Jump to content

Conficker worm gets an evil twin


Recommended Posts

  • Replies 5
  • Created
  • Last Reply
Guest Shenan Stanley
Posted

~BD~ wrote:<span style="color:blue">

> The criminals behind the widespread Conficker worm have released a

> new version

> of the malware that could signal a major shift in the way the worm

> operates.

> http://cwflyris.computerworld.com/t/439629...83302/170414/0/</span>

 

Just to get rid of any FUD, if you were patched, you still are.

 

Just because there is a new variant of the worm (one that can do more)

taking advantage of the possible hole in security doesn't mean that it can

now magically get past the fact you should have filled in the hole long ago.

The danger still only applies to _unpatched_ machines and to people not

using updated AV who might plug things in/run things randomly/foolishly.

 

Reference material:

 

MS08-067

http://www.microsoft.com/technet/security/...n/ms08-067.mspx

Malicious Software Removal tool

http://www.microsoft.com/security/malwareremove/default.mspx

History: Win32/Conficker.B

http://www.microsoft.com/security/portal/E...n32/Conficker.B

 

 

Though systems which have already applied the out-of-band released

MS08-067 (http://www.microsoft.com/technet/security/...n/ms08-067.mspx)

in October 2008 are protected, unpatched system users have

experienced system lockout and other problems.

 

Last week, a version of the Malicious Software Removal tool

(http://www.microsoft.com/security/malwareremove/default.mspx)

(MSRT) was released that can help remove variants of

Win32/Conficker and other resources.

 

 

Some Background:

 

Win32/Conficker.B

(http://www.microsoft.com/security/portal/E...n32/Conficker.B)

exploits a vulnerability in the Windows Server service (SVCHOST.EXE)

for Windows 2000, Windows XP, Windows Vista, Windows Server 2003,

and Windows 2008. While Microsoft addressed this issue in October

with Microsoft Security Bulletin MS08-67

(http://www.microsoft.com/technet/security/...n/ms08-067.mspx),

and Forefront antivirus and OneCare (as well as other vendor's anti-virus

products) helped protect against infections, many systems that have not

been patched manually through Server Update Services and

Microsoft/Windows Update or through Automatic Updates have recently

come under attack by this worm. Attacked systems may lock out users,

disable update services and block access to security-related Web sites.

 

 

In response to this threat, Microsoft has:

 

Updated the January version of the MSRT to detect and remove

variants of Win32/Conficker.B. You can download this version from the

MSRT from either the Microsoft Update site

(http://www.update.microsoft.com/) or through its associated

Knowledge Base article (http://support.microsoft.com/kb/890830).

 

Created the KB article 962007 "Virus alert about the Win32/Conficker.B

worm (http://support.microsoft.com/kb/962007)" to provide public details

on the symptoms and removal methods available to address this issue.

 

Announced the release of the items and the virus threat itself on

the Microsoft Malware Protection Center blog

(http://blogs.technet.com/mmpc/archive/2009...nd-banload.aspx).

 

It is hoped that these resources can assist you in resolving issues with

unpatched, infected systems and that you can apply MS08-067

(http://www.microsoft.com/technet/security/...n/ms08-067.mspx) to

any other unpatched systems as soon as possible to avoid this threat.

 

 

Really bored ?

http://mtc.sri.com/Conficker/

 

--

Shenan Stanley

MS-MVP

--

How To Ask Questions The Smart Way

http://www.catb.org/~esr/faqs/smart-questions.html

  • 3 weeks later...
Guest doneganw
Posted

Dear BD and Everybody Else,

 

I was a part of one of the Microsoft newsgroups dealing with security issues

about a month ago before I went OOBE. Was it this group?? Does anyone

remember me posting about the trojan Pro Antivirus 2009? I've lost touch

with which group.

 

(I also made a comment about psychologist Carl Jung that was unpopular with

some. I'm not intending to further that discussion. I merely mention that to

see if it jogs some memories about me in which group.)

 

Bye,

Will

 

 

"~BD~" <~BD~@nomail.afraid.com> wrote in message

news:OowpYh4kJHA.1168@TK2MSFTNGP05.phx.gbl...<span style="color:blue">

> The criminals behind the widespread Conficker worm have released a new

> version

> of the malware that could signal a major shift in the way the worm

> operates.

