Warning - conficker

[Dominique]

http://en.wikipedia.org/wiki/Conficker

Symptoms

Account lockout policies being reset automatically.

Certain Microsoft Windows services such as Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender and Error Reporting Services disabled.

Domain controllers responding slowly to client requests.

System network becoming unusually congested.

Websites related to antivirus software becoming inaccessible.

It is said that this worm will receive instructions to go off and do something on April 1st, and may disrupt the entire web. Read the articles, get virus scans and protection!

[universal4]

This is being cross posted on a few forums that I frequent so I apologize if anything in the post is redundant information.

There has been a bit of media hype associated with a worm that is set to launch it's payload on April 1st. Actually April 1st has been a launch date that hackers have used in the past so this is actually nothing new.

To add to the hype, it is constantly being reposted as others read the reports which sets off a bit of a chain reaction and adds to the hype.

The actual update that fixed this vunerability was released on 10-23-08
http://www.microsoft.com/technet/sec.../MS08-067.mspx

Since the update has been out for more than 5 months, if you run windows updates even on an occassional basis, you likely already have this update. This patch was issued AFTER Service Pack 3, so if you are one that usually only applies service packs and usually not individual updates you should apply this specific one.

If you want to make sure your system is patched, just take a look in add remove programs in the control panel.

Click Start
Control Panel
Add or Remove Programs
Click the check box for Show Updates
Drill down and look for an update labeled
Security Update for Windows XP (958644)

If you do not have this update in the list, I recommend you go to windows update and take all the critical updates available.

Now, I am not saying that we will not see any cases of this since there are hundreds of thousands of unpatched systems out there...(especially those still running the original version of XP (Devil's Own) which can not run updates) and it will spread since it attacks antivirus software and looks for open shares....but....

Most antivirus software on the market recognizes and combats this worm so I do not think it will be as bad as the media is trying to make it....they just like to sensationlize anything they get their hands on....and in reality I think many would like to see it bad so they can say...."See WE told you about this last week blah blah blah" plus it would give them more sensational news to report on....

Now if anyone has any specific needs related to this or any other security concerns, I am available to help and consult with you to get you past your concerns.

Rick
Universal4

PS: Normally this would not be treated as a GIA Announcement but the hype behind this worm has been growing the past few days. If it draws a lot of responses the thread may be moved to a more appropriate forum.

[FurnessPoker]

Is it going to be another "MIllenium" scare - something that wont happen, I am sure with the right Virus protection we are all safe

[kwblue]

Is it going to be another "MIllenium" scare - something that wont happen, I am sure with the right Virus protection we are all safe

Although the Milennium scare prompted a LOT of companies to resolve issues prior to an issue coming about. I work in the manufacturing arena as well and there were many old controllers that would have been in trouble had that 'scare' not been forwarned. It would have shut down some facilities for a long time waiting for 'fixes' and new parts (i.e., CPU's, Eproms, etc..)

[TheGooner]

Is it going to be another "MIllenium" scare - something that wont happen

As with KWBlue - I worked in the IT area (in banking at the time of the turnover).

It was not a con or hype - inaction would have meant it was a company ending event - in fact it was so important that that's probably why everything went so well. It all had to work - no second chances.

For the last 18 months prior to 2000, I'd estimate that fully half the systems staff were working on Y2K changes to avoid problems. There were many fixes and small patches that were required.

And it went way past internal computer systems.

We tested as far as phone systems, security systems, power supplies, money machines and even card processing centres and found many small errors that would have caused confusion, halt service and many days / weeks of "outage" if they had not been detected.

There were literally 1000's of changes in my company, both internally and with external equipment suppliers and many millions of dollars in wages were spent making sure that nothing was going to go wrong.

I didn't come cheap, and there was an "army" of people employed test, retest, and be absolutely sure that everything would work.

That being said, I must admit that on the night I was still amazed at how problem free things went - I had half expected the power to go out, traffic lights to freeze and phones to stop working ...

I had my bundle of cash ready, plenty of supplies (food, water, fire wood) and wondered what Doh! Doh! Doh! was going to hit a vital piece of infrastructure.


But generally all was well ...


---------

Regarding the April 1st Virus.

I do agree that most computer / internet professionals that keep up to date and have appropriate virus checkers and firewalls will be ok.

However, I still expect that the 50% of computers that are out there are vulnerable - and maybe we will see a flood of spam - and stories of more people being affected.

[giggles7p]

Am i screwed?

I run windows xp home edition, 2003, i have tried and tried to download the service pack 2 update, but for some reason my windows will not install it? i have tried over and over, and the one time it did install, nothing worked? had to uninstall. But there are updates out there that i can't download without service pack 2? what do i do? i have auto updates sent to my computer, and they all install, except sp2, and anything that needs sp2 to install.

what can i do? Gooner i am going to go check my programs right now to see if i have this update already on my cpu. i hope so.

thanks for the help

pat

[pgaming]

may disrupt the entire web

Was mentioned at the annual Defcon Rally for 2008. Very interesting a Trojan written for Unix could infect data centers globally. Just a matter of time I assume.

Similar to what MafiaBoy accomplished back in 2000. Young Canadian shutting down Yahoo, Dell, ebay, CNN ah he was just testing out firewalls. Causing more billions of dollars in damages.

I suppose the best advice ever given to me would be, always assume your P.C is infected. This way securing your system will be the number one priority.

greek39

[giggles7p]

ok, i do not have that important file, and i went to microsoft and tried to install that damn service pack 2 program, and it starts to install and then i get this error message "can not read or write to data base"? what can i do? helppppppp.


thanks
dazed and confused in ct.

[universal4]

That is interesting giggles.

First of all, what time zone are you in?
Are you behind a router?
Do you run a software firewall like ZoneAlarm or Norton/Symantec/McAfee?

If you would like a bit of help with this, let me know and I will see if I can help you get sp2 or sp3 installed.

I have not downloaded that specific update independantly, but I will see if I can grab it by itself.

It's 11pm here on east coast and I will be up working for a bit, or I can help you tomorrow, drop me a message here or at the GIA and we can discuss options for you.

Rick
Universal4

[giggles7p]

LOLLL, PM sent, don't read the first one, it will just confuse the crap out of you!! be warned!!
lollllllllllllllllll]
thanks rick, your the best

pat

[universal4]

Got your pm's...

Must be something wrong with me since I understood every one of em....LOL

Rick
Universal4

[giggles7p]

lolllllllllll

too funny

[raphnix]

This could end up like some of those warning spywares from some antivirus sites. Though being persuaded by those hype sometimes beneficial to those who are too weary about worm attacks on their websites.

I remember the scares always sent in my messenger and email inbox.

[universal4]

raphnix, the actual threat of this worm is real, I just don't know if it was worth the amount of hype it recieved.

I am actually more concerned about the one that is supposed to attack the routers, I forget the name of that one right now.

I guess we'll know tomorrow.

Rick
Universal4

[Anthony]

Since we are talking about viruses and worms...
What virus protection is everyone using?
Does one stand out from the rest?

[offyourface]

I use avg and I've never had a single problem with a virus.

Since we are talking about viruses and worms...
What virus protection is everyone using?
Does one stand out from the rest?

[Anthony]

Using the free version?

[offyourface]

No, its the paid version.

[Holland87]

I use the AVG free version. Have for years now and no problems at all.

[VegasBaby]

I dealt with a couple really nasty viruses last year and have since become paranoid. I am running updates and such today just to be sure. Nothing worse than being non operational for a day or more. Thanks for the heads up.