Many dangerous malware around just now
Conficker Worm Spikes, Infects 1.1 Million PCs In Less Than 24 Hours
It has been over a month since we heard much about Conficker, but the worm has reappeared with a vengeance over the past seven days. According to Finnish security company F-Secure, more than one million PCs have been infected with the worm (also known as Kido or Downadup) in the past 24 hours, with a total of 3.52 million machines infected worldwide. According to F-Secure, that 3.52 million is a conservative estimate.
The problem isn't so much with the older version of Conficker (now known as Conficker.A) but with a new flavor, dubbed Conficker.B. Ars spoke with Roger Halbheer, Chief Security Advisor of Microsoft's EMEA (Europe, Middle East, and Africa); he's been monitoring (and writing) about the current spread of infections. The skyrocketing infection rate is actually being caused by several factors; Roger describes Conficker.B as a "beast," and Microsoft has built a diagram to demonstrate how the worm functions.
Once run or given access to an unprotected machine, Conficker.B begins searching for other systems or shares within the local network that it can infect. Shared systems, removable drives, or unpatched systems are all eligible targets, as are machines with weak passwords. This last bit is an important new feature of Conficker.B; a complete list of the passwords it checks for can be found here. If Conficker.B manages to successfully guess a password, it moves in and continues hunting for new targets. Microsoft summarizes the new strain as follows:
Worm:Win32/Conficker.B is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. It may also spread via removable drives and weak administrator passwords. It disables several important system services and security products.
Roger confirmed that the Malicious Software Removal Tool (MSRT) has checked for and removed Conficker.B since December 29, 2008, but it's not possible to access any Microsoft website once Conficker.B has infected a system; the worm blocks access to multiple domains based on string identification. If you've got a system that's infected, you'll need to download the latest MSRT from Microsoft on a clean system and run it manually.
Not all AV scanners currently detect Conficker.B, even if they've been updated to detect Conficker.A?I don't have a list of specific solutions that can't currently catch the new worm, but all of Microsoft's antimalware/antivirus products?Forefront, OneCare, and the Online Safety Scanner?will find Conficker.B if it's present (and you somehow haven't noticed). If there's a scrap of good news in all this, it's that Conficker.B is not a subtle worm.
Roger has provided some additional coverage on the worm that may be useful. First and foremost, he recommends installing MS08-067?this will not remove an existing infection, but it will guard against attack from either version of the agent, provided you aren't using weak passwords.
When Conficker.A first appeared, we raised the question of whether or not Microsoft should force updates in certain situations, and what those situations might be. In this case, even unilaterally enforced updates wouldn't solve the problem of weak passwords, but it would have undoubtedly cut the number of new infections we are seeing today. The size of that reduction would be the point on which the value of forced updates would turn, and of course, that's the one thing we can't predict; there are holes in existing AV products that would allow Conficker.B through, and the worm will attack and infect machines using weak passwords. Depending on how you view the situation; this second strain could reinforce the need for mandatory updates or blow a whole in the argument.
Part of the reason for the problem, however, must inevitably come back upon the users, IT administrators, or managers that opted not to install the patch. As Roger writes: "If you decide not to roll out a security update which is so critical that we decide to go out of band, you play Russian Roulette with your network...The same is actually true if you do not run and maintain an appropriate Anti-Malware solution...Now, if we look at Conficker.B: This is really an ugly beast: You need just one infected machine in your network in order to have it spread across your network fast and aggressively. You can get it even through a USB-stick...it just needs one unpatched/infected machine."
Indeed. Based on the characteristics of a worm such as this, even mandatory updates would only be one facet of prevention.
I managed to clear down and out this beast through the Malware Protection Centre.
Malware Protection Center - Entry: Worm:Win32/Alcan.D
This is what it picked up:
Worm:Win32/Alcan.D is a worm that spreads via peer-to-peer (P2P) file sharing networks. Worm:Win32/Alcan.D downloads and runs files from remote websites and may interfere with security software installed on the system.
Backdoor:Win32/RBot
Win32/IRCBot.worm.variant (AhnLab)
W32/Ircbot.1!Generic (Authentium (Command))
Win32/Rbot!generic (CA)
Win32/Rbot.Y (ESET)
Backdoor.Win32.Rbot.gen (Kaspersky)
W32/Sdbot.worm.gen.g (McAfee)
W32/Spybot.BPUM (Norman)
W32/Rbot-GR (Sophos)
W32.Spybot.Worm (Symantec)
WORM_SPYBOT.GEN (Trend Micro)
AVG did not detect/block any of it
Some more help here;
StopBadware.org - How can I get rid of badware?
However, there is a much more dangerous virus spreading throughout the world right now - Antivirus - it appears from any site warning that your computer has been infected and click a button to detect and clear. It is presented on the normal WINDOWS format with the Windows emblem. DO NOT be tempted. If you click on any button on that warning sign, it immediately downloads onto every part of your PC and clings. You cant clear it completely even with Microsofts help or AVG etc. You think you have cleared it but its STILL there. There is only one way - Kasperskys, the best in the world. It not only found the remains on my laptop of that brute, it cleared out sites that had it and cleaned up my laptop. The difference was VERY noticeable in both speed and performance. I highly recommend it and you can have a 30 free trial. It is very expensive but it is worth it, you get what you pay for and these days there is so much Malware out there, your norm antivirus.spyware detectors wont pick them all up. I only got it because I was working and I had so much to do, I was using my laptop and my SuperMACBook at the same time for referrals.
Once you have a MAC - you never go back!!!!!!!!!!!
Windeguy you are incorrect about pricing. I bought my nearly new Macbook for $800. There are also lots of reconditionned ones for sale from Apple,
(Get better soon Steve)
Take care of your equipment. All these Malware about just now are very sophisticated.
Good luck