> http://cwflyris.computerworld.com/t/439629...83302/170414/0/

>

> </span>

Guest FromTheRafters
Posted

http://groups.google.com/group/microsoft.p...oneganw%22+oobe

 

"doneganw" <doneganw@att.net> wrote in message

news:4A17A53C-CE5D-458A-9C89-4D272E0DE049@microsoft.com...<span style="color:blue">

> Dear BD and Everybody Else,

>

> I was a part of one of the Microsoft newsgroups dealing with security

> issues about a month ago before I went OOBE. Was it this group?? Does

> anyone remember me posting about the trojan Pro Antivirus 2009? I've

> lost touch with which group.

>

> (I also made a comment about psychologist Carl Jung that was unpopular

> with some. I'm not intending to further that discussion. I merely

> mention that to see if it jogs some memories about me in which group.)

>

> Bye,

> Will

>

>

> "~BD~" <~BD~@nomail.afraid.com> wrote in message

> news:OowpYh4kJHA.1168@TK2MSFTNGP05.phx.gbl...<span style="color:green">

>> The criminals behind the widespread Conficker worm have released a

>> new version

>> of the malware that could signal a major shift in the way the worm

>> operates.

>> http://cwflyris.computerworld.com/t/439629...83302/170414/0/

>>

>></span>

> </span>

Guest doneganw
Posted

Dear TheRafters,

 

Thanks, I got it! Did you get this by using the search box??

 

Bye,

Will

 

 

"FromTheRafters" <erratic@nomail.afraid.org> wrote in message

news:uC6RwTEpJHA.1184@TK2MSFTNGP04.phx.gbl...<span style="color:blue">

> http://groups.google.com/group/microsoft.p...oneganw%22+oobe

>

> "doneganw" <doneganw@att.net> wrote in message

> news:4A17A53C-CE5D-458A-9C89-4D272E0DE049@microsoft.com...<span style="color:green">

>> Dear BD and Everybody Else,

>>

>> I was a part of one of the Microsoft newsgroups dealing with security

>> issues about a month ago before I went OOBE. Was it this group?? Does

>> anyone remember me posting about the trojan Pro Antivirus 2009? I've lost

>> touch with which group.

>>

>> (I also made a comment about psychologist Carl Jung that was unpopular

>> with some. I'm not intending to further that discussion. I merely mention

>> that to see if it jogs some memories about me in which group.)

>>

>> Bye,

>> Will

>>

>>

>> "~BD~" <~BD~@nomail.afraid.com> wrote in message

>> news:OowpYh4kJHA.1168@TK2MSFTNGP05.phx.gbl...<span style="color:darkred">

>>> The criminals behind the widespread Conficker worm have released a new

>>> version

>>> of the malware that could signal a major shift in the way the worm

>>> operates.

>>> http://cwflyris.computerworld.com/t/439629...83302/170414/0/

>>>

>>></span>

>></span>

>

> </span>

Guest FromTheRafters
Posted

IIRC Google Groups search for "doneganw" and oobe.

 

"doneganw" <doneganw@att.net> wrote in message

news:18337AC5-DC21-49AF-BE4A-BF4A7320CFDD@microsoft.com...<span style="color:blue">

> Dear TheRafters,

>

> Thanks, I got it! Did you get this by using the search box??

>

> Bye,

> Will

>

>

> "FromTheRafters" <erratic@nomail.afraid.org> wrote in message

> news:uC6RwTEpJHA.1184@TK2MSFTNGP04.phx.gbl...<span style="color:green">

>> http://groups.google.com/group/microsoft.p...oneganw%22+oobe

>>

>> "doneganw" <doneganw@att.net> wrote in message

>> news:4A17A53C-CE5D-458A-9C89-4D272E0DE049@microsoft.com...<span style="color:darkred">

>>> Dear BD and Everybody Else,

>>>

>>> I was a part of one of the Microsoft newsgroups dealing with

>>> security issues about a month ago before I went OOBE. Was it this

>>> group?? Does anyone remember me posting about the trojan Pro

>>> Antivirus 2009? I've lost touch with which group.

>>>

>>> (I also made a comment about psychologist Carl Jung that was

>>> unpopular with some. I'm not intending to further that discussion. I

>>> merely mention that to see if it jogs some memories about me in

>>> which group.)

>>>

>>> Bye,

>>> Will

>>>

>>>

>>> "~BD~" <~BD~@nomail.afraid.com> wrote in message

>>> news:OowpYh4kJHA.1168@TK2MSFTNGP05.phx.gbl...

>>>> The criminals behind the widespread Conficker worm have released a

>>>> new version

>>>> of the malware that could signal a major shift in the way the worm

>>>> operates.

>>>> http://cwflyris.computerworld.com/t/439629...83302/170414/0/

>>>>

>>>>

>>></span>

>>

>></span>

> </span>

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...