Yeah, it's gotten on Vista machines with UAC on. In fact, until the patch got through, it was flying right by UAC. With the patch, it's still spreading to other machines, all Windows.
So tell me something, how exactly is the solution of not using Windows NOT a legitimate way to avoid the "virus"?
Oh, and another thing, Conficker is a worm, not a virus, and I use Linux, not Mac. Get your facts straight. Notice I neglected to call you by any derogatory names throughout my response, do try and grow up. Adults don't use name calling as a debate tactic.
*cough* *cough* *hack* *cough*
"kill me, pleaseee"
Ohh Mojave!
Name one. Just one, this is all I am asking.
Oh yeah, trojans don't count. Has to be a real virus.
DO NOT USE WINDOWS
That removal tool worked for a friend of mine and as far as I know from my experience with BitDefender, it won't miss a thing if it's up to date and you have tweaked a little the configuration.
mac is ****, because theres nearly no software for it.
muhahahahaha, windows rulezzzzzzzzzzzzzzzz
I guess Microcrap never told you guys about the TAX you have to pay for paying for such a cheap unstable piece of crap
Windows is like a Venereal Disease, If you dont use protection You are bound to get a BUG
I said screw it and formatted the drive and re-installed windows. Probably a little extreme but worth it not having to worry about what's going to happen next.
Like I said I have no idea how I got it. One day it was fine the next it was hosed.
BitDefender, I trust.
But my research tells me that Enigma is NOT a reputable source of anti-malware programs. BEWARE,
If it were to be infected with it or something I'd surely go with BitDefender that already proved useful on my friends' computer earlier this week. :)
<a href="http://members.apex-internet.com/sa/windowslinux">http://members.apex-internet.com/sa/windowslinux</a>
destroy all windows machine
Tommy Linux
LOL
a cross platform virus/malware/worm all possible via a simple programming language. so? be it windows, linux, bsd, solaris, aix, hpux and last but not least THE MAC FAN BOYS, good news for you, assembly works in MAC too, see http://developer.apple.com/DOCUMENTATION/DeveloperTools/Reference/Assembler/Assembler.pdf has assembler info for PPC/PPC64 macs. so macs will get prolly screwed more than windows. now if you know assembly and IPC well? then you can write not one but trillion virus/bacterias/FUNGUS/worm/et al for MAC. now beat this MAC. so all your CLAIM on cross platform, i.e. a virus which works on all platform and MAC is good will be squashed soon. and anyway, assembly doesnt give a 2 cent screw if its PPC/i386/ia64/Sparc/ARM/x86_64 et al. if someone knows PPC arch and knows assembly inside out? YOU MAC USERS might think of changing arch? well lemme know i got some USED PC's. since assembly works in all kind of arch, all are screwed. hehehe. this is hilarious, not just intel or amd or sparc or anything. all are equally severely screwed.
MOV MAC
hopefully now annoying MAC screamers will get angry, that mac is safe. your boat fusilage got holes too man?!. yes a ? & ! & . bahahahahaha! and you will also sink along with us MAC users. hehehehe! LOL.
and who knows, if someone good with PPC assembly might have already written a few lines and prolly playing with your PPC. bahahaha!
ciao!
asm + c + IPC = MAC PISSED MAD! ;-)
so proudy mac users and a simple hint on assembly may shut their boasts. bahahahaha! sad MAC FANS SAD, here my 2 drops of crocodile tears. :((
good luck MAC and PPC/PPC64 ;-)
- by illmaticscripts April 13, 2009 9:22 AM PDT
- <embed src="http://i.ehow.com/images/widget/rss.swf?feed=http%3a%2f%2fwww.ehow.com%2fWidgetRss.aspx%3fuserId%3d9052aee7-f8bd-4683-8873-fdb6b9319f8a" width="300" height="450" allowScriptAccess="always" type="application/x-shockwave-flash"/><br><a href="http://www.ehow.com/videos.html" target="_blank">How to Videos</a> & Articles: eHow.com
- Reply to this comment
-
(43 Comments)