Comments on: Warning: Conficker worm infections gaining traction

By: Pedro Bustamante

Pedro Bustamante — Tue, 15 Sep 2009 09:51:40 +0000

@ComputerSupport, what you’re asking for is not really easy as Conficker creates system, read-only DLL files in Windows system directory with random names. It also creates .VMX files in the RECYCLER\random_name of all the shared and removable drives and modifies autorun.inf to make sure it is executed automatically (as well as a scheduled task).
The best thing you can do is to make sure all the endpoints are patched with MS08-067.
Alternatively use Panda USB Vaccine which can be deployed to multiple endpoints via login script or SMS to disable autorun on the machines and vaccinate USB drives.
More info on Conficker.C at
http://www.pandasecurity.com/homeusers/security-info/204292/information/Conficker.C

By: Computer Support

Computer Support — Mon, 14 Sep 2009 08:50:03 +0000

I’m trying to make sure this network (10k+) is safe from Conflicker. i cannot find the processes for this thing, and I’m trying to find a way to use SMS to find all the infections on the network, and another to find all the ones that are patched against it. anyone have a process list for Conflicker?

By: Pedro Bustamante

Pedro Bustamante — Thu, 09 Apr 2009 00:01:02 +0000

@virus,

please fill out your full name and contact information at https://tips.fbi.gov and tell them about your plans to infect other people with viruses. I’m sure they’ll be interested in what you have to say.

By: Pedro Bustamante

Pedro Bustamante — Wed, 01 Apr 2009 18:30:09 +0000

i want to know more about how to spread this worm? can anyone tell me how to infect others?

By: Pedro Bustamante

Pedro Bustamante — Wed, 01 Apr 2009 18:23:18 +0000

Would Conficker disable security sites on some computers, but not others? I ran a removal utility yesterday, and was able to download it from Symantec fine, as well as get to Microsoft’s website, but, upon restarting my computer according to the utility’s instructions, I couldn’t log in because I kept getting logged out by what I think might be Conficker.

I started the utility at 15:38 -8GMT, restarted at 17:00 -8GMT.

By: coffee fiend

coffee fiend — Wed, 01 Apr 2009 05:14:28 +0000

ironically, even if someone used Conficker to steal my credit card info, there wouldn’t be any credit there for them to exploit or spend

By: Pedro Bustamante

Pedro Bustamante — Mon, 30 Mar 2009 16:45:50 +0000

Part of the reason for this widespread attack are poorly configured Windows PCs running out there. The other reason are loopholes in Windows for allowing the exploits to work. Personally, I migrated over to Fedora 10 Linux and I couldn’t be happier. Now I don’t have to worry about all of these virus attacks, frequent maintenance and rebooting, and many other reasons.

http://members.apex-internet.com/sa/windowslinux

By: Pedro Bustamante

Pedro Bustamante — Tue, 27 Jan 2009 14:05:43 +0000

Hi!I have a Panda GPPromo 09 edition and I have the Error updating 12007 msg when I try to maually update.It means I’m infected with this Conficker?And sometimes when my Panda is updat/ed/ing (in 06,07,08 editions Panda IS ) the update normally broke my current downloads.Or when I play online during update…my game turns into Matrix slow motion.

By: Pedro Bustamante

Pedro Bustamante — Mon, 26 Jan 2009 09:11:00 +0000

Thanks for the link Aa’ed.

John, I imagine you’re referring to the picture on the post. It’s Wireshark network sniffer.

By: Pedro Bustamante

Pedro Bustamante — Sun, 25 Jan 2009 02:14:02 +0000

What is the cool program that did the trace of ip addresses?