Conficker worm aka skynet

[palswim]

Hopefully tomorrow's headline: Cabal Wins... Fatality!

 

[Cabages]

I am just going to do a clean Vista install, just in case...

 

[JS80]

Guys...the Conficker Cabal IS THE VIRUS!!

 

[seemingly random]

Originally posted by: will889
Here's an updated Mcafee stinger tool for Conficker.

Text

Just ran this on a pc with vista. It crashed while scanning an .iso file. Also, the drive had many files - 100k+.

 

[seemingly random]

Originally posted by: Joemonkey

Originally posted by: Demon-Xanth

Originally posted by: seemingly random
Since it's april 1 somewhere in the world right now, it seems that the question can now be answered.

March has 31 days.

OK, so what about now?

We're not looking at this correctly. Common sense doesn't fit into the news cycle...

 

[sygyzy]

Originally posted by: Modelworks

Originally posted by: Gunbuster
So why cant they monitor what it's checking for timesync and then forge the responses to set off the thing and find out where it will pull new instructions from. Then just DDOS that site.

It uses some 50,000 sites and creates hundreds more randomly on a daily basis. Time is pulled from websites like google, yahoo, facebook via the normal browsing experience. Blocking major sites like that would be impractical. That is why the creator(s) probably chose that method.

It is also using RSA encryption to protect its code and SSL to protect the data it sends/receives.

Are you sure about your statements? From the whitepaper:

Unlike the domain generation algorithm, which retrieves a GMT value from remote hosts, this new check is performed against the host's clock. Computers that have their clock set to a future time will already try to download updates.

 

[nobody554]

Originally posted by: sygyzy

Originally posted by: Modelworks

Originally posted by: Gunbuster
So why cant they monitor what it's checking for timesync and then forge the responses to set off the thing and find out where it will pull new instructions from. Then just DDOS that site.

It uses some 50,000 sites and creates hundreds more randomly on a daily basis. Time is pulled from websites like google, yahoo, facebook via the normal browsing experience. Blocking major sites like that would be impractical. That is why the creator(s) probably chose that method.

It is also using RSA encryption to protect its code and SSL to protect the data it sends/receives.

Are you sure about your statements? From the whitepaper:

Unlike the domain generation algorithm, which retrieves a GMT value from remote hosts, this new check is performed against the host's clock. Computers that have their clock set to a future time will already try to download updates.

Also from the whitepaper (page 11)

In a first step, a public web-site is queried in order to get a response that includes the current time based on
GMT. Conficker.A and .B randomly contact one of the following web-sites:
! baidu.com
! google.com
! yahoo.com
! msn.com
! ask.com
! w3.org
Conficker.C uses three more web-sites in addition to those above:
! facebook.com
! imageshack.us
! rapidshare.com
Selecting such high profile websites as these for time synchronization makes it almost impossible for system
defenders to simultaneously disable all target time sources in a co-ordinated effort.

 

[Modelworks]

Originally posted by: sygyzy

Originally posted by: Modelworks

Originally posted by: Gunbuster
So why cant they monitor what it's checking for timesync and then forge the responses to set off the thing and find out where it will pull new instructions from. Then just DDOS that site.

It uses some 50,000 sites and creates hundreds more randomly on a daily basis. Time is pulled from websites like google, yahoo, facebook via the normal browsing experience. Blocking major sites like that would be impractical. That is why the creator(s) probably chose that method.

It is also using RSA encryption to protect its code and SSL to protect the data it sends/receives.

Are you sure about your statements? From the whitepaper:

Unlike the domain generation algorithm, which retrieves a GMT value from remote hosts, this new check is performed against the host's clock. Computers that have their clock set to a future time will already try to download updates.

Two checks. First is for generating domains, taken off the http header. Second check for updates to the program taken off host clock. There is also a CMP instruction that takes place nobody is sure the result of until tomorrow.

Most malware you know what its aim is and what it is going to do. steal passwords, or delete files, redirect you to a site. This one really has not done anything yet except infect and create dummy sites. It just seems to quietly sit in the background spreading itself.

 

[ballmode]

self aware?

