Regarding the noted "super worm", aka Conficker.B and Downadup

[vi edit]

This thing continues to be brutal to us. Today it managed to get into some of our application servers and grab the logged in enterprise level admin account that runs enterprise application services across multiple campuses and tried cracking the password on those accounts.

It locked out the domain account bringing the services that run under the account down and thus killing the applications that require said services.

We've had infections down to a handful of machines only to jump up into the several hundred mark in a matter of hours.

I have never seen such a smart, viscious, and hard to squash virus.

 

[Chiefcrowe]

wow that is Crazy!!! how do you think it got into your systems? USB drives?

Originally posted by: vi edit
This thing continues to be brutal to us. Today it managed to get into some of our application servers and grab the logged in enterprise level admin account that runs enterprise application services across multiple campuses and tried cracking the password on those accounts.

It locked out the domain account bringing the services that run under the account down and thus killing the applications that require said services.

We've had infections down to a handful of machines only to jump up into the several hundred mark in a matter of hours.

I have never seen such a smart, viscious, and hard to squash virus.

 

[Chiefcrowe]

Conficker Virus to Attack Southwest Airlines Web Site

http://www.switched.com/2009/0...gsmith_inpage_switched

 

[Chiefcrowe]

Romanians find cure for conficker

http://www.computerworld.com.a...ns_find_cure_conficker

 

[Chiefcrowe]

Conficker.C primed for April Fool's activation


http://arstechnica.com/securit...l-fools-activation.ars

 

[biggestmuff]

Here's some really great, in-depth analysis of Conficker:

Conficker analysis

 

[ricleo2]

You are the man, mechBgon!

 

[Chiefcrowe]

'60 Minutes': What's next for the Conficker worm?

http://news.cnet.com/8301-1009_3-10206784-83.html

 

[Chiefcrowe]

an update on what it is doing now:

http://www.itpro.co.uk/610478/...t-of-conficker-strikes

 

[Red Squirrel]

This is a bit OT, but you can have autorun on USB drives? How is that setup? I've run into several situations where I wanted to do this (such as a winaudit key to audit many PCs) but found that autorun does not work.

 

[balloonshark]

Post #14 in this thread gives a good summary on conficker. http://www.wilderssecurity.com/showthread.php?t=236407

 

[smallrabbit]

Conficker is indeed a worm no.1 these days. To be honest it is a masterpiece. Unfortunately a bad one.
Conficker/Downadup/Kido can be successfuly removed in various ways. Basic way provides Microsoft with their software malicious removal tool. More advanced tools and also free have been developed by Sophos, Norman and McAfee.
Sophos Conficker removal tool is actually pretty good. You can use those tools as a precautios and scan your computer for Conficker infection. Just to make sure.
If you need more information and download, read this BitDefender article.

 

[Chiefcrowe]

Conficker also installs fake antivirus software

http://news.cnet.com/conficker...ke-antivirus-software/