 

[spidey07]

Originally posted by: Modelworks


Two checks. First is for generating domains, taken off the http header. Second check for updates to the program taken off host clock. There is also a CMP instruction that takes place nobody is sure the result of until tomorrow.

Most malware you know what its aim is and what it is going to do. steal passwords, or delete files, redirect you to a site. This one really has not done anything yet except infect and create dummy sites. It just seems to quietly sit in the background spreading itself.

And I've said all along that when get get a worm that works over SSL for it's payload/instructions we're screwed. This is one nastly little ah heck.

 

[KLin]

OMFG NUCLEAR WAR IS COMING!!!! :Q :Q :Q

 

[will889]

Originally posted by: seemingly random

Originally posted by: will889
Here's an updated Mcafee stinger tool for Conficker.

Text

Just ran this on a pc with vista. It crashed while scanning an .iso file. Also, the drive had many files - 100k+.

Interesting - I used it along with some f-secure apps -- with one Vista install and 3 XP installs today (clients) and no issues. I hope you had a backup?

 

[dennilfloss]

Those two tools say my memory and hard disks are clean. Got my Comodo firewall and Norton AV 2009 all setup for realtime.

http://support.kaspersky.com/faq/?qid=193238496
http://vil.nai.com/vil/averttools.aspx

 

[Triumph]

Originally posted by: nobody554
From here.

Your first step should be the tools you already have: Windows Update, to make sure your computer is fully patched, and your current antivirus software, to make sure anything that slips through the cracks is caught.

But if Conficker's already on your machine, it may bypass certain subsystems and updating Windows and your antivirus at this point may not work. If you are worried about anything being amiss -- try booting into Safe Mode, which Conficker prevents, to check -- you should run a specialized tool to get rid of Conficker.

So all I have to do to check and see if I have it, is to try and boot in safe mode? That's easy enough, no more work for me! I haven't been on Windows Update in about 6 years.

 

[Modelworks]

Originally posted by: Triumph


So all I have to do to check and see if I have it, is to try and boot in safe mode? That's easy enough, no more work for me! I haven't been on Windows Update in about 6 years.

I hope the pc you are using is not on a network. Not patching any OS for long periods of time , like years, is really asking for trouble.,

 

[Triumph]

Originally posted by: Modelworks

Originally posted by: Triumph


So all I have to do to check and see if I have it, is to try and boot in safe mode? That's easy enough, no more work for me! I haven't been on Windows Update in about 6 years.

I hope the pc you are using is not on a network. Not patching any OS for long periods of time , like years, is really asking for trouble.,

So is that a yes to the safe mode thing?

 

[seemingly random]

Originally posted by: will889

Originally posted by: seemingly random

Originally posted by: will889
Here's an updated Mcafee stinger tool for Conficker.

Text

Just ran this on a pc with vista. It crashed while scanning an .iso file. Also, the drive had many files - 100k+.

Interesting - I used it along with some f-secure apps -- with one Vista install and 3 XP installs today (clients) and no issues. I hope you had a backup?

Sorry, that was grammatically vague. The stinger app crashed - no data loss.

 

[archcommus]

Is there anything in particular normal users should do to prepare for this nasty little ah heck tomorrow?

 

[Acanthus]

CYBER CABALS

 

[JackBurton]

We'll see how tomorrow goes. We're up to date on all our Windows patches (we've been patched for this particular security hole for a long time), AV up to date, and everyone is running with limited user rights.

 

[GTaudiophile]

Well, all seems to be well in Australia, Japan, etc.

I'm sure they would start to see the effects of Conficker first.

 

[Acanthus]

Originally posted by: GTaudiophile
Well, all seems to be well in Australia, Japan, etc.

I'm sure they would start to see the effects of Conficker first.

It could be going by GMT or a certain time zone.

 

[Dominato3r]

Your making the cisco guys feel like heros =D

 

[Canai]

http://www.microsoft.com/

Down for anyone else? Could maybe be that time?

 

[IEC]

Originally posted by: Canai
http://www.microsoft.com/

Down for anyone else? Could maybe be that time?

100% working for me.